Securing a Self-Hosted AI Server
Keep Ollama's API private, control Open WebUI accounts and tools, protect documents and logs, and test denied access before sharing a self-hosted AI service.
Home Assistant Matter Server 9.0: Migration And Post-Upgrade Proof
Prepare Home Assistant and Matter controller data together before migration. Check existing device control, new commissioning, applicable updates and consistent recovery rather than treating a running server as success.
OPNsense 26.7 Migration: Source NAT, Legacy Rules, And Rollback
Rehearse OPNsense upgrades and source NAT conversion on an isolated clone. Compare effective rules and client traffic, including WireGuard and multi-WAN behavior, before relying on prior-release recovery.
RouterOS Stable Still Needs A Canary: A 7.23 Upgrade Runbook
Choose a RouterOS upgrade canary by hardware, packages and active features. Preserve off-device backups and local recovery, then validate representative services before expanding across unlike routers.
pfSense 26.03 System Patches: Auto-Apply Does Not Update The Package
Keep pfSense System Patches package maintenance separate from automatic patch application. Review package currency, applicable patches, required reboots and resulting behavior before treating an applied status as completion.
Recyclarr 8.7 Security Response: Treat Template Sources as a Write Boundary
A Recyclarr security-response guide for template-provider path traversal: upgrade, inventory providers, protect secrets, compare generated files, and test safely.
Authentik 2026 Security Response
Separate Authentik OAuth secret disclosure from inbound SAML account-mapping risks. Plan applicable updates, affected secret and session invalidation, and relying-application identity checks while retaining clean emergency administration.
Build a Private RAG Box for Network Docs
A private RAG guide for network documentation, configs, diagrams, NetBox exports, runbooks, embeddings, vector search, citations, and evals.
Jellyfin Security: Treat Media as Untrusted Input
Contain untrusted Jellyfin media, preserve evidence, patch to the current stable release, restrict writable paths, validate clients, and recover without returning to a vulnerable version.
Tailscale Security Updates: Audit SSH, Serve, Funnel, and Services
Review Tailscale nodes and enabled features against current security bulletins rather than stopping at a historical fixed release. Assess SSH, Services, private Serve and public Funnel as separate exposure paths.