Tag: security

iptables is in soft retirement. Here's why the nft shim isn't a long-term plan and what direct nftables syntax actually buys you.

Encryption hides content, not shape. Here's why state-level censors don't read your VPN traffic, they recognize it, and what actually still works in 2026.

Use age + age-plugin-yubikey to encrypt files with a key that literally cannot leave your hardware token. No GPG drama required.

Pangolin gives you Cloudflare Tunnel-style access to home services via a $5 VPS and a WireGuard mesh. Works even behind CGNAT, with zero vendor lock-in.

Keyless signed git commits with Sigstore and Gitsign, no GPG key rot, no passphrase prompts. OIDC-backed ephemeral certs that just work.

Sealed Secrets vs External Secrets Operator: which Kubernetes secret manager fits your GitOps workflow best, home lab cluster or production multi-tenant setup?

Renovate vs Dependabot for self-hosted teams: config depth, ecosystem coverage, self-host paths, and which bot wins for Forgejo/GitLab shops.

Tailscale vs Nebula vs ZeroTier vs NetBird, honest comparison of mesh VPN options for homelabs, small teams, and self-hosters in 2026.

Self-hosted secure email gateways compared: Proxmox Mail Gateway vs Hermes SEG vs DIY Rspamd, plus which classic appliances are now abandonware.

How to expose a possibly-vulnerable app to the public internet and survive it: rootless containers, a file-integrity tripwire, and zero inbound SSH on the box.

Kasm Workspaces streams disposable Linux desktops and apps to your browser. Threat model, real homelab uses, and how it compares to Guacamole.

Open Policy Agent and Gatekeeper enforce rules across Kubernetes, block privileged pods, require labels, restrict images. Rego basics and real homelab constraints.