authentik
Authentik as the front door to every app in my homelab
How I run Authentik in front of a dozen self-hosted apps over OIDC, and the MFA, lockout, recovery and backup traps I had to fix after login worked.
Renstur
netbird
My NetBird homelab: zero open ports
How I reach Authentik, Vaultwarden, Forgejo, Checkmk, TrueNAS and Home Assistant from anywhere with NetBird, with no port forwarded on my home router for any of it.
'Failed to connect to bus' — and four other things that break when a service moves to a user unit
Moving a service from a root system unit to a systemd user unit is a two-line change and four separate traps. The bus error is the loud one; the quiet one is that user units start earlier at boot than the unit they replaced.
Two of three group mappings worked — which is what made the third so hard to find
OIDC group sync grants Editor and Viewer correctly but silently skips Admin. The claim is fine, the config is right, and the partial success argues against every correct hypothesis. The cause is one line of asymmetric normalisation.
'npm is not available' — except npm is right there on PATH
A service crash-loops insisting npm is missing. Both node and npm are installed, executable, and first on PATH. The real cause is a shared library that was never installed, planted weeks earlier by a distro migration.
Your mesh ACL check returned nothing — because you asked the wrong firewall
You run nft list table ip netbird on a peer to see what the overlay actually permits. Empty output, exit code 0. That reads as "nothing is allowed" — but the host uses iptables and nftables was never going to answer.
Your Authentik login dies on 'not all parts available' — and two different bugs produce it
Forgejo 500s on the OIDC callback. You fix the missing openid scope, retry, and get the identical error — because an unrelated misconfiguration throws the same one. Here is how to tell them apart by counting dots.
Why Traefik 502s your service right after you recreate its container
You redeploy a service behind Traefik, it comes up healthy, and Traefik returns 502 until you restart it. A network-name mismatch explains the warning — but fixing it does not stop the 502. Updated with what actually did.
Your CrowdSec is running, connected — and completely blind while running NetBird
Healthy container, enrolled in the console, enforcing the community blocklist — every dashboard is green. It's also reading zero logs and detecting nothing. Here's how to tell, and how to fix it.
Stop Ansible hanging forever on a host that is "up"
A host answers pings and a bare ssh, but Ansible freezes on it indefinitely and takes the whole run down. Here is why ConnectTimeout and wait_for_connection do not save you — and how to hard-bound every SSH.
sshd -t fails with 'Missing privilege separation directory: /run/sshd' — and quietly undoes your hardening
Your sshd config is fine, but `sshd -t` exits non-zero anyway — and if you gate a config rollback on that check, you silently revert the hardening you were trying to apply. Here is why, and the one-line fix.
Semaphore's per-task host limit does nothing — and takes the whole fleet with it
You set a task limit to test a playbook on one host. Semaphore ignores it and runs against every host in the inventory. Here is the trap, and the two ways to scope a run that actually work.