It’s a mix of “too expensive” and “I should have spent more on this”.

None of this was designed all at once. It’s the result of buying things for one reason, repurposing them for another, and slowly discovering a stable setup.

What it’s for

HomeOps is the boring half of my homelab: the part that runs the services I actually depend on.

It started as an all-in-one server, but I eventually moved away from that. It was convenient until it wasn’t; every change was risky.

Splitting it up gives me more to manage, but also a smaller blast radius when something goes wrong.

Overview

Each of these devices could do more than they currently do, but I’ve tried to keep their roles separate.

They are more like pets than cattle: the software is reproducible but the machines are not disposable.

NAS

I have a dedicated machine for Network Attached Storage. I built it myself; the specs are in the repo . It runs TrueNAS and is the central place for storage, backups, archiving, and media.

Storage is shared over NFS for Mac and Linux, and SMB for Windows. The only app the NAS runs is minIO , which provides S3-compatible storage. minIO changed its license recently so I am eventually going to swap it for something else.

It has 4TB of NVMe storage, which is the pool I use most often. My NAS and PC are connected through a small 10GbE switch, so from my PC it feels like the drives are plugged in directly. These drives are not set up in a RAID array, so if one failed I would lose data.

For archiving and longer-term storage it has 4 x 6TB HDD set up in a RAIDZ2 array, which means 2 of the drives could fail before I lost data. Anything important is copied to the RAIDZ2 pool, which is why I’m comfortable running the NVMe drives without redundancy. RAID is not a backup , so I should back this data up to an external location, but I’m yet to set this up.

It was originally made up of spare parts from an old gaming PC but I decided I wanted ECC memory. That meant replacing the CPU and motherboard with parts that supported it, and the affordable options were older server components. At this point the only gaming PC parts still in use are the case and the PSU.

Review

Those older server components are less efficient and more power-hungry than newer ones would be.

It was expensive. I made the decision that storage was important enough to justify ECC memory, but plenty of people choose to go without it. ECC is there to protect against memory-related corruption, and I don’t know whether it’s ever actually done that.

It’s overpowered and underutilised for its current role, mostly because it used to do everything and now it just does storage.

However, it plays a major part in my HomeOps setup, so it’s definitely worth its place.

If you have a homelab, or even just multiple computers in one household, you would benefit from a NAS. It doesn’t need to be an expensive one like mine though.

NUC

I use an Intel NUC as my server. Specs are in the repo .

Originally I used my NAS as a server, until I found that messing with it made it unstable, so I stopped doing that and looked for something else. I bought something from Kickstarter, and in true Kickstarter fashion it was delayed multiple times, and eventually I got impatient and bought the NUC.

It’s modern and pretty power efficient, which means running it is much cheaper than the NAS made out of older components.

The CPU has 12 cores and 16 threads, which gives me plenty of headroom for virtualisation. I have Proxmox installed and use it to run 9 virtual machines and 1 LXC. This lets me split services across separate environments instead of installing everything directly on one host, so a problem with one service is less likely to affect the others.

The LXC is for Jellyfin, which is self-hosted Netflix for movies I store on my NAS. The NUC has an integrated Intel GPU that supports Quick Sync, which Jellyfin uses for hardware-accelerated transcoding. This means I can watch my movies from any device and let the GPU do the transcoding, leaving the CPU available for the other services hosted by the NUC.

Review

The NUC is an excellent home server. It’s not enterprise hardware with redundant power supplies and room for expansion, but its size and efficiency make it a great fit at home.

The trade-off is that it’s not a box for lots of disks. Mine has room for an SSD boot drive and the NVMe I use for local data. After that I needed to pair it with my NAS for extra storage.

It has a 2.5GbE NIC. That is not as fast as the 10GbE link to the NAS, but is more than enough for what I use it for.

If I started again and didn’t need much local storage, a machine like this might be all I needed.

Unfortunately Intel has stopped making these but places like Minisforum make ones that are similar.

VPS

The VPS is the only machine in this setup that I don’t physically own. It’s rented from Hetzner .

It is the public side of my “tunnel” setup, which I’ll explain in a future post. The services I run are hosted at home and this VPS gives me an entry point without directly exposing my home network.

There isn’t much to say about it. Hetzner is some of the cheapest European hosting I could find, and even though the VPS is located in Germany it doesn’t add any real delay to my connection.

MonPi

The final part of the setup is the Raspberry Pi that monitors everything else.

The reason it exists is separation. I didn’t want to run monitoring on the same machines that host the services. If the NAS or the NUC has a problem, a separate device has a better chance of catching it.

It runs two types of monitoring: Uptime Kuma for service uptime checks, and Beszel for host metrics. I’ll cover these in more detail later in the series.

Review

The Pi works great for monitoring, but for this particular model that’s about all it can do.

It was originally called “DeskPi” and was plugged into a screen to show a live output, but because it has only 2GB of RAM it struggled to run the desktop environment and I quickly gave up on that idea.

What’s missing

There are two pieces of hardware people might expect to see listed here that I don’t yet have: a custom router and a UPS.

I still use the router my ISP gave me, instead of something like OPNsense or pfSense. I’ve worked around some of its limitations by letting Pi-hole handle DHCP - more details on that in the Pi-hole post. I will be moving soon, and when I get settled I’ll start working on the router.

The UPS will come after. It is risky running a NAS without one, but I live in the UK, and in the five years I’ve lived in this house there’s been exactly one power cut, so I haven’t felt the need to prioritise it.

Not Highly Available

The obvious limitation of my setup is that it’s not highly available.

Splitting storage, compute and monitoring across different machines gives me cleaner roles and a smaller blast radius than the all-in-one server I started with. It does not mean the setup can survive any of those machines breaking.

If the NUC dies, my services go offline. If the NAS fails, the storage layer is unavailable. If the VPS has a problem, friends and family can’t get through the tunnel. MonPi monitors the setup, but nothing is monitoring MonPi.

There is an old redundancy saying that “two is one and one is none”. That applies here, but in different ways at different layers. The NAS has redundant disks, but it is still a single machine with one motherboard, one power supply and one network path. The NUC is a single host, so the VMs and containers running on it have nowhere else to fail over to.

Making the NUC highly available would mean running multiple Proxmox nodes. That means not just two machines, but three, so Proxmox can maintain quorum .

That would be a better HA design, but it would also mean more hardware and more power usage.

For now, I have accepted that my setup might have downtime because that is the trade-off that keeps it affordable and manageable at home.

Next

That’s the hardware covered for my setup.

The important thing is not that any individual machine is special, it’s that each one has a clear job. The NAS stores things, the NUC runs things, the VPS provides the public entry point, and the Pi monitors it all.

It’s not perfect, and it’s not highly available, but it’s much easier to work with than the all-in-one server I started with.

Next I’ll look at the storage layer in more detail: how I use TrueNAS for network shares, archives, and the storage services that support the rest of the setup.

Logseq seems to suit my brain more than Obsidian, but with either tool the best feature is the cross-linking of ideas. I will sometimes forget where I wrote a note, but I remember that it linked to other ideas, so I can go to them to find the one I am looking for.

And I especially like finding out I have written about an idea before, and that I can see how my thinking has evolved since then.

What is HomeOps?

HomeOps isn’t a widely used term, but I have seen a few people use it. To explain what I mean by it I should first define “Homelab”.

A homelab is a setup of computers you control and use for experiments - like a laboratory. It’s usually at home, hence the name, but not always. You might own all the equipment, rent it, or even send your own machines to a provider so they can run them for you - called “colocation”.

The problem is that homelab seems to cover experimentation as well as self-hosting services you use every day, which have different needs.

HomeOps, short for “Home Operations”, is my attempt at labelling the stable part of my homelab.

Purpose

My HomeOps setup is used to host the apps and services a few people depend on, so I can’t be breaking it every five minutes.

Some people call this “HomeProd”, short for “Home Production”, which separates it from the “development” or “staging” environment you use for experiments.

As such I treat it like a real production system: stable, reproducible, and intentionally boring to operate.

Architecture

The system is split over different machines, each with a different purpose.

• a NAS provides storage over the network
• a server hosts all the apps and services
• a rented VPS lets external users in securely through a “tunnel”
• a Raspberry Pi monitors it all

The whole thing is written down as Infrastructure as Code, with Terraform defining the infrastructure and Ansible for configuring it. This would let me reproduce it if a machine breaks and I need to set up a new one.

The server uses a hypervisor as an operating system and services generally get their own virtual machine. One of those VMs uses Docker to run most of the apps.

Key Decisions

Each of these deserve their own post later in the series.

Separating HomeOps from Homelab

I made this split after the data loss incident which taught me not to let others depend on apps I’m only trialing in my lab, especially without working backups.

Infrastructure as code

Everything is written down as code, so there’s as little manual setup as possible. This means I can see what’s going on by inspecting the code, and I can automate configuration.

Terraform and Ansible, not Kubernetes

When I started I wanted to compare Terraform and Ansible against Kubernetes for running a homelab.

I thought I’d prove that Kubernetes was obviously the better choice, but two years later I’ve found the Terraform and Ansible setup works just fine, so that’s what powers my HomeOps.

I use Kubernetes in its own environment where I run experiments.

Not highly available

One downside to my setup is that it’s not highly available. If a machine breaks then there’s nothing to fill in for it until I replace it. I could fix this by running more machines, but that increases the cost.

For now I can live with the downtime. So far nothing’s broken, although one day something will.

What this series will cover

In this series I’ll go over each part of the system in more detail, including the hardware, IaC, services that run on top, and how I let people access it from outside my home.

The aim is not to present this as the correct way to run a homelab, but to explain the choices I made, how they fit together, and why I use the apps that I do.

It will be split up so you can dive in and out at any point to read just the parts that interest you, with links to anything written earlier that provides necessary context.

It might be awkward in that the system builds up in layers, and things may only make sense for my particular setup, but I’ll try my best to generalise each part so it’s relevant on its own.

Next

Coming up first is the hardware I use.

Check back soon for the link, or subscribe to the feed for this series in your feed reader.

Or jump straight into the code, which is now on GitHub .

For pages that are really just lists you can treat them like posts on a blog.

My directory of indie web directories is one of those, it’s a collection of links that grows over time.

Since my site is built with Hugo, I:

• changed the page into a section
• made a file for each entry

and Hugo made a feed for it.

The only tweak it needed was in the RSS template, so that for this new section the <item><link> would point to the directory instead of my own site, which for me looked a bit like:

{{- $itemLink := .Permalink -}}
{{- if eq .Section "indieweb-directories" -}}
	{{- with .Params.link -}}
		{{- $itemLink = . -}}
	{{- end -}}
{{- end -}}

<item>
  <title>{{ .Title }}</title>
  <link>{{ $itemLink }}</link>

This works well for pages where updates are incremental additions, such as changelogs or collections.

It works less well for pages that are edited in place. You’d need to post what changed, which means keeping a history of revisions - something wikis do by publishing diffs.

Those updates can be harder to read, and while you could do it with Hugo, you’d have to write them manually. There’s no built-in way of creating them.

In my case it works, not because I’ve solved how to signal updates to a page, but because it turns out my page wasn’t even a page in the first place.

I too have been annoyed by GitHub’s performance lately, and that’s just from using it personally.

I can’t imagine what’s it’s like for those relying on it for paid work right now.

Curious to see where Ghostty ends up, and what impact this has on its contributions.

Related:

• The Missing GitHub Status Page
• Before GitHub

My inspiration was from a few weeks ago when Ricardo demonstrated his new setup at Homebrew Website Club London . I guess I was prompted into action by the How to unblock yourself and actually post more often session this weekend, but I’m trying to give credit where it’s due, since my demo was basically the same as his.

What I didn’t show, however, was all the work that’s been happening over the last few months to make my demo possible, which is why I’m posting this.

Also, I wanted to regain some nerd-cred because my demo was followed by Naty who showed us an updated stats page , which looks awesome and is something I’m going to have to steal.

Intro

My site’s powered by Hugo, which is a static site generator that turns files into a website.

I write posts on my laptop and push them up to GitHub, where the site gets generated with the new content and then deployed to my server. I’ve written about that before , which you don’t need to read for this, I’m just setting the scene.

With that setup I couldn’t publish from my phone, which is sometimes all I have on me.

The indie web has a solution for this called Micropub , which is an API for creating posts on your site, even if you use a static site generator like I do.

IndieKit

As mentioned, a few weeks ago at HWC Ricardo showed us his new setup, to which he’d added a Micropub server called IndieKit .

It was created by Paul Robert Lloyd , who I met (briefly) at an IndieWebCamp eleven years ago.

Side note - isn’t it strange that there’s millions of things on the web but you prefer using the things made by people you’ve met in real life?

IndieKit works by connecting to the place you store your posts, which for me is GitHub, and lets you write new ones from the web:

✨ Sparkles ✨

The other thing a Micropub server lets you do is use any Micropub client you want. You don’t have to use the one in Indiekit - which is perfectly fine by the way - you can use a different one if you like.

Or you could use multiple. Epilogue and indiebookclub both let you post about books you’ve read.

Or you could post from a native app, like iA Writer , a markdown editor that lets you post to WordPress, Ghost, and with Micropub: your own website.

The one Ricardo showed us in his demo, because it’s got a good interface for posting about songs and albums, was Sparkles .

I don’t post about songs or albums, but I do like how it looks, so I included it in my demo:

Bonus content

And that’s where my demo ended.

Here’s the extra footage.

Home server

I first tried running IndieKit on the Raspberry Pi that hosts my site.

The Pi doesn’t have any direct storage attached. That means I can’t reliably run a database on it and IndieKit needs one for some of the features I want from it.

I didn’t want to rent another server. I already have one at home, so I installed IndieKit there instead.

It works, I can access it from my phone, but only on my home network. Not much of an upgrade.

Tunnel

The next step then was to add it to the “tunnel” setup I have.

I rent a VPS, which lives in Nürnberg by the way, and have Pangolin running on it, which is a reverse proxy that sends traffic down a Wireguard tunnel that ends in my home.

and now I can post to my site, wherever I am 🎉.

Deleted scenes

Dan’s indie feed reader feed.city - which I discovered through IWC this weekend - caught me testing all of this and recorded my test posts .

Sometimes deleted scenes are deleted for a reason. They’re boring.

I only included them here as part of the Extended Edition theme I’ve chosen to use. Let’s skip forward.

Behind the scenes

When I use Sparkles to post to my site:

• I go to sparkles.sploot.com and enter my website’s address
• Sparkles sees the address of the Micropub endpoint I declare in the <head> of my site
  • which points at IndieKit
• Sparkles connects to IndieKit
  • by going to the VPS in Germany
  • through the tunnel into my home in the UK
  • and finds IndieKit on my home server
• I write a new post
• IndieKit sends it to GitHub
  • GitHub creates a new markdown file
• the change triggers my deployment pipeline
  • which builds the site
  • and pushes it up to the Raspberry Pi

This is more complex than a typical hosted solution but it means I can self-host IndieKit at home and access it from anywhere.

If you’re into that sort of stuff, stick around, I’ll be posting about the setup and sharing the code soon.

Sequel?

If you’re not, then I might see you at a future IndieWebCamp, hopefully in-person that time.

Maybe that’ll be IndieWebCamp Nürnberg 2026 and I’ll get to meet my VPS for the first time, as well as some of the wonderful people who made this weekend possible.

Today I’m working on:

• setting up IndieKit so I can post from my phone
• changing my /links page so posts tagged as link and links are also included

I’ll hopefully have at least one ready for demos later.

Sessions

The first session of the day was Running your own LLM to get out of big tech. The word was inevitably going to come up, so it was good to hear an indie approach that lets you keep your privacy whilst using it.

The second session was Private posts, which didn’t have a microphone nearby, so it wasn’t recorded.

After a long lunch the third and fourth sessions were about Feeds and Canvas animations. It was good to hear creative talks happening, especially about boring tech like RSS.

The last sessions of the day were Organising data and Homepage design. It turns out nobody really likes their current homepage, which was weirdly reassuring.

Bonus session

I say they were the last sessions, but there was actually a secret session right at the end of the day on How to unblock yourself and actually post more often. There were lots of good ideas mentioned, like Dan’s Polaroids project where he takes and publishes a Polaroid every day.

The one that stuck with me is the idea that you can write a brief summary about something that happened and then hit publish without spending too much time on it.

I’ll be joining in remotely this weekend. I do wish I was there with you all, maybe next time!

“They are selling you a solution to a problem they created. They want you to feel insecure. If you feel insecure, you pay the subscription.”

“You are not bad. You are a jazz musician in a world trying to sell ringtones.”

here’s a collection of articles that to some degree answer the question “Why have a personal website?” with “Because it’s fun, and the internet used to be fun."

(It still is, but it used to be, too)

Then I was introduced to Russel’s paradox , which asks if a directory should include itself?

The answer is no, you make another one .

all the signs are pointing to the fact that we might be in endgame for “open” as we’ve known it on the Internet over the last few decades

See also:

• Prepping for the endgame of the open web
• Some Thoughts on the Open Web

I get inspired by many things mentioned at HWC , but somehow the first to make it to my blog, based on a comment from the last meetup, is this:

📡 Broadcast

⏹️ Stop

To make this I was going to need to look up the Morse code alphabet, and then use it as part of a script.

I was feeling lazy so I used an LLM to do that for me, and it ended up writing the whole thing, including turning it into sound, which I hadn’t even asked it to do.

It didn’t just make it all, in seconds, it ruined any fun I might have had experimenting on a new thing, maybe even learning a thing or two.

So I present it here begrudgingly.

I am using this note to test I can send an RSVP .

If you see my name on this list then it worked.

I wrote that I was going to optimise my photos so they would be smaller and I could include them in my posts, since that’s all I was planning to do.

Then I realised I needed a video in my post. If you’ve read Museum memories you’ll know why.

The problem

My website is powered by Hugo, a static site generator that takes an input, like my markdown files where I write my posts, and outputs a website.

I store both my site code and content in Git, which also drives my deployment process: every change triggers a new build and deploy.

This is where it gets tricky with media files.

Photos

To include my own photos in a blog post I need to host them. I can do that in Hugo, but I would need to save the photos with Git so it’s part of the site and the deployment process. The problem with this is photos can be quite large, so they bloat the Git repository.

This isn’t really a problem with one blog post with a few photos, but it does become a problem when you do it over and over for many years.

I don’t know if I’ll be posting lots of photos, or doing it for many years, but I don’t like the idea of one day having a scaling problem, I’d rather fix it now.

Videos

Videos are even more of a problem. They’re much bigger than photos, and they don’t compress down as effectively.

A 7 MB photo can compress down to 200 KB, which might be tolerable in a Git repo.

A 15 second video might be 30 MB and only compress down to 15 MB.

A solution

Instead of keeping my photos and videos inside the Git repo I am moving towards separate media hosting for them. I wanted to publish my photo post before fully solving media hosting, so I’m using a temporary solution for now.

I have made a directory on my server and uploaded the videos there. I then changed my web server to serve the files in this directory at https://paultibbetts.uk/media/ and updated my post to use this URL for videos.

You can see the change in infrastructure code on GitHub .

It’s Temporary™

My web server has 50 GB of storage so there is a limit to how many photos and videos I can upload. This type of storage is relatively expensive and it’s awkward changing the setup.

A better solution for media hosting would be a storage bucket and a Content Delivery Network to serve the files, as mentioned in Changes to the Site .

I don’t know when that’s happening.

I have not been to many museums or galleries. I am not a cultured person.

My favourite museum is the city of Barcelona.

Museums

I grew up in Birmingham, UK, and I have been to a few museums there. We went on a school trip to the Science Museum and I’m pretty sure I’ve been down to London to go to the Natural History Museum.

They’re all great.

My favourite museum trips were all in Barcelona, and there must be something to that city because out of the three entries to this month’s carnival I’ve read there’s already one about a museum there .

Barcelona

I first went in 2017, staying for a week in a hotel in Eixample, a giant extension to the city that was started in the 1860s.

The Old Quarter, the historic core, dates back over 2,000 years. It was founded by the Romans as Barcino and some of their walls are still standing.

The development of other parts of the city, like Barri Gòtic and El Born, happened during the medieval period and were built right on top of what came before.

It’s chaotic and organic.

Eixample

Eixample, known in English as “extension”, is the complete opposite. It was designed as a uniform grid layout, and turned out to be very forward-thinking design.

The octagonal blocks give better visibility at intersections and make turning easier for vehicles, even ones we use now, which didn’t exist when the design was first conceived.

Museums

I mention all of this because the city itself is a giant museum. You can step back in time, in design, and urban planning, and wander through the narrow cobbled streets of the Old Quarter, then walk ten minutes to Eixample to see an extension, started two hundred years ago, that’s still celebrated for how modern it is.

Barcelona has free museum visits on Sundays (in most city-run museums), with free entry from 3pm onwards and all day on the first Sunday of the month.

I made a second trip later in 2017 for a month, and ended up staying six weeks. I visited most of the free museums whilst I was there,

as well as Castell de Montjuïc, the fort on the hill.

It was interesting to see how it was being used.

Barcelona does a really good job of preserving layers of its past, from Castell de Montjuïc, to Roman walls in the Gothic Quarter and entire neighbourhoods from the 1700s, like those uncovered in El Born.

These are curated spaces that preserve and display the history of the city itself.

I don’t have a favourite museum in Barcelona. Barcelona is my favourite museum.

Galleries

It’s also a giant street art gallery.

The residents communicate with posters, stickers and slogans:

To deter graffiti many property owners commission work for their shutters:

which is respected and left untouched.

The streets become a gallery, with guides offering tours of their own curated favourites.

Architecture

Speaking of streets, some of the best views are of the architecture.

Whether it’s an open public space…

or one of the many gold statues…

or an ornate entrance to a church…

it’s hard not to admire the intricate details and extravagance of Barcelona.

A lot of that is the result of Antoni Gaudí, a Catalan architect and designer, whose designs stretched from parks and gardens:

to one of the most ambitious Catholic churches in the world, started 143 years ago and still under construction:

Culture

Perhaps the biggest highlight of my first trip was its timing. I’d accidentally arrived during La Mercè, Barcelona’s annual festival that’s been going on since 1871.

Every corner of the city was filled with art and music…

as well as papier-mâché giants and castells (human pyramids, or “castles”)…

and the wildest fireworks show…

I’ve ever been to…

2017

What made 2017 special was the result of hundreds of years of history - it marked the first independence referendum hosted by the Catalan government.

The city was covered in flags, and signs that said “Si” - which meant yes, if given the chance to vote.

There were plenty of Si supporters…

They once interrupted a conversation I was having, and it was the highlight of my trip.

At, I think it was, 6pm, supporters of the vote leaned out their windows and started smashing pots and pans. It was a DIY siren to let everyone else know they existed, and that they wanted to vote.

It was deafeningly loud and an extremely effective way of communicating.

History

I’m no expert, but a brief history is:

• in the Middle Ages, Catalonia was part of the Crown of Aragon
• the War of Spanish Succession (1701-1714) saw Catalonia become part of Spain
• the dictatorship of Francisco Franco restricted Catalan language and culture from 1939 to 1975
• in 2006 Catalonia negotiated a new agreement with Spain
• Spain’s conservative party opposed it and it went to court for 4 years
• in 2010 the court ruled that parts of the agreement should be annulled
• Catalans saw the agreement as settled and not to be changed
• this sparked a resurgence in the independence movement

which led to the referendum in 2017.

The result

The Catalan government claimed that 90% of voters voted “Yes”, however they also recognised that it had only a 42% turnout.

Because of this, Spain ignored the result and then called it illegal anyway.

A month later Catalonia’s parliament declared independence.

The next day Spain dissolved the Catalan government, arrested several of its leaders, and the regional president Carles Puigdemont fled to Belgium.

Since then

Unfortunately, since then, the only notable things to have happened are trials and prison sentences followed by a new amnesty law that pardons some of those involved in the push for independence.

I wish this had a better ending, and that the Catalan people were given a legal vote to decide what they want to do. I don’t know if independence is a good or bad thing for Catalonia, I’m just a tourist with an admiration for its capital.

Memories

I met a Spanish man on a hiking trail once and tried to tell him how nice Barcelona is. It turned out he did not want Catalonia to become independent, so he didn’t want to talk to me, and he definitely didn’t want to see my photos.

Thanks for the IndieWeb Carnival prompt James . It gave me an excuse to put this on my blog and add support for photos and videos.

And it was good to reminisce.

Changes:

• Notes: shorter posts that don’t need titles
• Bookmarks and likes: a way to share links without writing full posts
• Replies: posts that are part of a conversation with another site
• Webmentions: now appear below posts

Ideas:

• serving media through a CDN
• dynamic image resizing with imgproxy
• publishing from my phone using micropub

Notes

My site now has notes . They are still posts but I treat them a bit differently.

Notes don’t need a title, and they’re usually shorter, but they’re effectively the same as the articles I’ve already been posting. The real difference will be what I end up classing as an article instead of a note.

I added them because I wanted to post moments in time without needing to write several paragraphs like I would in an article. This post was nearly a note, until I realised it was more than just recent changes and that I could write about future ones as well.

I think I will probably end up writing less articles now I have notes but when I do write an article it should mean that it’s taken more effort to write, and is therefore of higher quality, but I’m not guaranteeing anything.

Bookmarks

I’ve also added bookmarks , which I’m going to use to share links to interesting things around the web.

These are notes with a bookmark_of field set to the URL I’ve bookmarked. They are then displayed a little differently, with the link going to the bookmarked site instead of my own post.

<a class="u-bookmark-of" href="https://example.com/post">Example</a>

Using a different post kind for this makes it easier for me to share links, since I don’t need to write an article talking about it, or even a note saying what I like about it. I can just share the link.

Likes

Another type of link I’m going to share is a like , which is both a reaction and me sharing something. I don’t know if there’s going to be a system for deciding whether something is a bookmark or a like so I will make it up as I go along.

<a class="u-like-of" href="https://example.com/post">I liked this</a>

Because I don’t know what the difference will end up being, and they’re both just a link to something, I have also added a /links feed which includes both bookmarks and likes.

This will be my own curated version of the internet I want others to know about.

Webmentions

Speaking of likes, I got my first webmention like! Thank you Joe !

I was checking Google Search Console and found a page showing me what sites linked to mine when I saw Joe had liked one of my posts .

I run my own site because I enjoy doing so, but that interaction made it all seem worth it, and I want to post likes from my own site to share that with others going forward.

webmention.io

Joe was able to send me a like because I signed up to webmention.io , which now collects my webmentions for me.

It also provides a feed showing all the webmentions my site has received, which I’ve added to my reader so I’m notified of new ones.

To display the webmentions on my site I’m using webmention.js to show them below the post they are mentioning.

Replies

The other post type I’ve added recently is a reply .

These are notes that are in response to someone else’s post. I will use webmentions to tell them that I’ve written it, after which they could display my reply as a comment.

This now means that to write about a link I could:

• write an article about it
• share it as a bookmark
• share it as a like
• write a note about it
• reply to it directly

So to try and make a rule for them: replies are notes that are part of a conversation.

Where it gets confusing is that any type of post can also be a reply. I could publish a post as an article, and then include a line like

my entry for
<a class="u-in-reply-to" href="https://carnival.host/prompt.html">this month's IndieWeb Carnival</a>

and the post would be both an article and a reply.

If the site I’m replying to displayed my article in full, it might be as long as their original post. Because of that they might show only an excerpt, or just link to it instead.

So, for long articles that are technically also replies I will have to make sure I write a shorter summary that works well as a comment, which could be displayed in full.

The replies I write using the reply post type will be written as I want them to appear in the conversation.

Planned changes

My entry for this month’s IndieWeb Carnival is taking longer than I thought because it’s turned into a holiday photo dump.

This has had me questioning my setup, which is annoying because I thought it would last a bit longer before it needed changing.

I have not even finished my post about infra.paultibbetts.uk , which documents my infrastructure, and I am already thinking of changing it.

I do enjoy working on my site, maybe even more than actually using it, but I have other things I should be working on.

I don’t know when the following will get done.

Media

My draft Carnival post was starting to include photos from my phone, which were about 7 MB each. I hadn’t thought about photos before and didn’t have a process for them.

My site uses git for version control, which is great for text like code and content but it starts to get bloated when you fill it with 7 MB photos. I started thinking up a better system for this, which is coming up next, until I realised I could optimise my images before saving them in git.

The solution for now is to run a script that replaces the original image with a compressed version. The 7 MB photos shrink down to ~200 kB. I am still bloating my repo with images, but at a much more tolerable size.

CDN

A better solution is to store my photos separately, which lets me keep the repo slim by tracking only text files.

I could use my Raspberry Pi to host the photos, but it uses Network File Storage which is a bit slow and has only 50 GB of storage.

Instead I’m thinking of using a storage bucket, which could grow to any size, and then using a Content Delivery Network to serve the assets.

Edit

I needed a temporary solution, so in Added support for photos and videos I explain how I’ve set up my Raspberry Pi to host my media files until I get a storage bucket and CDN sorted out.

Dynamic Image Resizing

I might also use something like imgproxy to dynamically resize images.

When a user requests a smaller version of a photo, imgproxy would generate it on demand. That resized image would then be cached by the CDN, so future visitors can receive the optimised version immediately.

This might mean I can stop compressing photos manually and just use the originals.

Micropub

The final change to my site, which will really elevate it from a simple blog to a personal publishing system, is using micropub to let me post from my phone.

This would need hosting and hooking up to my git repo to manage my content. I would have the same problem as I do right now if I used it for photos, so I will need to wait until I have the storage bucket and CDN sorted before tackling this.

I’m considering using Indiekit as my micropub server, as it works with Hugo (which powers my site), and can also syndicate my posts out to social networks. It doesn’t look like it has a Micro.blog plugin yet, so I’d need to write one before I can selectively choose which posts to syndicate there.

Micro.blog

Which leaves me with a site that can do what I currently use my Micro.blog microblog for. I want to stay as part of the Micro.blog community, and will continue using their apps, but I can see myself migrating the hosting of my content to my own site in the future.

I could merge my Micro.blog posts into the notes on my own site and then syndicate future posts to the Micro.blog timeline, and for Micro.blog users nothing will seem to have changed, only where my content is hosted.

My feed might even get better, as I could filter out posts that I know the Micro.blog community wouldn’t be interested in.

This isn’t a remark against Micro.blog by the way - I think it’s an excellent service - I just believe that I was destined to outgrow it, since I always intended on working on my own site. I think of it more as graduating as a socially-capable indie website, and because Micro.blog is part of the indieweb I can stay part of its community.

I would be missing out on lots of features that Micro.blog has that I don’t yet support, so it wouldn’t be a seamless transition, but after implementing all the above ideas my site should be capable of hosting all of my post kinds in one place.

[…] the path back to feeling like you have some control is to un-spin yourself from the Five Apps of the Apocalypse and reclaim the Internet as a set of tools you use to build something you can own & be proud of

I use it to provision the infrastructure for my personal website.

This is why I built it, what it does, and how to use it.

Why I built it

I prefer writing down my infrastructure as code. It’s something I’ve been doing for years now, and I don’t think I could go back to doing things manually, no matter how small or simple the setup.

I’d decided to use a Pi from Mythic Beasts to host my site and saw that they had APIs available, but no Terraform provider.

Terraform is a tool I’ve been using for infrastructure for a while now, and I wanted to use it with Mythic Beasts because:

• I wanted a fully reproducible setup
• I didn’t want to click around the control panel
• their Pis are IPv6-only, so I’d need to also set up the proxy
• • I wanted to declare the Pi and the endpoints for the proxy in the same place

Plus, I’d never written a Terraform provider before, and I wanted to see what it was like.

What it does

Terraform is a tool for writing your infrastructure as code, and a provider is a plugin that lets it work with different infrastructure providers.

For example you can write:

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    mythicbeasts = {
      source = "paultibbetts/mythicbeasts"
    }
  }
}

resource "mythicbeasts_pi" "pi" {
	identifier   = "web"
	disk_size    = 10
	model        = 4
	memory       = 4096
	os_image     = "rpi-bookworm-arm64"
    ssh_key      = "ssh-ed25519 ..."
    wait_for_dns = true
}

then run terraform apply, and you would get a Raspberry Pi 4 from Mythic Beasts.

Resources

The provider uses the Mythic Beasts APIs to configure the following resources:

• VPS
• Raspberry Pi
• Proxy endpoint

The Raspberry Pis from Mythic Beasts are on an IPv6-only network, so the Proxy endpoints are to allow users trying to access from an IPv4-only network.

Data sources

Some of the settings for the resources require specific values, like the os_image to use, and data sources make it easy to get this info from the API.

For example, the mythicbeasts_pi_operating_systems data source can be used to get all valid os_image values for a Raspberry Pi 4:

data "mythicbeasts_pi_operating_systems" "four" {
  model = 4
}

where you would inspect the data to choose the right value to use.

Alternatively you could use Terraform to find the right value for you, for example to use “Bookworm” for “Arm64”:

data "mythicbeasts_pi_operating_systems" "four" {
  model = 4
}

locals {
  bookworm_arm64 = one([
    for image in data.mythicbeasts_pi_operating_systems.four.images :
    image.id
    if strcontains(image.id, "bookworm") &&
    strcontains(image.id, "arm64")
  ])
}

resource "mythicbeasts_pi" "bookworm" {
  model    = 4
  os_image = local.bookworm_arm64
  ...
}

where Terraform will find the image with both “bookworm” and “arm64” in the ID.

Attributes

Using Terraform for your infrastructure not only lets you write it down as code, with all the benefits that brings , but you can use the attributes of one thing as inputs for another.

For example: the Pis from Mythic Beasts are on an IPv6-only network and need endpoints set up on the proxy to let users access them from IPv4-only networks.

To do this you can get the attribute from a Pi, like the IP address, and then use that as the input for the proxy endpoint resource:

locals {
  domain = "example.com"
  subdomains = {
    apex  = "@"
    www   = "www"
  }
}

resource "mythicbeasts_pi" "web" {
	identifier   = "web"
	disk_size    = 10
	model        = 4
	memory       = 4096
	os_image     = "rpi-bookworm-arm64"
    ssh_key      = "ssh-ed25519 ..."
    wait_for_dns = true
}

resource "mythicbeasts_proxy_endpoint" "endpoint" {
  for_each = local.subdomains

  domain         = local.domain
  hostname       = each.value
  address        = mythicbeasts_pi.web.ip
  site           = "all"
  proxy_protocol = true
}

How to use it

The provider is available on the Terraform registry .

Authentication

The Mythic Beasts APIs require an API key for authentication.

When creating the key you must add permissions to work with the APIs you wish to use, such as:

• “Virtual Server Provisioning” for VPS
• “Raspberry Pi provisioning” for Pis
• “IPv4 to IPv6 Proxy API” for Proxy endpoints

Proxy endpoint domain management

The domain used for proxy endpoints must be registered with the Mythic Beasts control panel.

This can be done by registering the domain using their domain management or by adding it as a 3rd party domain .

Installation

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    mythicbeasts = {
      source = "paultibbetts/mythicbeasts"
    }
  }
}

provider "mythicbeasts" {
  keyid  = "your-keyid"
  secret = "your-secret"
}

Alternatively, credentials can be supplied via environment variables:

• MYTHICBEASTS_KEYID
• MYTHICBEASTS_SECRET

Examples

Examples of each resource and data source can be found at /examples .

These are also used to generate the documentation hosted by the Terraform registry .

How it works

The provider uses the newer Terraform Plugin Framework .

For it to work with the Mythic Beasts APIs I had to create a Go client, which can be found on GitHub . The client handles the APIs and means that the provider only needs to focus on Terraform itself.

The Mythic Beasts VPS API needs values that are only ever used when creating a VPS and so the provider uses the new write-only arguments feature, which is only available in Terraform v1.11.0 and later. Write-only is normally used for sensitive values like passwords but the VPS API doesn’t return every attribute so write-only is used for these values when creating the VPS and then they are forgotten.

Support

To make it clear, this is an unofficial provider that is not endorsed by Mythic Beasts.

It’s currently at version v0.1 and I wouldn’t consider it stable until it hits v1.0.

Right now it supports the APIs I need it to. Further features will be added as needed.

In use

I use the provider to provision a Raspberry Pi 4 from Mythic Beasts and set up the proxy endpoints for my personal website.

The whole setup, with Terraform to provision the Pi and then Ansible to configure it, is documented at infra.paultibbetts.uk .

What’s next?

The provider works with the VPS, Pi, and Proxy APIs, as these are what I currently use or have used in the past.

Mythic Beasts also have a DNS API which lets you manage the DNS records for domains.

If I were to add this to the provider I could change the management of my domain from Cloudflare over to Mythic Beasts, which would improve my website’s sovereignty .

These are used by some feed readers to show the full content, which means my posts are now fully readable through RSS.

This is how to do that.

You might already have one

If you’re using a static site generator like Hugo, or a CMS like WordPress, then you might already have an RSS feed.

If not, and you’re writing your site manually, or just want to understand what’s going on, here’s what an RSS feed looks like.

A minimal RSS feed

At a minimum an RSS feed contains:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>Example Blog</title>
    <link>https://example.com/</link>
    <description>Updates from my blog.</description>

    <item>
      <title>Hello World</title>
      <link>https://example.com/hello-world</link>
      <description>My first post.</description>
    </item>

  </channel>
</rss>

Required

<?xml version="1.0" encoding="UTF-8"?>

This line declares the XML version of the file and the encoding that it uses. UTF-8 supports text and emoji.

It’s strongly recommended to include this line so the file is read correctly.

<rss version="2.0">

This is the start of the <rss> element. The version="2.0" tells consumers that the feed conforms to the RSS 2.0 specification, the most widely supported version.

<channel>
  <title>Example Blog</title>
  <link>https://example.com/</link>
  <description>Updates from my blog.</description>

The <channel> declares the feed itself, so <title>, <link> and <description> are used to describe the feed and its contents.

These details should match what’s displayed on your site and will show up for users when adding or managing your feed in their reader.

The <link> should point to the URL of the <channel>, which is the site itself.

<item>
  <title>Hello World</title>
  <link>https://example.com/hello-world</link>
  <description>My first post.</description>
</item>

The <item> tag is used for each post in the feed.

An <item> must contain at least one of:

• <title>
• <description>

which means you could do:

<item>
  <title>My first post</title>
</item>

which is valid, but not very useful, or:

<item>
  <description>Hello, World!</description>
</item>

which is also valid, and slightly more useful, if only for microblogs and notes and other posts without a title.

<item>
  <title>An example</title>
  <link>https://example.com/posts/1</link>
</item>

Title + link is more practical, and may be all you need, but:

<item>
  <title>An example</title>
  <link>https://example.com/posts/1</link>
  <description>Hello, World!</description>
</item>

using all three is most common.

You could use the <description> for the summary of your post or for the whole thing.

There’s no upper limit on the amount of <item>s you can include in a feed, but there are some practical things to consider:

• RSS does not do pagination
• • everything is listed in one file
• if the file gets really big then it takes longer to download
• • aim to keep it under 500KB
• maybe only show your latest posts if you have lots of them

Optional

The fields mentioned above are all that is required for a minimal feed, but there are some optional extras that are recommended.

<item>
  ...
  <guid isPermaLink="true">
    https://example.com/posts/1
  </guid>
</item>

A guid, for “Globally Unique IDentifier”, gives each item in the feed a stable identity. This means feed readers can detect and remove duplicates correctly.

This is usually the permalink of the post. If so, isPermaLink defaults to true and can be omitted, however it it’s not the permalink, like a database ID, or the exact datetime the post was published, you would change isPermaLink to false.

Note that the L in PermaLink is also capitalised.

<item>
  ...
  <pubDate>Sun, 1 Mar 2026 14:00:00 GMT</pubDate>
</item>

The <pubDate> is used to show when an item in the feed was published. It can help feed readers understand the order of your posts and should be added.

<rss version="2.0"
xmlns:atom="http://www.w3.org/2005/Atom">

Changing the <rss> tag to include xmlns:atom="http://www.w3.org/2005/Atom" is also optional but recommended.

This tells whatever is reading the feed that anything defined with atom: comes from the Atom specification, and lets you use extra tags defined by the Atom spec.

This isn’t useful by itself, but it is used when you also add:

<atom:link
href="https://example.com/index.xml"
rel="self"
type="application/rss+xml" />

which defines the URL of the feed and helps feed readers know the canonical URL of the feed itself, which helps prevent duplicate subscriptions.

<lastBuildDate>Sun, 1 Mar 2026 14:00:00 GMT</lastBuildDate>

The <lastBuildDate> can be used by feed readers to know if the feed has changed.

Set it to the date of the most recent post.

<language>en-gb</language>

You should declare the language of the feed. It’s small, but it’s technically correct.

Things to remember

RSS is pretty simple but dealing with XML means you have to remember a few things.

XML must be well-formed

Writing an RSS feed is still writing XML, and so it must obey the rules of an XML file.

This means the file must not have any missing closing tags, or mix ups with the order in which you close them.

It also means you must handle special characters, otherwise the file is invalid and won’t be understood.

For example:

<title>Special & Character</title>

won’t work, because of the &, which must be escaped:

<title>Special &amp; Character</title>

No unescaped HTML in the description

The same happens with the <description> tag, which usually holds the summary or the contents of the post, and must not include unescaped HTML characters.

The first option is to escape all of the HTML in the description:

<description>&lt;p&gt;Hello, World!&lt;/p&gt;</description>

or the more common option is to wrap the HTML content in the description in a CDATA tag:

<description><![CDATA[
<p>Hello, World!</p>
]]></description>

where CDATA tells whatever is reading the XML file that everything inside this is raw text.

Dates must be written as RFC 822

If you do use <pubDate> or <lastBuildDate> to show dates you must ensure they are written using the RFC 822 format :

<pubDate>Sun, 1 Mar 2026 14:00:00 GMT</pubDate>

Serve the file with the correct Content-Type

When your server responds to a request to show the feed it should send:

Content-Type: application/rss+xml

so that feed readers recognise it as an RSS feed.

Most static web hosting handles this for you, I only mention it in case you are setting up a server and are messing with the Content-Type of the files you serve.

How to check your feed

There are a few ways to check you’ve written your feed correctly.

Open it in a browser

The file should open and look similar to what you wrote it as. If it doesn’t open, there’s a problem, and if it shows an error then you need to fix it.

Use a validator

You can use validator.w3.org/feed to validate your feed. It can work with the URL of your feed online or you can paste in its contents if you’re still working on it.

Add it to your reader

The best test is to add your own feed to your reader and check it looks the way you want.

Make sure it’s showing in the order you expect and you can edit posts without making duplicates in your reader.

Full example

Here is a condensed version of my own RSS feed, containing two articles and a note.

The note doesn’t have a <title>, which influenced the URL used for its <guid>.

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0"
	xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<title>Paul Tibbetts</title>
		<link>https://paultibbetts.uk/</link>
		<description>Recent posts by Paul Tibbetts</description>
		<generator>Hugo</generator>
		<language>en-gb</language>
		<lastBuildDate>Sun, 01 Mar 2026 12:41:46 +0000</lastBuildDate>
		<atom:link href="https://paultibbetts.uk/feed.xml" rel="self" type="application/rss+xml" />
		<item>
			<title>How to create an RSS Feed</title>
			<link>https://paultibbetts.uk/2026/03/01/how-to-create-an-rss-feed/</link>
			<pubDate>Sun, 01 Mar 2026 16:33:46 +0000</pubDate>
			<guid>https://paultibbetts.uk/2026/03/01/how-to-create-an-rss-feed/</guid>
			<description>In my last post I recommended starting with RSS to make your site followable. This is how to do that.</description>
		</item>
		<item>
			<title>Ways to make your feed followable</title>
			<link>https://paultibbetts.uk/2026/03/01/ways-to-make-your-feed-followable/</link>
			<pubDate>Sun, 01 Mar 2026 11:36:03 +0000</pubDate>
			<guid>https://paultibbetts.uk/2026/03/01/ways-to-make-your-feed-followable/</guid>
			<description>You’ve got 3 posts on your site and you want people to be notified about new ones. Here’s all the ways I can think of doing that.</description>
			</item>
		<item>
			<title>2026-02-15 14:54:58</title>
			<link>https://paultibbetts.uk/2026/02/15/2026-02-15-145458/</link>
			<pubDate>Sun, 15 Feb 2026 14:54:58 +0000</pubDate>
			<guid>https://paultibbetts.uk/2026/02/15/2026-02-15-145458/</guid>
			<description>Launched: infra.paultibbetts.uk A documentation site for the infrastructure that runs paultibbetts.uk.</description>
		</item>
	</channel>
</rss>

Here’s all the ways I can think of doing that.

Email

Some sites let you send out your posts as emails.

Don’t do it. It can be tempting, because it’s easy, but emails are for emails.

There are better options for your feed.

RSS

RSS stands for “Really Simple Syndication”.

It’s a standard format for publishing a feed so apps can subscribe to your updates.

Feed readers and podcast apps use it.

It looks a bit like this:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>RSS Example Site</title>
    <link>https://example.com/</link>
    <description>Example site description.</description>

    <item>
      <title>Hello, World!</title>
      <link>https://example.com/hello-world.html</link>
      <description>My first post.</description>
    </item>

  </channel>
</rss>

You would host a file like this, link to it from the <head> part of your pages, and readers would check it occasionally for updates.

Its simplicity means it’s supported by almost all feed reading apps.

Because of this I’d say RSS is the best starting point for letting users subscribe to your posts and is worth adding to your site first, before the other alternatives.

Atom

RSS isn’t the only way to create an XML feed. Atom is another standard which is more formally specified.

In the early 2000’s, after Atom’s launch, there was a time called the “RSS vs Atom wars”. There was no real winner. Atom was decided to be technically better, but by then RSS had already become dominant.

These days you can add a few Atom elements to your RSS feed, like a rel=self link, to get the best of both worlds.

JSON

JSON feed is the one of the newer standards. It works in the same way as RSS and Atom but the data is presented as JSON instead of XML.

Web development has moved on from XML and these days JSON-based things are much more common. The idea is that by using JSON we allow developers to build new things like feed readers using modern techniques and tooling, instead of ones used only for legacy publishing steps like an XML-based feed.

It looks a bit like this:

{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Example JSON Feed Site",
  "home_page_url": "https://example.com/",
  "feed_url": "https://example.com/feed.json",
  "items": [
    {
      "id": "2026-02-28-153000",
      "url": "https://paultibbetts.uk/notes/2026-02-28-153000/",
      "content_html": "<p>Hello world</p>",
      "date_published": "2026-02-28T15:30:00Z"
    }
  ]
}

JSON feed is already supported by many feed readers and, at least in theory, makes it easier than XML-based feeds to make new ones.

I’d say it’s worth adding to your site after you’ve got an RSS feed, since those are more universally supported right now.

Microformats

Microformats is a standard for marking up the contents of your posts, and in doing so makes your feed followable without any other files.

Classes like h-entry and h-card help others to understand the content you’re publishing, and the h-feed class is used to identify feeds. This means readers using apps that understand microformats can subscribe to your content directly, without needing an XML or JSON file.

Right now most feed readers expect RSS or Atom feeds, so whilst I would suggest adding microformats, I would do it after adding an RSS feed.

Social media

There’s also social media, where you would post a link to your content on another site, like Facebook or Instagram.

It’s a great way to get your posts in front of users across the web on the apps they’re already using, but it’s no longer on your own site and you’re now at the mercy of whatever the algorithms think of your content.

I’d consider doing this as an extra, and only after making your own feed available.

For more information on posting out to social media the IndieWeb.org wiki has a great page called Publish Own Site, Syndicate Elsewhere (POSSE) .

ActivityPub

Another option is to use the ActivityPub protocol for your content.

ActivityPub is what powers Fediverse apps like Mastodon and making your content available through it makes your site part of the Fediverse itself. Readers can then subscribe using whatever Fediverse app they want.

This involves a lot of work, and is difficult to implement for static sites, so hosted solutions like Bridgy Fed can be used to do this for you.

All of the above

The best option could even be to do all of the above, to give your readers freedom to choose the method that works for them.

If you want the most compatible way to let others follow your posts: start with RSS.

Then add alternatives after.

I use it for my personal site and in my homelab.

This is what it does and how to use it.

What it does

An Ansible role is like a plugin that extends Ansible with the ability to do something, and in this case it’s to install and manage Caddy .

Specifically it:

• installs Caddy
• • defaults to using the apt package manager
• • or it can be given the URL to a specific binary
• • or it can be given a list of plugins
• can be used to manage Caddy
• • or completely uninstall it
• can write the Caddyfile from a template

Why Caddy?

I use Caddy because it manages TLS certificates automatically and, with a plugin, supports DNS-01 challenges .

DNS-01 is useful when services aren’t reachable by Lets Encrypt, like in a homelab, so private networks can also have TLS.

Design goals

The role was designed with the following in mind:

• idempotent and safe to re-run
• Debian and Ubuntu
• works on x86 and ARM
• supports installing with plugins
• can optionally write the Caddyfile

There are already Ansible roles for Caddy, like the one listed in the docs , but I needed a role that could install Caddy with plugins.

How to use it

The role is available on Ansible Galaxy .

Install

You can install it by adding:

- name: paultibbetts.caddy
  version: 1.0.0

to your requirements.yml file and then running:

ansible-galaxy role install -r requirements.yml

Variables

The variables for the role, as well as the default settings, can all be overridden.

The most important ones are the install method, the plugins to include, and whether the role writes the Caddyfile for you.

caddy_install_method: apt

The role defaults to installing Caddy via apt, the package manager for Debian/Ubuntu.

This means Caddy does not include any plugins but it does get updated when you run apt upgrade.

caddy_install_method: download

Alternatively you can change the install method to download.

Now you can pass in the URL of a specific binary using:

caddy_download_url: ""

Using this you could build a binary for Caddy (including plugins), host it, then pass that URL to the role and that specific binary will be installed.

This is currently the only way to install a specific version of Caddy that isn’t “latest”.

If you want to install plugins for Caddy and don’t want to build your own binary you can leave the download URL empty and pass in the plugins:

caddy_plugins:
  - github.com/caddy-dns/cloudflare

and the role will generate a URL from the download page .

caddy_caddyfile_template: "" | "{{ playbook_dir }}/templates/Caddyfile.j2"

The Caddyfile template variable lets you pass in a template of a Caddyfile for Caddy to use and it will be written to the appropriate place.

Letting the role write the Caddyfile means you can import the role, set its variables, and have all of Caddy configured by one thing - you don’t need to write extra tasks after installation to get it up and running.

Examples

The following examples show how the role can be used for a public website and for a private homelab reverse proxy.

In both instances Caddy acquires TLS certificates from Lets Encrypt, using Cloudflare to do DNS-01 challenges.

Example: Personal website

The role can be used to setup Caddy to host a personal website.

- hosts: server
  become: true
  roles:
    - role: paultibbetts.caddy
      vars:
        caddy_caddyfile_template: "{{ playbook_dir }}/templates/Caddyfile.j2"
        caddy_install_method: download
        caddy_plugins:
          - github.com/caddy-dns/cloudflare
        caddy_manage_systemd_env_file: true
        caddy_systemd_env:
          CF_API_TOKEN: "{{ vault_cf_api_token }}"

The download install method is used to install Caddy with the Cloudflare plugin , the Cloudflare API token is passed to Caddy from Ansible vault, and a template is provided for the Caddyfile, which could look like:

(cf_tls) {
    tls {
        dns cloudflare {env.CF_API_TOKEN}
    }
}

{% for site in web_sites %}
{{ site }} {
  import cf_tls
  root * {{ web_sites_root }}/{{ site }}/current
  file_server
  encode zstd gzip
  log
}
{% endfor %}

This sets up Caddy to use Cloudflare to do DNS-01 challenges with Lets Encrypt to get a TLS certificate for each site in web_sites.

Example: Homelab

The role can also be used to setup Caddy in a private network, like a homelab.

- hosts: homelab
  become: true
  roles:
    - role: paultibbetts.caddy
      vars:
        caddy_caddyfile_template: "{{ playbook_dir }}/templates/Caddyfile.j2"
        caddy_install_method: download
        caddy_plugins:
          - github.com/caddy-dns/cloudflare
        caddy_manage_systemd_env_file: true
        caddy_systemd_env:
          CF_API_TOKEN: "{{ vault_cf_api_token }}"

{
        acme_dns cloudflare {env.CF_API_TOKEN}
}

service.homelab.example {
        reverse_proxy <ip>:<port>
}

where the Cloudflare plugin is configured once and is then used to do DNS-01 challenges for any TLS certificates Caddy requests. Note this style has been deprecated and you should do it per host, like the earlier example for a personal website.

DNS-01 challenges are solved by writing a TXT record to prove domain ownership. This means Lets Encrypt is able to issue certificates for domains it can’t reach, which makes DNS-01 ideal when Caddy is running in a homelab.

Molecule Scenarios

Ansible Molecule is a way to run tests for an Ansible role.

The role includes molecule scenarios that test it works on x86 as well as Arm, because I use the role on a Raspberry Pi 4, as well as scenarios for the Cloudflare plugin and the Caddyfile templating.

In use

I use this role as part of the code that sets up the infrastructure for my website.

Terraform is used to provision the server, then Ansible is used to configure it, with this role setting up Caddy and the Caddyfile it uses.

The complete setup - Terraform, Ansible, Caddy, and the rest of the files - is documented at infra.paultibbetts.uk , where I explain how it all fits together.

It was simple and free, but it didn’t really feel like it was mine.

I’ve fixed that with a Raspberry Pi.

Why leave GitHub Pages?

GitHub Pages is excellent at what it does.

You upload the code for your site to GitHub and they will build and host it for you.
All for free.

So why leave?

Independence

GitHub is owned by Microsoft, one of the biggest companies on the planet.

I have no problem with Microsoft, or using their economies of scale to do something for free that would otherwise cost me money, but ultimately I didn’t feel very indie hosting my site on something I didn’t control.

Sovereignty

GitHub and Microsoft are companies based in the USA, and those of us in Europe are re-considering our dependence on US tech.

Moving has brought my website closer to home - physically, legally, and ethically.

Portability

The work to move from GitHub Pages to anything else has also made it easier to move it all again to another provider, should I ever choose to do so.

I’ve taken the script to build the site out of GitHub Actions and made it part of the code itself. This decouples the site from any specific CI platform and makes both hosting and deployment replaceable.

What it now runs on

There’s no good reason for using a Raspberry Pi for this, I just thought it would be cool.

It is some of the cheapest hosting I could find from a UK-based provider, but there are cheaper options and hosting in Europe works just the same and is even cheaper.

The Pi is from Mythic Beasts , a UK company based in Cambridge. It lives in London and runs on green energy .

I provision it with Terraform, which lets me write the Pi down as code, and then I configure it using Ansible, another tool that sets up the software it runs.

Ansible installs and manages Caddy, which is a web server that has been configured to serve my site.

Deployment is still handled by GitHub Actions but now it goes to the Pi instead of Pages.

From the outside it all works exactly the same, but now it’s on hardware I control, with a setup that’s more portable than it was before.

Under the hood

To make this all possible I ended up writing more code than I set out to.

There wasn’t a Terraform provider for Mythic Beasts, so I wrote one .

For that to work it needed a client to talk to their APIs, so I wrote that too .

And to set up Caddy using Ansible I wrote my own role . There were already others that did this but none of them did exactly what I wanted, so I made my own.

None of this was really required, I could have moved to the Pi without writing any code, but the change from a manual setup to an automated one - driven by code - has forced me to treat the infrastructure of my website as a real system, that can change and evolve over time.

What this means

As a result my setup is now reproducible, portable and more independent.

I can see all the parts that make up my infrastructure and swap them out for alternatives. I’m not tied down to a provider I can replace with a few lines of code.

And ultimately, there’s no difference to visitors of the site, who still get the same experience as before.

What comes next

Through doing this I can see that I might also be able to move my domain from Cloudflare to Mythic Beasts, another win for sovereignty.

If I did that, and moved the code hosting away from GitHub, I’d have a website that’s fully independent.

But that’s for another time.

Over the next few posts I’ll go over:

• how to use the Ansible role
• making a provider for Terraform
• the code that ties it all together
• the site that explains it all in-depth

Now

For now this post marks that this site’s no longer hosted by GitHub Pages.

It’s on a tiny computer, closer to home, set up by my own code.

That feels a bit more mine.

A documentation site for the infrastructure that runs paultibbetts.uk.

A Terraform provider for Mythic Beasts.

A client for the Mythic Beasts APIs, written in Go.

An Ansible role to install and operate Caddy web server.