Filter posts by category

Security

Locking Down Authelia: TOTP, Real SMTP, and the Hostname-vs-IP TLS Trap

Leave a Comment / Security

Claude responded: Post excerptPost excerptA login page that renders isn’t the same thing as authentication that’s actually done. Here’s how I turned on real TOTP two-factor for Authelia, bootstrapped the very first registration without a working mailbox using a filesystem notifier trick, and then tripped over a TLS certificate trap that taught me hostnames aren’t an implementation detail you can swap for a raw IP — not once certificate validation enters the picture.

Locking Down Authelia: TOTP, Real SMTP, and the Hostname-vs-IP TLS Trap Read More »

From App Logs to Firewall Blocks: Building a fail2ban-to-OPNsense Ban Pipeline

Leave a Comment / Security

fail2ban catches the bad guys, but if it’s only banning them at the backend, every attacker still gets a free trip through OPNsense and HAProxy before being told no. Here’s how to close that gap: a script that exports every jail’s banned IPs into a flat file, a tightly locked-down Caddy route to serve it, and an OPNsense URL Table alias that turns it into a live WAN block rule — so the next retry never makes it past the front gate.

From App Logs to Firewall Blocks: Building a fail2ban-to-OPNsense Ban Pipeline Read More »

One Login to Rule Them All: Wiring Authelia as SSO for Open WebUI and Nextcloud

Leave a Comment / Security

Authelia gives you one login screen, but underneath it you’re actually running two completely different integration patterns. Open WebUI never knows Authelia exists — Caddy vets every request at the edge and hands the app a verdict. Nextcloud’s user_oidc plugin talks to Authelia directly, parsing signed tokens and making its own decisions about identity. Same login box, two very different trust relationships — and the difference matters more than it looks like it should.

One Login to Rule Them All: Wiring Authelia as SSO for Open WebUI and Nextcloud Read More »

Hardening Your Homelab’s Public Edge: GeoIP Blocking, CrowdSec, and Syncing Fail2Ban with OPNsense

Leave a Comment / Security

Exposing services to the internet means accepting a constant flood of automated attacks. Here’s how I cut that noise dramatically with GeoIP blocking, CrowdSec, and a Fail2Ban-to-OPNsense sync that turns one webserver’s detection into a network-wide block.

Hardening Your Homelab’s Public Edge: GeoIP Blocking, CrowdSec, and Syncing Fail2Ban with OPNsense Read More »