Homelab

the robot pressing an inking stamp down onto a sheet of text, blacking out several lines into redaction bars, while the boy in the cap holds the page steady and a padlock sits on the table beside them

🕵️ Privacy-Preserving LLM Pipelines: Anonymize Before You Send

Replace PII with semantically realistic fakes before sending to a cloud LLM, then restore the originals from the response. Started with a general model and prompt engineering — then upgraded to a purpose-built 1.7B fine-tune via Ollama.

the boy in the cap holding a tablet showing four small line charts, connected by a single cable plugged into a port on the robot's chest

📈 Observing Local LLM Inference: llama.cpp's Built-in Prometheus Metrics

llama.cpp’s inference server ships a /metrics endpoint. One flag, Prometheus scraping, a Grafana dashboard loaded via ConfigMap sidecar — AI observability without a proxy layer.

the boy in the cap holding up a small processor chip toward the robot, who reaches out to it with an open hand; behind them a plain desktop computer and blank monitor sit on a desk

🤖 Local LLM Inference on Kubernetes, No GPU Required

A CPU-only self-hosted LLM stack running on k3s: llama.cpp as the inference server, Open WebUI as the chat interface, deployed as a single Git push.

the robot standing behind crossed hazard-striped barrier tape while the boy in the cap looks at it through a magnifying glass, one hand on his chin, thinking rather than reaching in

🚨 Don't Restart the Node. Quarantine It First.

Rebooting a misbehaving node feels productive. It isn’t. You’re erasing your evidence and skipping the lesson.

two winding paths leading to one server cabinet with its door open — the robot walking up the left path holding a key past a pi symbol, the boy in the cap walking up the right path holding a padlock past a cloud

🔐 Same Hostname, Two Traffic Paths: Local HTTPS Without a VPN

No open ports. Real TLS at home. One IngressRoute per app. This is the networking setup I landed on after ruling out everything that required a compromise.

the boy in the cap plugging a network cable into a server rack while the robot stands beside him holding a small server box in both hands, eyes closed and grinning

🏗️ My Homelab Runs on GitOps. Here's What That Actually Means.

I wanted to learn production-grade Kubernetes patterns without breaking production. One node, a full GitOps stack, and a hard rule: no manual kubectl after bootstrap.

the boy in the cap holding a phone showing a GitLab sign-in screen with a Continue button, a small ticket marked with a key travelling along an arrow from the phone to a QR code on the robot's chest, the robot's antenna lighting up

📱 Building a QR Code Login for a Homelab (And Learning oauth2-proxy's Session Format the Hard Way)

My homelab uses oauth2-proxy for GitLab SSO. I wanted a QR code login for the TV dashboard. Two days and four complete rewrites later, I knew more about oauth2-proxy’s session format than I ever planned to.