7 posts · all tags
What started as an alert screen on a Raspberry Pi turned into PiDash: an iPhone app for my homelab’s alerts, incidents, Kubernetes, SSH and scheduled jobs. It’s in TestFlight now. Here’s why I built it, how, and how you can run it on your own lab. I’m looking for 50 beta testers.
My Kubernetes Secrets were made by hand with kubectl, and my Ansible repo carried passwords in plain text. Over two days they all moved into OpenBao. Git now says which secrets exist; OpenBao holds the values, audits every read, and nothing restarted on the way. This is the long version: the design, the four plans, the migration waves, and everything that bit me.
Everything public in my homelab goes through one door: BunkerWeb, a reverse proxy with a web application firewall, running in Kubernetes. Here is how it’s set up, how a new site goes from detect to block, and the outages that taught me the rest.
The Kubernetes cluster already ran kube-prometheus-stack. Two Checkmk VMs watched everything else. Over two days I moved hosts, websites and services into the one stack, in three slices, and then switched Checkmk off. Here is the plan, the tricks, and the list of things that went wrong.
Every service in my homelab signs in through Authentik, except Emby, which only knows passwords. So I wrote a plugin that adds OpenID Connect to Emby: browser sign-in, a PIN for the TV, group gating, and a few surprises along the way.
My whole development setup lives in the homelab. All I carry is a laptop with Visual Studio Code and a password manager. Coder, Kasm, Authentik and a dotfiles repo do the rest, over plain HTTPS. Includes the steps to build the same thing.
My homelab is five Proxmox nodes. Two do the heavy lifting, one is the firewall, one runs the home automation and one is storage. Here is what each one is, what is inside, and how they are wired together.