Featured guide · October 4, 2026
Whose GitLab Permissions Does Your AI Assistant Use?
A shared read-only token does not preserve each reader’s GitLab permissions. How fallback credentials, user tokens, and HTTP sessions affect access.
Read the guideInfrastructure and operations
Software, networks, and AI development
Firewall migrations, DHCP, code review, and the systems around a pull request.
Kodus Caught Two Authorization Bugs in a Report Handoff
Kodus flagged firewall conversion differences and two report-token authorization flaws. Sanitized code shows the missing permission check and environment mismatch.
Two MCP Session Bugs and the Tests That Caught Them
A recursive close handler and stale client session IDs show why transport lifecycle needs explicit states and failure-focused tests.
Why Read-Only SQL Filters Are Not a Security Boundary
A SELECT-only query check cannot contain database authority, credentials, cached results, or multi-host access. Here are the controls that can.
ISC DHCP’s OMAPI Bug Can Exhaust Server Memory
Check access to the management port. Moving to Kea can be straightforward: my Salt-managed deployment kept its IP assignments and switched over in an evening.
Home automation
Lighting, fans, and Home Assistant
The configuration behind my kitchen lights, an RF fan that lost power, and the controls I use at home.
Control Multiple WLED Controllers as One Home Assistant Light
Six WLED controllers, mixed white channels, and one Home Assistant light group. Includes YAML, a read-only inspector, and checks for inconsistent lighting.
Keep a Bond Ceiling Fan Reliable Behind a Lutron Switch
One-way RF control fails when an upstream wall switch removes power. Continuous power and a clear control boundary fix the architecture.
Where I Would Use Matter Bulbs Instead of Lutron Caséta
I use Caséta for permanent lighting. A Matter bulb only makes sense to me in a continuously powered lamp, and I have not verified an exact bulb to recommend.
Add the Eufy Omni S2 to Home Assistant with Matter
Room cleaning works locally through Matter, but room identifiers, error handling, charging data, and battery reporting still need careful treatment.
Practical guides
Fixes I had to learn the hard way
Deployments, schedules, remote access, and recovery procedures you can reuse without inheriting my exact setup.
A Running Container Is Not a Deployment
Container health does not prove reachability, supported topology, persistent state, client continuity, backup, or rollback.
Prevent Overlapping Cron Jobs That Outrun Their Schedule
Use an atomic lock, meaningful exit status, observable duration, and explicit host ownership when scheduled work takes longer than its interval.
How I Deploy WordPress Changes Without WP-CLI—and Roll Them Back
I deploy this WordPress site with narrow PHP migrations, pre-write checkpoints, plugin backups, and public regression checks—not a stale universal publisher.
SSH SOCKS Proxy: When Dynamic Forwarding Is the Right Tool
How SSH dynamic forwarding works, where its encryption ends, how to verify the route, and when a real VPN is the better answer.
Calculators
Plan capacity and running costs
Network ranges, backup windows, power, and payback. The calculations run in your browser.
IPv4 subnetsCheck masks, host ranges, and /31 links.Backup windowsCheck daily capacity and backlog recovery.First backup uploadEstimate the initial transfer time.Electricity costPrice an always-on device.Smart-plug paybackCount the plug’s own power use.Upgrade paybackCompare purchase cost with actual savings.