Homelab
Bitwarden Secrets Manager for AI Agents
How I set up bws (Bitwarden Secrets Manager's CLI) so Claude can fetch homelab credentials itself, no master password, no pasting secrets into chat.
Giving Internal Homelab Apps Real DNS Names and HTTPS
Cloudflare Tunnel gets your public apps out; a local DNS rewrite gives private ones the same clean hostname and valid HTTPS, from the same Caddy instance.
Running AdGuard Home in Docker on Synology
A working docker-compose.yml for AdGuard Home on Synology, the port-53 conflict everyone hits, and the host-vs-bridge tradeoff you have to make.
AI + Recipe Manager
Inconsistent tags, vague titles, pasted-text ingredients: using ChatGPT or Claude to fix a self-hosted recipe collection, with copy-paste prompts.
Part 1: The Map Before the Territory
What Sonarr, Radarr, Prowlarr, qBittorrent, SABnzbd, Bazarr and Seerr do, how they fit together, and the folder layout to get right first.
Part 2: Sonarr and Radarr
Install Sonarr and Radarr first, get the library structure and naming right, before a single downloader or indexer exists (Media Stack Part 2).
Part 3: qBittorrent + SABnzbd
qBittorrent that cannot leak outside its VPN tunnel, and SABnzbd for Usenet: the compose file, the settings everyone gets wrong, wired into Sonarr/Radarr.
Part 4: Prowlarr
Stop configuring indexers per app. Prowlarr holds them once and syncs to Sonarr/Radarr. The pipeline runs end to end for the first time.
Part 5: Seerr
Nobody else is opening Sonarr. Seerr gives a Netflix-style request search, wired to Plex for who's-allowed and to the arrs for fulfilment.
Part 6: Bazarr
Bazarr piggybacks on Sonarr and Radarr to fetch subtitles for the exact releases in your library. Set the language profile once and stop thinking about it.
Part 7: Profilarr
Default quality profiles just grab a resolution. Profilarr syncs curated custom formats so 'best release' means best encode, not biggest file.
Part 8: An AI Agent
Giving an AI assistant real, API-key-backed access to query and manage Sonarr/Radarr in plain language, plus three MCP traps nobody documents.
Mealie & Tandoor
Two recipe managers, deployed and compared honestly: compose for both, the Django host-header trap that took Tandoor down, what survives migrating.
Part 1: Cloudflare vs Tailscale
Cloudflare Tunnel publishes an app without opening a port; Tailscale puts your devices on one private network. The real difference, and the hybrid I run.
Part 2: Cloudflare Tunnel
cloudflared connects outbound-only to Cloudflare's edge; Caddy reverse-proxies apps behind it with automatic TLS: compose files, and a DNS-challenge trap.
Part 3: Tailscale
Tailscale runs once per host, not per container: every app on it becomes reachable through one mesh IP. The setup, a DNS trap, and the sidecar exception.
Dockhand Multi-Host Dashboard
Why I run Dockhand across my Docker hosts, how the Gitea-first deploy flow works, and the API that lets an agent manage containers without SSH.
Wake-on-LAN from Home Assistant
Home Assistant's Synology integration has no wake button. It only manages the NAS once it's on. Here's the WoL setup, and what silently breaks it.
USB Passthrough After VM Reboot
Synology Virtual Machine Manager doesn't re-attach a passed-through USB device after a VM reboot. Here's why, plus a self-healing script: ConBee II example.
Docker Compose Basics
The five ideas behind every compose.yaml on this site: images vs containers, volumes, networks, restart policies, and PUID/PGID conventions.