If you run a Docker host that is reachable from the internet, one of the most effective security changes you can make costs nothing and takes five minutes: stop running your containers as root. This post walks through creating a dedicated, tightly-scoped service account for running Docker workloads that need hardware access, such as GPU […]
Category: howto
Step-by-step things to do.
Send Discord Notifications from Linux
This guide covers setting up a Linux server to send notifications to a Discord channel using Discord’s incoming webhook API and a small Bash script. No third-party packages are required beyond curl, which is often installed by default on most Linux distributions. Discord is a reasonable choice for low-frequency infrastructure notifications. It is free for […]
Configure Static IP Address on Ubuntu Server
Modern Ubuntu server releases use netplan to manage network settings. This guide covers configuring a static IP address on Ubuntu Server, a typical first step when building a new server to ensure communication remains available even when DHCP services are unavailable. Check Current Network Configuration Default Ubuntu installations typically use DHCP for IP configuration. Verify […]
Setting Up RAID1 with LVM on Ubuntu
This guide covers building a software RAID1 mirror with LVM on Ubuntu using two 10TB drives. The combination of mdadm for mirroring and LVM for volume management provides redundancy against single drive failure while maintaining the flexibility to resize, snapshot, or extend storage without repartitioning. Overview The storage stack consists of mdadm software RAID1 at […]
Enable GPU on Server Hardware for Media Services
Some datacenter and server farms disable GPUs in their servers by default. The hardware is present and functional, but the devices are hidden at the BIOS or firmware level to simplify inventory management and reduce support complexity. Hetzner does not officially support GPU passthrough or direct GPU use on auction servers, but the hardware can […]
Automated Wildcard Certificate with Certbot and DNS
Certbot is a package available on many Linux distributions that simplifies the registration and management of Let’s Encrypt certificates. This post covers the setup of automated certificate renewal for wildcard domains using DNS challenges. Prerequisites This guide was tested on Ubuntu 26.04 Server. It should work on any Debian based distribution. You need sudo or […]
Connect a Debian or Ubuntu Server to FritzBox using WireGuard
A VPS or remote server can join a home network without deploying a separate VPN stack. If the FritzBox supports WireGuard, the server connects as a client to the built-in WireGuard server. This avoids running additional containers, managing firewall port ranges for internal services, or subscribing to a third-party VPN provider. This configuration differs from […]
Hetzner Bare Metal Setup: Custom RAID and Firewall Configuration
Hetzner dedicated servers require manual provisioning to achieve production-ready storage layouts and network security. The default automated installation does not support custom partition schemes or proper Docker firewall integration. This guide covers booting into rescue mode, deploying Ubuntu with multiple MD RAID arrays, and configuring both UFW and the Hetzner hardware firewall. Prerequisites The following […]
Hetzner StorageBox with Encryption at Rest
A server running, for example, Nextcloud and Immich on a single unencrypted locally mounted drive presents two problems: no redundancy and no encryption. Moving bulk storage to Hetzner StorageBox addresses both issues. This post examines how to do this and the technical tradeoffs of that migration. Starting Configuration The existing example server runs Ubuntu 24.04 […]
Deploying AdGuard with DNS-over-HTTPS in Docker
AdGuard provides centralized DNS filtering and encrypted upstream queries for infrastructure deployments. This guide covers deploying AdGuard in Docker with DNS-over-HTTPS upstreams, integrating it with Nginx Proxy Manager and WireGuard, and securing administrative access behind VPN boundaries. Prerequisites The following items are required: Checking Port 53 Availability Before deploying AdGuard Home, verify that port 53 […]