Tutorials
Frigate 0.17.2 Security And Exposure Audit
Frigate 0.17.2 does not resolve every viewer-access issue identified in its release notes. Review public exposure, authenticated access and camera permissions without treating the update as an all-clear.
ESPHome 2026 Fleet Security Migration
Separate ESPHome API encryption, OTA authentication and firmware recovery when planning fleet changes. Use representative devices to check control, updates and reconnection before expanding beyond a recoverable canary.
Home Assistant Matter Server 9.0: Migration And Post-Upgrade Proof
Prepare Home Assistant and Matter controller data together before migration. Check existing device control, new commissioning, applicable updates and consistent recovery rather than treating a running server as success.
OPNsense 26.7 Migration: Source NAT, Legacy Rules, And Rollback
Rehearse OPNsense upgrades and source NAT conversion on an isolated clone. Compare effective rules and client traffic, including WireGuard and multi-WAN behavior, before relying on prior-release recovery.
RouterOS Stable Still Needs A Canary: A 7.23 Upgrade Runbook
Choose a RouterOS upgrade canary by hardware, packages and active features. Preserve off-device backups and local recovery, then validate representative services before expanding across unlike routers.
pfSense 26.03 System Patches: Auto-Apply Does Not Update The Package
Keep pfSense System Patches package maintenance separate from automatic patch application. Review package currency, applicable patches, required reboots and resulting behavior before treating an applied status as completion.
Recyclarr 8.7 Security Response: Treat Template Sources as a Write Boundary
A Recyclarr security-response guide for template-provider path traversal: upgrade, inventory providers, protect secrets, compare generated files, and test safely.
Authentik 2026 Security Response
Separate Authentik OAuth secret disclosure from inbound SAML account-mapping risks. Plan applicable updates, affected secret and session invalidation, and relying-application identity checks while retaining clean emergency administration.
Build a Private RAG Box for Network Docs
A private RAG guide for network documentation, configs, diagrams, NetBox exports, runbooks, embeddings, vector search, citations, and evals.
Jellyfin Security: Treat Media as Untrusted Input
Contain untrusted Jellyfin media, preserve evidence, patch to the current stable release, restrict writable paths, validate clients, and recover without returning to a vulnerable version.