The OPNsense dashboard tells you how things look right now. It has no memory of an hour ago, let alone last Tuesday at 2am. Here’s how I gave it one — wiring Telegraf, InfluxDB, and Grafana into a real monitoring stack, and the version-mismatch trap that quietly cost me the most time along the way.
Watching the Firewall Breathe: Monitoring OPNsense with Telegraf, InfluxDB, and Grafana Read More »
Every search query is a small confession. Here’s how I took mine back — running SearXNG as a self-hosted metasearch engine, locking it down with Authelia and real 2FA, and wiring it in as the default search for both my desktop browser and my local LLM stack.
Ditch Google: Self-Hosting SearXNG Behind Authelia for Desktop and Open WebUI Read More »
Claude responded: Post excerptPost excerptA login page that renders isn’t the same thing as authentication that’s actually done. Here’s how I turned on real TOTP two-factor for Authelia, bootstrapped the very first registration without a working mailbox using a filesystem notifier trick, and then tripped over a TLS certificate trap that taught me hostnames aren’t an implementation detail you can swap for a raw IP — not once certificate validation enters the picture.
Locking Down Authelia: TOTP, Real SMTP, and the Hostname-vs-IP TLS Trap Read More »
Two firewalls, one home connection behind CGNAT, and a problem I kept putting off: how do you build an anti-lockout rule for a remote firewall when your home IP changes and isn’t even fully under your control? Here’s the self-updating fix.
Never Lock Yourself Out: Building a Self-Updating Anti-Lockout Rule for OPNsense Read More »
fail2ban catches the bad guys, but if it’s only banning them at the backend, every attacker still gets a free trip through OPNsense and HAProxy before being told no. Here’s how to close that gap: a script that exports every jail’s banned IPs into a flat file, a tightly locked-down Caddy route to serve it, and an OPNsense URL Table alias that turns it into a live WAN block rule — so the next retry never makes it past the front gate.
From App Logs to Firewall Blocks: Building a fail2ban-to-OPNsense Ban Pipeline Read More »
Authelia gives you one login screen, but underneath it you’re actually running two completely different integration patterns. Open WebUI never knows Authelia exists — Caddy vets every request at the edge and hands the app a verdict. Nextcloud’s user_oidc plugin talks to Authelia directly, parsing signed tokens and making its own decisions about identity. Same login box, two very different trust relationships — and the difference matters more than it looks like it should.
One Login to Rule Them All: Wiring Authelia as SSO for Open WebUI and Nextcloud Read More »
Exposing services to the internet means accepting a constant flood of automated attacks. Here’s how I cut that noise dramatically with GeoIP blocking, CrowdSec, and a Fail2Ban-to-OPNsense sync that turns one webserver’s detection into a network-wide block.
The WireGuard tunnel got traffic into my homelab. HAProxy, ACME, and a strict VLAN policy decide what happens next. A follow-up on how I expose services safely — and what I deliberately keep hidden.
Stuck behind your ISP’s CGNAT and can’t expose your homelab services? Here’s how I bypassed it using an OPNsense firewall and a WireGuard tunnel to a cheap VPS — no port forwarding required.
Bypassing CGNAT with an OPNsense WireGuard Tunnel Read More »