17 posts
A Plesk-managed Let's Encrypt cert expired and took the site down. The fix wasn't renewing it in Plesk — it was moving the domain to standalone certbot. Two gotchas included.
How to route ports 80/443 to one container and 3389/game ports to another VM behind a single public IP on Proxmox — DNAT rules, hairpin, and making it survive a reboot.
Tailscale vs WireGuard compared — Tailscale is built on WireGuard but adds NAT traversal, MagicDNS, ACLs and zero-config mesh. When to pick raw WireGuard instead.
Set up CrowdSec on Linux as a fail2ban alternative — the agent/bouncer split, parsing logs, the firewall bouncer, community blocklists, and honest trade-offs.
PBS gives you dedup + incremental + verify on top of Proxmox VE. Install, wire it as storage, first backup + restore, prune policy. The why and the how.
Run your own Tailscale control plane with Headscale. Docker compose setup, preauth keys, MagicDNS, point clients with --login-server. No vendor lock-in.
Run a Minecraft, Valheim or Palworld server only your friends can reach. Tailscale mesh, MagicDNS, no DDoS surface, no router config.
Lock down RDP on Windows Server — enforce NLA, restrict the firewall to specific IPs, audit failed logons, kill the bot brute-force traffic. The settings I run on every internet-exposed server.
Three legacy protocols still enabled by default on Windows Server that no modern network needs. PowerShell one-liners to disable each, the rare exceptions, and how to verify.
Enable BitLocker on a Windows Server OS volume via PowerShell — TPM unlock, recovery key handling, the boot quirks specific to Server, and how to unlock from WinPE.
Alternative to the Utilman trick — replace sethc.exe to get SYSTEM-level cmd at the Windows lockscreen. When to use it, how to harden against it.
Real backup setup with Restic — encrypted offsite to S3 or self-hosted MinIO, dedup, retention, and the restore-drill that proves your backups actually work.