Homelab

the little robot stands guard at a doorway like a friendly bouncer, holding up a hand to check a stack of papers, while the boy in the cap watches; a shield symbol floats above them, protective and watchful

🔒 Building a PII Guardrail Proxy for Cloud LLM Calls

A local model classifies every prompt before it leaves the cluster. If it’s sensitive, it’s blocked. If it’s clean, it goes to NVIDIA NIM. 150 lines of FastAPI, deployed on k3s.

the robot pressing an inking stamp down onto a sheet of text, blacking out several lines into redaction bars, while the boy in the cap holds the page steady and a padlock sits on the table beside them

🕵️ Privacy-Preserving LLM Pipelines: Anonymize Before You Send

Replace PII with semantically realistic fakes before sending to a cloud LLM, then restore the originals from the response. Started with a general model and prompt engineering — then upgraded to a purpose-built 1.7B fine-tune via Ollama.

the boy in the cap holding a tablet showing four small line charts, connected by a single cable plugged into a port on the robot's chest

📈 Observing Local LLM Inference: llama.cpp's Built-in Prometheus Metrics

llama.cpp’s inference server ships a /metrics endpoint. One flag, Prometheus scraping, a Grafana dashboard loaded via ConfigMap sidecar — AI observability without a proxy layer.

the boy in the cap holding up a small processor chip toward the robot, who reaches out to it with an open hand; behind them a plain desktop computer and blank monitor sit on a desk

🤖 Local LLM Inference on Kubernetes, No GPU Required

A CPU-only self-hosted LLM stack running on k3s: llama.cpp as the inference server, Open WebUI as the chat interface, deployed as a single Git push.

the robot standing behind crossed hazard-striped barrier tape while the boy in the cap looks at it through a magnifying glass, one hand on his chin, thinking rather than reaching in

🚨 Don't Restart the Node. Quarantine It First.

Rebooting a misbehaving node feels productive. It isn’t. You’re erasing your evidence and skipping the lesson.

two winding paths leading to one server cabinet with its door open — the robot walking up the left path holding a key past a pi symbol, the boy in the cap walking up the right path holding a padlock past a cloud

🔐 Same Hostname, Two Traffic Paths: Local HTTPS Without a VPN

No open ports. Real TLS at home. One IngressRoute per app. This is the networking setup I landed on after ruling out everything that required a compromise.

the boy in the cap plugging a network cable into a server rack while the robot stands beside him holding a small server box in both hands, eyes closed and grinning

🏗️ My Homelab Runs on GitOps. Here's What That Actually Means.

I wanted to learn production-grade Kubernetes patterns without breaking production. One node, a full GitOps stack, and a hard rule: no manual kubectl after bootstrap.

the boy in the cap holding a phone showing a GitLab sign-in screen with a Continue button, a small ticket marked with a key travelling along an arrow from the phone to a QR code on the robot's chest, the robot's antenna lighting up

📱 Building a QR Code Login for a Homelab (And Learning oauth2-proxy's Session Format the Hard Way)

My homelab uses oauth2-proxy for GitLab SSO. I wanted a QR code login for the TV dashboard. Two days and four complete rewrites later, I knew more about oauth2-proxy’s session format than I ever planned to.