Security
Headscale — Self-Hosted Tailscale Control Plane on Ubuntu
Run your own Tailscale control plane with Headscale. Docker compose setup, preauth keys, MagicDNS, point clients with --login-server. No vendor lock-in.
Security
Server security from real incidents: SSH hardening, fail2ban, CrowdSec, firewalls, TLS and mail server pitfalls.
Security
Tailscale for Gameservers — Friends-Only Without Port Forwards
Run a Minecraft, Valheim or Palworld server only your friends can reach. Tailscale mesh, MagicDNS, no DDoS surface, no router config.
Windows Server
RDP Hardening on Windows Server — NLA, IP Allowlist, and Audit
Lock down RDP on Windows Server — enforce NLA, restrict the firewall to specific IPs, audit failed logons, kill the bot brute-force traffic. The settings I run on every internet-exposed server.
Windows Server
Windows Server Hardening — Kill SMBv1, LLMNR, and NTLMv1
Three legacy protocols still enabled by default on Windows Server that no modern network needs. PowerShell one-liners to disable each, the rare exceptions, and how to verify.
Windows Server
BitLocker on Windows Server — Encrypting the OS Volume Without Locking Yourself Out
Enable BitLocker on a Windows Server OS volume via PowerShell — TPM unlock, recovery key handling, the boot quirks specific to Server, and how to unlock from WinPE.
Linux
Restic Backups to S3 / MinIO — Encrypted, Deduplicated, Restore-Tested
Real backup setup with Restic — encrypted offsite to S3 or self-hosted MinIO, dedup, retention, and the restore-drill that proves your backups actually work.
Windows Server
Active Directory Part 3 — GPO Hardening for the Whole Domain
The GPOs every domain should have — password policy, account lockout, audit, RDP restrictions, SMBv1 / LLMNR / NTLMv1 kill, BitLocker enforcement. The defaults are not enough.
Linux
Netdata on Ubuntu — Live Server Metrics in 5 Minutes
Install Netdata on Ubuntu for per-second server metrics. Install, bind to localhost, SSH-tunnel the dashboard, ship alerts to Discord.
Security
WireGuard VPN on Ubuntu — the Setup I Actually Use
Minimal WireGuard setup on Ubuntu. Server config, one client, UFW rule, QR code for the phone. The version I run on my home-lab jumpbox.
Linux
SSH Hardening Checklist for Ubuntu Servers
Lock down SSH on Ubuntu 24.04 without locking yourself out: keys only, no root, the cloud-init drop-in trap, socket activation, verification.
Windows Server
Join Windows Server to AD Domain with PowerShell
Domain-join a Windows Server with Add-Computer: point DNS at the DC first, land in the right OU, verify the secure channel, fix the usual join errors.
Linux
fail2ban: Stop Getting Hammered on SSH and Nginx
fail2ban for SSH and nginx on Ubuntu 24.04 / Debian 12-13: jail.local, systemd backend, a custom scanner filter, testing with fail2ban-regex, and gotchas.