Step-by-step guides pulled from real homelab projects — rewritten for anyone to follow, with internal IPs and account details stripped out. Real gotchas kept in, because that's the useful part.
Six GPUs on SHA3-256t with wall watts and efficiency. Three are pool runs with shares accepted. Three are benchmarks and say so.
MiningHashrate over network hashrate overstated daily revenue by 75% on a real chain. Use difficulty instead, and take it from the block header.
MiningA free open source GPU miner with a real window. Multi-GPU, a gaming mode that drops every card to 30% so you can play, and an honest account of the two warnings Windows will show you.
MiningA host nine days from a full disk, with 26 container images and one of them in use. The updater was working perfectly and never pruned anything.
DockerLoad 51 on a 32-core box is fine, load 45 next to an idle CPU is I/O, and a container's load average belongs to the host. Three misreads of one number.
LinuxA Pi runs a full node fine with no monitor, but SSH has to be enabled before first boot. The file that enables it is named ssh with no extension, and Windows hides extensions by default, so most people create ssh.txt and cannot log in.
Raspberry PiNodesFour failure classes with different first moves: no post, no boot, a card that will not show up, and a rig that reboots hours later. Pull every GPU, add them back one at a time, and swap against a known good card to tell the GPU from the riser.
MiningTroubleshootingA bad VBIOS flash leaves a card that will not post, so no Windows tool can reach it. Boot amdvbflash from a FAT32 stick and force the original ROM back. The step people miss is unhiding files, because the EFI folder never gets copied.
GPU RepairBIOSAn empty wallet after a week is usually a payout threshold, not a broken rig. Look your address up on the pool and read the last seen time per worker, because a hashrate next to a stale timestamp is history rather than a live reading.
MiningPoolsA straight clone copies the old partition sizes onto the new drive, so a 64GB layout lands on a 1TB disk and the rest sits unallocated. Pick shrink or extend to fill the target, then confirm the data partition really grew before committing.
WindowsStorageAbove 4G Decoding and Resizable BAR stay hidden while CSM is enabled, so the options look absent from your board when they are not. Nothing in Windows confirms the feature is on, which makes a benchmark the only real check.
BIOSAMDA 24-pin splitter ties the second supply to the motherboard's own power signal so both come up and go down together. The paperclip trick does not, which is how you get GPUs still spinning in a machine that thinks it is off.
MiningPowerMeasure the old pads with calipers and match the thickness, because a thicker pad lifts the cooler off everything around it. The mistake that costs a second teardown is doing the cooler side and never opening the backplate.
GPU RepairCoolingA spare NVMe boots HiveOS fine, but on many boards the M.2 slot borrows PCIe lanes from the GPU slots and cards start going missing. Set the M.2 controller to SATA mode. HiveOS gains nothing from the speed anyway.
MiningHiveOSMaintenance mode without loading drivers, then run the update from Hive Shell so you can actually watch it. Check the hashrate afterward: one update cost 8 to 9 MH/s on 3070s and 3060 Tis while leaving 3080s untouched.
MiningHiveOSConsole, SSH and SFTP solve different problems, and the console is the one that still works when SSH does not. Three commands after every login confirm the right machine, the right user and the right directory before you change anything.
LinuxSSHAbsolute and relative paths, and why a script needs the absolute one. Cron and systemd do not start your script from the folder you wrote it in. Plus ls -ltr, wc, more, less and grep, and the pipe that joins them.
LinuxShellhashrate.no publishes per-card, per-coin overclocks and the miner config to match. The config is often formatted for a Windows .bat file rather than a HiveOS flight sheet, so it needs rewriting before the miner will start.
MiningOverclockingSteamOS targets handhelds, so Bazzite is the practical route to a console-style Steam boot on desktop hardware. Nvidia is still beta for gaming mode, and a Ryzen iGPU next to a discrete card can stop gamescope finding the display.
Linux GamingBazziteWrite a mining OS image to a USB stick and Disk Management may never format it again. The drive is fine. diskpart clean removes the partition table in four commands, and the warning is that it never asks you to confirm.
WindowsStorageQubes ships an ISO that its own instructions tell you to write as a DD image. Pick DD mode in Rufus and the file browser filters your ISO out of view, so the download looks missing when it is not.
Qubes OSWindowsNULL NOT IN (1, 2) is not true, it is NULL, so every row with no value in that column silently vanishes from the result. The near-miss is the better story: the test written for exactly this passed against an empty fixture.
DatabasesCorrectnessElectron denies getDisplayMedia unless you register a handler, and the denial raises the same error a cancelled picker does, so every wrapper swallows it. It works in a browser, which is what makes it look distro-specific.
ElectronWebRTCWrapping a web app in a WebView is a fine way to ship a mobile client until the feature is voice. iOS suspends WebView audio shortly after the screen locks, and no entitlement changes it.
MobileWebRTCAn embedded login window has none of the user's sessions and none of their password manager. Use the system browser, return through a scheme you own, and never put the session token in that URL.
AuthenticationDesktop AppsThree layers kept the printer off the internet and the slicer still checked for updates, because a process reads the whole routing table. Isolating the device is a network problem, confining the app is not.
NetworkingIsolationProton exposes no SMTP to third-party clients, so Bridge is what lets monitoring, forms and scanners send mail. On a headless box it needs a keychain that is not a keychain and a From address it will accept.
EmailSelf-HostingA scanner outside your network needs a reachable SMTP server, and the ten-minute version is an open relay that gets found within hours. Submission only, TLS and auth mandatory, port 25 listener deleted outright.
EmailSecurityA checksum found 158 of 159 files identical and one regenerated by a cron job every two minutes. The generator could not move and home could not push, so the new host pulls, and refuses to publish anything that does not parse.
HostingMigrationsAn absolutely positioned box resolves its offsets against the padding box, whose edges are outside the padding, so a safe-area fix on the shell can be a complete no-op. Twice shipped, never once applied.
CSSLayoutA fresh VPS took 1,118 login attempts from 37 addresses in its first eight hours. Harden it before you build anything on it, and name your drop-in so cloud-init's own config cannot win.
SecuritySSHLocking SSH to your own address is good practice and the fastest way to lock yourself out, because that address changes without telling you. Keep one allowlist entry that is not your home IP.
SecuritySSHPasting a hardening snippet can leave you with weaker key exchange than the default, and nothing will warn you. Audit what the server actually negotiates rather than what the file says.
SecuritySSHInternal-only hostnames cannot answer an HTTP challenge, so their certificates quietly stop renewing. A private CA issues real certificates for names the public internet will never see.
SecurityCertificatesThe handshake succeeds, the peer is listed, and not one packet crosses. wg set installs crypto routing without installing a kernel route, so the traffic never reaches the tunnel at all.
NetworkingWireGuardA home IP hardcoded in five places breaks in five ways at once, with symptoms that look unrelated. Detect the live value, reconcile every copy from it, and email the ones you cannot automate.
NetworkingAutomationThe tracking script has to be public. The dashboard does not. Splitting them is easy, and the obvious allowlist locks out your own laptop for a reason worth understanding.
SecuritySelf-HostingA firewall rule, a permission or a policy that reads perfectly and changes nothing. Existing connections and cached decisions are evaluated once, so the fix has to invalidate the cache too.
NetworkingSecurityA sync tool's cleanup step deleted two running hosts from monitoring because the inventory said they were offline. Nothing alerted, because a deleted host cannot go critical.
MonitoringA scan scheduled in a four-hour window that takes eleven hours will never finish, and it reports as scheduled rather than as broken. Monitoring can fail silently in a direction nobody watches.
MonitoringAutomationHalf the page is live and half of it errors. That is a cached shell, not a dead server. Caddy's file_server sends no Cache-Control at all, so the browser decides how long to keep your page for you.
CaddyWebA status page built on private data has to serve the output and never the source. Keep identifiers in a mode 600 file outside the web root, and go check the backup you left next to index.html.
SecurityWebYour service crash-loops on a setting that looks correct in the file. systemd only treats # as a comment at the start of a line, so the note you wrote after the value became part of the value.
LinuxsystemdA Rust binary that owns the terminal your coding agent runs in, so the work survives a closed lid. Read the installer first, and know what the Claude integration writes into your settings.json.
AI AgentsTerminalYour gateway blocks an SSH scan every five minutes and the source is inside the house. Monitoring is still polling a host you retired, and crossing a VLAN to do it. Mine was 93 percent of the threat log.
MonitoringSecurityAdding a second path to a reverse_proxy line turns it into an upstream called rtc/* on port 80. The config validates, the reload succeeds, and the route your clients actually use is gone.
CaddyWebI doubled a container's RAM to fix an out of memory error that was never about memory. The kernel log had zero OOM events and the job I blamed used 2MB.
DebuggingLinuxYou shut a container down on purpose and it came back, or it paged you at 3am. Autostart, your watchdog and your monitoring all have an opinion, and one of them has to be dealt with before you stop anything.
ProxmoxOperationsYou set the sysctl, you verified it, and after the next reboot it is back. On Ubuntu a crash handler rewrites it at runtime, so the value in your config file and the value in the kernel disagree.
SecurityLinuxA reload that reports success and changes nothing, and a bind mount that stops tracking the file it points at. Two mechanisms, one symptom, and the same verification habit catches both.
Self-HostingDockerGreen builds, clean commits, and a site that has not changed in three days. When publishing is a second step, verify against the public URL rather than against the pipeline you just watched.
Self-HostingAutomationThe Electron BaseApp ships zypak, not Electron, which produces a 2.7MB app with no runtime in it. Six blockers that appear only when you run flatpak-builder instead of rereading the manifest.
PackagingLinuxTwo nodes means two votes, so losing either leaves the survivor below majority and refusing to start guests. Decide where the third vote lives before you form the cluster.
ProxmoxHomelabThe estimate said 149G, the real total was 521G, and the destination had 86G free. The shell glob skips every hidden directory, and the durable fix is a preflight that refuses to start.
LinuxMigrationsBehind a CDN your matcher only ever sees the CDN, so it can never match a visitor. Declaring trusted proxies fixes that, and closes the forged-header bypass you get free by skipping it.
NetworkingSecurityCreative Commons grants cannot be revoked, the upload form defaults to public domain, and the strictest CC licence still permits unlimited mirroring. Plus what each marketplace actually pays.
3D PrintingPublishingonboot only covers a host reboot. A five-minute watchdog covers a guest stopping at any other time, and the hold file is what stops it fighting you during planned maintenance.
ProxmoxAutomationA local model can turn a wall of alerts into one readable daily email. Keep it notify-only, and tell it explicitly that retrieved documentation is never a source of current facts.
AIAutomationA free MIT-licensed CLI that reads the two numbers your slicer never shows you — height over footprint, and flat underside floating in mid-air — and diffs new gcode against a print you already know came out right.
3D PrintingToolsCopy-pasted CSP headers break real sites, so most people water them down until they do nothing. Inventory what your site actually loads first — including the runtime fetch() calls that never appear in your HTML — then write a policy that fits it.
SecurityWebCamera drifting, menus scrolling by themselves, a character that walks without you — on Linux it's often a motherboard RGB controller enumerated as a joystick with its axes jammed at full deflection. Prove it in two minutes, then kill it with one udev rule.
Linux GamingHardwareA Klipper printer is a small Linux server with a published default password and a trust-everything network posture — here's the 20-minute lockdown, with the real commands and the gotchas that make a naive attempt look like it worked when it didn't.
Security3D PrintingA WebKitGTK conflict QIDITECH admits to in their own release notes, not a config mistake — the dmesg trace, the diagnosis, and the two-setting fix.
3D PrintingLinuxTwo services fail on every boot of an ARM single board computer and neither one can ever succeed. How to prove it, how to mask them safely, and what to monitor on eMMC instead of SMART.
MonitoringLinuxScripting docker-ce onto a fresh LXC or minimal VM over non-interactive SSH can leave the docker group missing and the socket refusing to start — here's the exact one-line fix.
DockerProxmoxA raw SQL write to a field an app encrypts at its own layer can succeed silently, then break the app's very next read in a way that looks exactly like data loss.
DatabasesSelf-HostingVoice-activity detection going silent after mute, a stale room-event race, and an iOS-only connection failure traced to Multipath TCP inside the SDK itself.
LiveKitWebRTCDSM's rsync binary is setuid-root, and that specifically breaks non-interactive SSH invocation — real hardening, not a bug. Here's the actual workaround.
SynologyMigrationsA login item created via the bw CLI can report success while the password is never actually persisted server-side — reproduced when the item lands in a shared organization collection.
VaultwardenAutomationThe official plugin's real request body shape isn't documented anywhere reachable through Grafana's own API — plus the one settings field that silently 404s every graph.
GrafanaCheckmkA browser extension auto-updated past what a one-version-behind self-hosted server could support, silently breaking sync while every other client kept working.
AutomationSelf-HostingAn internal, unauthenticated localhost port answers the exact same routes UniFi's own certificate auto-renewal presumably uses — reverse-engineered from the console's own UI.
UniFiAutomationBrowser-based VDI with Proxmox auto-cloning agent VMs on demand — the real permission set, every startup-script gotcha, and a general method for diagnosing a stuck clone/destroy loop from scratch.
KasmProxmoxVDIRunning your own internal certificate authority (step-ca) so every admin UI on your LAN gets a real, trusted cert — no more click-through security warnings.
PKIDockerMoving public domains from a vendor NAS's reverse proxy to a dedicated Caddy instance — plus the Cloudflare certificate trick you need if you're behind Cloudflare.
CaddyNetworkingRunning Vaultwarden (a Bitwarden-compatible server) in its own isolated container, and the safe way to migrate an existing vault without losing sessions or data.
VaultwardenDockerForwarding a UNIX domain socket over SSH — not a port — so browser automation running on a headless box can drive Chrome on your workstation, kept alive by a systemd user service.
SSHsystemdHeadless Docker Compose deployment (no web install wizard), avoiding the SSH-port collision, and mirroring an existing GitHub repo without giving it up as canonical.
GiteaDockerA self-hosted photo library with real ML search, plus CalDAV/CardDAV for contacts and calendars — and how to migrate years of existing data over safely.
ImmichSelf-HostingThree free, complementary scanners — network, container images, and web apps — set up to run on a schedule and actually get looked at.
SecurityOpenVASWiring your network controller, your hypervisor, an inventory system, and a monitoring stack together so new devices and VMs show up automatically — and the silent failure modes to watch for on every leg.
NetBoxProxmoxAutomationA fleet-wide notification rule silently discarding every service alert, plus real Docker container monitoring and a from-scratch agent bootstrap on a non-systemd host — every gotcha included.
CheckmkDockerMonitoringA per-game breakdown covering Docker-based servers, raw SteamCMD/systemd servers, and a whole Kubernetes-operator-managed one — plus two real bugs a dry "no update available" check would have hidden forever, including a management script that lies about its own exit code.
AutomationGame ServersBackupsInstalling Palworld via SteamCMD, exposing it publicly without a port-forward or leaking your home IP, and two config settings — guild-building permissions and PvP damage — that silently don't do what their names suggest.
Game ServersSteamCMDNetworkingRunning Enshrouded in Docker with split-horizon DNS for fast LAN play — and a real docker-compose bug where the container looked perfectly healthy while its port was never actually open to the host.
DockerGame ServersNetworkingDisabling decay/sandstorms/building limits, exposing a 100+ port UDP range through a VPS relay (and a silent config bug that broke it invisibly), a disk that snuck onto the wrong storage, and an auto-update cron that was failing on something nobody suspected.
Game ServersProxmoxNetworkingA self-hosted Hytale migration where the obvious save file was a decoy — the real multi-week world was trapped inside a stopped container's writable layer, thanks to a bind-mount path mismatch.
HytaleDockerGame ServersMoving a long-stopped Minecraft Bedrock world off a general-purpose Docker host onto its own dedicated server — the small file-permission gotcha that actually broke it, and why Bedrock needs its own box separate from Java.
MinecraftBedrockDockerA second Minecraft server built specifically for a Forge mod stuck on 1.7.10 — the Java 8 image tag requirement, a CurseForge CDN workaround, and rescuing a player from a mod dimension with no built-in way out.
MinecraftForgeDockerStanding up a modded Minecraft Java server on Fabric 1.20.1 — avoiding shared-storage I/O contention, resolving a modpack's full dependency tree via the Modrinth API, and a recipe-serializer crash with two completely unrelated causes.
MinecraftFabricGame ServersDeploying TeamSpeak 6 beta in Docker — bootstrapping WebQuery/SSH-query API access past a real chicken-and-egg deadlock, building AFK auto-move/mute yourself, and exposing voice + file transfer publicly without silently breaking the file-transfer half.
Self-HostingTeamSpeakDockerA real phone call impersonating Google tried to trigger a genuine account-recovery approval prompt — not a fake login page, the real thing. How the technique works, the tells, and what actually stopped it.
SecuritySocial EngineeringA precautionary infrastructure audit after an unrelated social-engineering attempt found an over-privileged automation API key — and a role downgrade that looked like a complete fix but wasn't. The real gap, how to actually verify a fix, and why to audit standing credentials on a schedule.
SecurityUniFiAccess ControlThree checks that reported success against hosts that were not hardened. An AEAD cipher skipping MAC negotiation, sshd -T printing nothing on a host that is listening, and a guard that failed open.
SSHHardeningVerificationFixing weak SSH MAC algorithms across an entire fleet of mixed Linux containers, VMs, and vendor NAS units — and how to actually verify the fix worked.
SSHHardeningA dedicated backup target for your whole virtualization fleet — including physical Windows PCs, not just VMs — plus the permission gotchas that trip up almost everyone on first setup.
ProxmoxBackupsAn NFS bind-mount for a container's config folder is invisible to most backup tools — how to check for this silent gap and migrate onto real backed-up storage without losing anything.
DockerBackupsA second, independent backup server on a cloud VPS for genuine 3-2-1 coverage — locking it down with a firewall instead of a tunnel, a write-only sync credential, and the honest truth about backup immutability.
BackupsCloudA cloud droplet isn't a VM your hypervisor manages, so nothing backs it up automatically — plus a genuinely obscure Docker/overlay2 bug that can leave backups completely unrestorable while looking perfectly healthy.
BackupsDigitalOceanDockerAn off-site btrfs backup failed every night for 5 nights with zero alerting — the red herring that wasn't the cause, the real version-mismatch root cause, the fix, and closing the monitoring gap so it can't happen silently again.
BackupsMonitoringTwo approaches — a simple single-port tunnel for most games, and a VPS-based tunnel for games that need a whole range of ports — plus a subtle bug that can make a tunnel look healthy while being completely broken.
NetworkingGame ServersPUID/PGID are a LinuxServer.io convention, not a Docker feature. Set them on an image that ignores them, inside an unprivileged LXC that offsets every uid by 100000, and writes to an NFS share fail with permission denied while extraction looks like it succeeded.
DockerProxmoxNFSCloudflare's Free plan caps a single proxied response at 100 MB. Streaming survives it because segments are small; full-file downloads don't, and Range-resumed retries fail just as fast. How to confirm it in the origin's logs and route around it.
CloudflareJellyfinNetworkingReal-time monitoring uses inotify, which can never observe writes made by a different NFS client. It looks enabled and does nothing. Why it's structural, and a debounced poller that triggers a real scan instead.
JellyfinNFSRadarrNFSv4 trunking detection recognises a server it already has a session with and reuses the old connection, so a new fast path can carry zero bytes while mount, routing and ping all look correct. Plus why nconnect nearly doubled throughput from a VM.
NFS10GbEProxmoxkeep-daily keeps the newest snapshot per local calendar day, not per 24 hours. Backups running near local midnight collide, and a host with two backups can be pruned to one. Pair it with keep-last, and dry-run everything.
ProxmoxBackupsBackup clients pin the server's certificate fingerprint, so a routine renewal breaks every one of them at the same moment — and a nightly job that fails is completely silent. How to fix it, where the pins hide, and how to make sure it can't happen quietly again.
BackupsMonitoringProxmoxA misconfigured AllowedIPs value doesn't just fail to connect — it can hijack all of a host's outbound traffic via policy routing, even while the tunnel itself never connects. How to spot it, fix it, and avoid it from the start.
WireGuardNetworkingSecurityPutting a device on its own VLAN doesn't isolate it by default on most routers — how to check, fix it properly, and avoid a gotcha that silently breaks the direction you meant to keep working.
NetworkingSecurityProtocol and server choices that actually matter, a real gotcha with reused provider configs, and a test suite that goes well beyond a handful of pings.
VPNNetworkingBypassing an official Windows+Hyper-V requirement by finding the real Linux payload underneath — plus a real debugging story about a live-service game's hidden cloud dependencies, including two wrong turns before finding the real answer.
Self-HostingGame ServersA real security incident from one wrong env var name, a Cloudflare mTLS gotcha that broke only the iOS app, and the honest truth about what "automatic sync" can and can't mean on an iPhone.
SeafileSelf-HostingDiscovering a reverse proxy had zero access logging, standing up self-hosted Umami analytics, a dropped-image gotcha, and verifying the whole pipeline with a real simulated pageview instead of just a healthy container.
UmamiAnalyticsDockerDeploying a self-hosted Discord alternative with real WebRTC voice/video — the one-click Docker install, and the TLS gotcha that silently breaks voice chat (not just avatars) if you skip it.
DockerSelf-HostingLiveKitWiring up Mailgun + Cloudflare DNS so a contact form can actually deliver — a per-account domain limit, a brand-new account getting auto-disabled, and a dashboard that lags real DNS by several minutes.
MailgunDNSEmailBoth classic sitemap-ping URLs have been dead for years, IndexNow is the real replacement for everyone except Google, and how to verify Search Console via a plain DNS record instead of an OAuth grant to your DNS provider.
SEODNSSearch ConsolePunching a precise, single-device hole in a network-wide content filtering rule — and a real gotcha where the firewall API silently refuses to reorder rules, no matter how convincing the success response looks.
NetworkingFirewallDedicated service/bot accounts over reusing your own login, scoped roles instead of admin convenience, one-time tokens, and a real secret-storage gotcha that quietly drops passwords.
SecurityAutomation