Home on zolty.systems

Why I moved my homelab repos off GitHub onto self-hosted GitLab CE, what broke during the cutover, and how the disaster-recovery rebuild from an S3 backup actually went.

A used Dell Latitude 7400 runs k3s or Proxmox for ~$150, sips 10W, and rides out power blips on its own battery.

How I wire Claude into OpenClaw — my homelab's autonomous ops + trading intelligence platform — so long-running agents can think, act, and interrupt me in Slack when something needs a human.

I run 3-5 parallel Claude Code sessions against the same codebase.

A structured 5-layer interview bot that extracts tacit knowledge, generates agent config files, and saves tokens by giving your agents real context.

I tried Figma, Excalidraw, Mermaid, Kroki, and raw SVG generation to auto-document a k3s homelab.

A complete guide to running your own private AI assistant on Windows with Docker Desktop, Ollama, and OpenClaw.

Benchmarking Z.ai's 744B GLM-5.1 model locally on a Mac Studio M3 Ultra with 256GB unified memory via llama.cpp.

Running ComfyUI natively on a Mac Studio M3 Ultra with MPS GPU acceleration, proxied through k3s Traefik ingress with Authentik SSO, integrated with Open WebUI and an MCP server.

How I added full observability to a Mac Studio M3 Ultra running Ollama — node_exporter, a custom Python model exporter, a Go metrics proxy, and Grafana Alloy for log shipping.

How I reduced OpenClaw's container CVE count from 46 Critical to single digits, locked down network traffic with default-deny policies, and automated daily CVE triage with a local LLM.

I built an autonomous CronJob that analyzes my k3s cluster off-hours and files GitHub issues for improvements.

Deploying Whisper STT, Piper TTS, and openWakeWord on a k3s cluster for Home Assistant voice pipelines.

How to write layered Goss specs that assert your .env values actually resolve to working MySQL credentials — not just that the vars exist.

I compared OpenClaw's open-source architecture against the leaked Claude Code source.

AWS Lens was built as an Electron desktop app.

A week of CVE patches, OpenClaw stabilization, Wiki.js fork shipping, PiKey, a self-hosted Actions cache, and a Reddit comment thread that made me document everything properly.

Wiki.js ships Mermaid 8.8.2 from 2020.

Fail2ban, OAuth SSO, IP block lists, DDNS whitelisting, and why a VPN is the easiest answer to the whole problem.

GitHub Actions cache hits are slow when your runners are local.

A rundown of the stability improvements I have made to my k3s homelab cluster over the past two months -- Harbor migration, Grafana SQLite fix, security patches, networking hardening, pve4 recovery, and CI/CD reliability.

Designing a WireGuard hub-and-spoke VPN mesh to connect a tech collective -- shared Jellyfin, CI/CD runners, game servers, and centralized monitoring across multiple sites with privacy-first logging.

Why I am replacing OAuth2 Proxy with Authentik for SSO across 20+ services -- Google federation, group-based RBAC, Traefik forwardAuth integration, and a phased migration plan that does not break anything.

How I built a headless GPU transcoding stress tester for Jellyfin on Kubernetes -- escalating concurrent streams against Intel UHD 630 VAAPI, JSON reports, and a k3s Job manifest that auto-cleans after 10 minutes.

How I built PiKey -- a Raspberry Pi Zero 2W that spoofs a Logitech K380 Bluetooth keyboard, jiggles the mouse, and auto-types LLM-generated text to simulate human activity.

A full audit of the k3s homelab as of March 2026 — compute, storage, networking, media, monitoring, and AI services across 42 namespaces on 7 nodes.

How the blog deploys itself using self-hosted GitHub Actions runners inside the k3s cluster — scheduled posts, Bedrock content generation, and Playwright scanning after every push.

Adding multi-user support with privacy guarantees, dual model providers (Anthropic direct API and AWS Bedrock via LiteLLM), and per-user cost tracking to OpenClaw on k3s.

A deep dive into Linkerd, what a service mesh does, its latest features like post-quantum cryptography, and why a 20-workload homelab doesn't need one yet.

How I replaced Open WebUI with OpenClaw -- a Node.js AI assistant gateway that is lighter, supports multiple channels, and deploys cleanly on Kubernetes with a custom Docker image.

A thought experiment taken too far: what would it actually take to have Claude rewrite the Linux kernel in Rust, module by module?

Regulatory compliance feels like a wall until you start climbing it.

A day working across five repositories with Claude as a pair programmer -- stock automation (13K LOC), Harbor registry migration, digital signage auth, cardboard sell signals, and OpenClaw cost optimization.

How I built Cardboard -- a trading card game price tracker that monitors 10 TCGs across TCGPlayer and eBay using a three-tier scraping strategy, runs on k3s, and displays historical price data on a Chart.js dashboard.

After a year with GitHub Copilot, I switched to Claude Code Max for homelab infrastructure work.

Why I stopped using separate weather and calendar APIs and built an HA proxy that turns Home Assistant into the single data source for every digital signage widget -- plus API key auth, graceful degradation, and the CI/CD fixes that made it all deployable.

Migrating 13 CI workflows from AWS ECR to self-hosted Harbor and Gitea -- eliminating 12-hour token expiry, Docker Hub rate limits, and per-image AWS costs.

A month-by-month timeline of building a production-grade homelab Kubernetes cluster -- from three bare Proxmox hosts to 8 nodes running 15+ applications with full observability, AI-powered operations, and 10GbE networking.

Building a complete swing trading research platform in one session -- 5 phases, 13K lines of Python, 199 tests, paper trading, and a Rich terminal dashboard.

Dialing in PETG settings on the Bambu Lab P1S -- running 265C nozzle and 80C bed instead of the advertised 230-250C, why first layer temps matter, and how Amazon delivered 4KG of filament just before I ran out.

Adding a Bambu Lab P1S to the homelab toolkit -- printing custom enclosures, cable brackets, rack mounts, and ventilated cases for cluster nodes with minimal setup and impressive quality.

How I added high-availability transcoding to Jellyfin with a Redis-backed session store, lease-based pod takeover, and shared NFS storage on k3s.

An honest look at what the Jellyfin HA conversion didn't solve — transcoding limits, SyncPlay, fork rebase burden, and the road to Track B.

Setting replicas to 2, running six failover scenarios, and measuring what actually happens when you kill a Jellyfin pod mid-stream on k3s.

Eleven ConcurrentDictionaries hold Jellyfin's runtime state in memory.

Deploying PostgreSQL on k3s, restructuring Jellyfin's volumes from monolithic PVC to NFS + Longhorn, and migrating years of media metadata without losing playback history.

Building a pluggable PostgreSQL database provider for Jellyfin using EF Core and Npgsql.

Four AI models reviewed the Jellyfin HA plan before any code was written.

Jellyfin was built for a single process on a single machine.

A complete incident report of a multi-failure Kubernetes debugging session: Longhorn self-healing, stale Jobs, an expired ECR secret, and three nested Python bugs that all had to fall in order before dnd-backend could start.