An engineering notebook — homelab, networking, AI tooling, and other "how I figured this out" notes. Posts land here when I'm done staring at something long enough to make it work.
Browse by topic
Latest posts
- Counting bicycles part 2: recall and counting · 10 min read
Part 1 left two open questions: does the doorbell see enough street, and do bikes come back labelled person. Both got answered. This is the model swap to YOLOv9-s, a class-aware NMS patch that worked offline and did nothing in production, the Home Assistant counting layer, and a judge queue that turns the miss rate into a measurement instead of a guess.
- Counting bicycles with Frigate and a doorbell · 9 min read
How I set up Frigate on k3s to count bicycles passing the house using the UniFi G4 Doorbell Pro that was already there — the architecture, the stream and storage decisions, and the gotchas along the way: Protect has no bicycle class, local-path enforces no quota, a healthy pod that was detecting nothing, and a stream role Frigate assigned to itself.
- Building a charity site on Astro and Cloudflare · 4 min read
How we built a free, low-maintenance website for a neighbourhood children's Christmas market: a static Astro front-end, Cloudflare Pages Functions for the forms, Google Sheets as the datastore, Resend for email, and Turnstile for spam — all on free tiers, deployed from git.
- Books don't want an arr stack · 9 min read
I asked the obvious question — what's the Readarr for ebooks? — and learned, faster than I expected, that the arr model is the wrong shape for books. The clues: a metadata API that died and took Readarr with it, a download provider that was alive on my laptop and dead inside my cluster, and a pile of friction that turned out to be the architecture telling me I was forcing it. The fix was simpler than the thing I tore out, and it ends with reading stats syncing to a Kobo over WireGuard from a hotel.
- GitOps homelab part 5: where data belongs · 10 min read
Moving paperless off the Synology and into k3s sounded like a routine migration. What it actually taught me: a one-sentence storage principle that flipped my whole design, the official export tool that walked straight around a root-access wall, the same s6 trap that bit me three times, and a secrets controller that had been silently broken for eighteen hours — discovered only because this migration needed it.
- GitOps homelab part 4: the DNS that ate itself · 8 min read
The ads came back — not a filter problem, a redundancy problem. So I gave the homelab a second DNS resolver in Kubernetes, and watched a LoadBalancer on port 53 deadlock the cluster's own DNS into a perfect loop. Plus: collapsing 25 hand-edited split-horizon entries into one synced wildcard, why this very blog needed an exception, and DNS failover that's finally real.
- GitOps homelab part 3: the great migration · 8 min read
Two days after the platform was finished, it ate half my homelab: a Prometheus VM deleted, a nine-service media stack live-migrated behind a VPN gateway with a kill-switch, every reverse-proxy route moved into Git, and Nginx Proxy Manager reduced from 28 routes to one. Including the forgotten qemu-nbd from December that held a dead VM's disk hostage, and the UID whodunit that broke NFS.
-
Part 1 built a self-maintaining cluster nobody could reach. Part 2 makes it visible: a split-horizon DNS zone, Traefik ingress, Let's Encrypt wildcard TLS on a LAN-only cluster, External Secrets pulling from 1Password so Git never sees a credential again, and kube-prometheus-stack as the first real tenant — absorbed by the platform with zero per-service setup.
- GitOps homelab part 1: k3s, Flux, SOPS and Renovate · 7 min read
I rebuilt the foundation of my homelab in an afternoon: a disposable k3s VM on Proxmox, Flux watching a Git repo, secrets encrypted with SOPS and age, and a self-hosted Renovate bot that turns every upgrade into a pull request. Here's the whole build, including the wrong turns.
- Teaching my agent what to forget · 9 min read
I self-hosted Hindsight, then spent a day reading how people actually tune it before letting it run. The failure mode they all describe is baked into 'auto-everything' memory — and the fix is taking the pen out of the agent's hand.