What it does A re-runnable, root-run Bash tool that applies server-level WordPress performance and hardening tuning — no WordPress plugins involved. It auto-discovers every WordPress install under a base directory (default /var/www, override with WP_SITES), and every optimization is an…
What this is Two Bash installers that turn a fresh Debian/Ubuntu box into a working WordPress site, backed by MariaDB and PHP-FPM. One targets nginx (LEMP), the other targets Apache (LAMP, using mod_proxy_fcgi rather than mod_php). Both are interactive by…
In an earlier post, we covered split-tunnel VPN proxying: keeping your main application on its normal, direct connection, and routing only specific requests through a VPN container acting as an HTTP proxy. This post extends that pattern to multiple VPN…
The UniFi Cloud Key Gen2 (and Gen2 Plus) ships with a self-signed certificate, so every browser throws a warning when you open its admin UI. Here’s how to get a real, free Let’s Encrypt certificate on it automatically, and keep…
Keeping container images up to date across a homelab or small production environment is tedious to do by hand. WUD (What’s Up Docker) solves this by watching your running containers, checking registries for newer images, and optionally triggering updates automatically — all…
Not every ESPHome project needs to be an 8-zone irrigation controller with a queue system and current-sensing fault detection. This one is much smaller — an ESP32-C3 with a PIR motion sensor and a small DC gear motor, driven by…
ESPHome is deceptively simple to get started with — a YAML file, a few sensors, done. It’s much less simple once a project grows into something that has to run unattended for months, survive power blips mid-cycle, and not silently…
Moodle 5.x changed enough about how a server needs to be set up that a lot of older install guides are now actively wrong: the web root moved into a /public subdirectory, the minimum PHP version climbed to 8.3, and Composer became…
A homelab with more than one person relying on it remotely runs into an interesting access problem: some services need to be reachable from wherever its users happen to be, and some really shouldn’t be reachable from anywhere except a…
This is a full production reverse-proxy stack built around Traefik v3, with two independent, free WAF layers, IP-reputation blocking backed by real threat-intel feeds, Let’s Encrypt via Cloudflare DNS-01, HTTP/3, and rotated logs — all running as plain Docker containers,…