It’s a mix of “too expensive” and “I should have spent more on this”.

None of this was designed all at once. It’s the result of buying things for one reason, repurposing them for another, and slowly discovering a stable setup.

What it’s for

HomeOps is the boring half of my homelab: the part that runs the services I actually depend on.

It started as an all-in-one server, but I eventually moved away from that. It was convenient until it wasn’t; every change was risky.

Splitting it up gives me more to manage, but also a smaller blast radius when something goes wrong.

Overview

Each of these devices could do more than they currently do, but I’ve tried to keep their roles separate.

They are more like pets than cattle: the software is reproducible but the machines are not disposable.

NAS

I have a dedicated machine for Network Attached Storage. I built it myself; the specs are in the repo . It runs TrueNAS and is the central place for storage, backups, archiving, and media.

Storage is shared over NFS for Mac and Linux, and SMB for Windows. The only app the NAS runs is minIO , which provides S3-compatible storage. minIO changed its license recently so I am eventually going to swap it for something else.

It has 4TB of NVMe storage, which is the pool I use most often. My NAS and PC are connected through a small 10GbE switch, so from my PC it feels like the drives are plugged in directly. These drives are not set up in a RAID array, so if one failed I would lose data.

For archiving and longer-term storage it has 4 x 6TB HDD set up in a RAIDZ2 array, which means 2 of the drives could fail before I lost data. Anything important is copied to the RAIDZ2 pool, which is why I’m comfortable running the NVMe drives without redundancy. RAID is not a backup , so I should back this data up to an external location, but I’m yet to set this up.

It was originally made up of spare parts from an old gaming PC but I decided I wanted ECC memory. That meant replacing the CPU and motherboard with parts that supported it, and the affordable options were older server components. At this point the only gaming PC parts still in use are the case and the PSU.

Review

Those older server components are less efficient and more power-hungry than newer ones would be.

It was expensive. I made the decision that storage was important enough to justify ECC memory, but plenty of people choose to go without it. ECC is there to protect against memory-related corruption, and I don’t know whether it’s ever actually done that.

It’s overpowered and underutilised for its current role, mostly because it used to do everything and now it just does storage.

However, it plays a major part in my HomeOps setup, so it’s definitely worth its place.

If you have a homelab, or even just multiple computers in one household, you would benefit from a NAS. It doesn’t need to be an expensive one like mine though.

NUC

I use an Intel NUC as my server. Specs are in the repo .

Originally I used my NAS as a server, until I found that messing with it made it unstable, so I stopped doing that and looked for something else. I bought something from Kickstarter, and in true Kickstarter fashion it was delayed multiple times, and eventually I got impatient and bought the NUC.

It’s modern and pretty power efficient, which means running it is much cheaper than the NAS made out of older components.

The CPU has 12 cores and 16 threads, which gives me plenty of headroom for virtualisation. I have Proxmox installed and use it to run 9 virtual machines and 1 LXC. This lets me split services across separate environments instead of installing everything directly on one host, so a problem with one service is less likely to affect the others.

The LXC is for Jellyfin, which is self-hosted Netflix for movies I store on my NAS. The NUC has an integrated Intel GPU that supports Quick Sync, which Jellyfin uses for hardware-accelerated transcoding. This means I can watch my movies from any device and let the GPU do the transcoding, leaving the CPU available for the other services hosted by the NUC.

Review

The NUC is an excellent home server. It’s not enterprise hardware with redundant power supplies and room for expansion, but its size and efficiency make it a great fit at home.

The trade-off is that it’s not a box for lots of disks. Mine has room for an SSD boot drive and the NVMe I use for local data. After that I needed to pair it with my NAS for extra storage.

It has a 2.5GbE NIC. That is not as fast as the 10GbE link to the NAS, but is more than enough for what I use it for.

If I started again and didn’t need much local storage, a machine like this might be all I needed.

Unfortunately Intel has stopped making these but places like Minisforum make ones that are similar.

VPS

The VPS is the only machine in this setup that I don’t physically own. It’s rented from Hetzner .

It is the public side of my “tunnel” setup, which I’ll explain in a future post. The services I run are hosted at home and this VPS gives me an entry point without directly exposing my home network.

There isn’t much to say about it. Hetzner is some of the cheapest European hosting I could find, and even though the VPS is located in Germany it doesn’t add any real delay to my connection.

MonPi

The final part of the setup is the Raspberry Pi that monitors everything else.

The reason it exists is separation. I didn’t want to run monitoring on the same machines that host the services. If the NAS or the NUC has a problem, a separate device has a better chance of catching it.

It runs two types of monitoring: Uptime Kuma for service uptime checks, and Beszel for host metrics. I’ll cover these in more detail later in the series.

Review

The Pi works great for monitoring, but for this particular model that’s about all it can do.

It was originally called “DeskPi” and was plugged into a screen to show a live output, but because it has only 2GB of RAM it struggled to run the desktop environment and I quickly gave up on that idea.

What’s missing

There are two pieces of hardware people might expect to see listed here that I don’t yet have: a custom router and a UPS.

I still use the router my ISP gave me, instead of something like OPNsense or pfSense. I’ve worked around some of its limitations by letting Pi-hole handle DHCP - more details on that in the Pi-hole post. I will be moving soon, and when I get settled I’ll start working on the router.

The UPS will come after. It is risky running a NAS without one, but I live in the UK, and in the five years I’ve lived in this house there’s been exactly one power cut, so I haven’t felt the need to prioritise it.

Not Highly Available

The obvious limitation of my setup is that it’s not highly available.

Splitting storage, compute and monitoring across different machines gives me cleaner roles and a smaller blast radius than the all-in-one server I started with. It does not mean the setup can survive any of those machines breaking.

If the NUC dies, my services go offline. If the NAS fails, the storage layer is unavailable. If the VPS has a problem, friends and family can’t get through the tunnel. MonPi monitors the setup, but nothing is monitoring MonPi.

There is an old redundancy saying that “two is one and one is none”. That applies here, but in different ways at different layers. The NAS has redundant disks, but it is still a single machine with one motherboard, one power supply and one network path. The NUC is a single host, so the VMs and containers running on it have nowhere else to fail over to.

Making the NUC highly available would mean running multiple Proxmox nodes. That means not just two machines, but three, so Proxmox can maintain quorum .

That would be a better HA design, but it would also mean more hardware and more power usage.

For now, I have accepted that my setup might have downtime because that is the trade-off that keeps it affordable and manageable at home.

Next

That’s the hardware covered for my setup.

The important thing is not that any individual machine is special, it’s that each one has a clear job. The NAS stores things, the NUC runs things, the VPS provides the public entry point, and the Pi monitors it all.

It’s not perfect, and it’s not highly available, but it’s much easier to work with than the all-in-one server I started with.

Next I’ll look at the storage layer in more detail: how I use TrueNAS for network shares, archives, and the storage services that support the rest of the setup.

Logseq seems to suit my brain more than Obsidian, but with either tool the best feature is the cross-linking of ideas. I will sometimes forget where I wrote a note, but I remember that it linked to other ideas, so I can go to them to find the one I am looking for.

And I especially like finding out I have written about an idea before, and that I can see how my thinking has evolved since then.

What is HomeOps?

HomeOps isn’t a widely used term, but I have seen a few people use it. To explain what I mean by it I should first define “Homelab”.

A homelab is a setup of computers you control and use for experiments - like a laboratory. It’s usually at home, hence the name, but not always. You might own all the equipment, rent it, or even send your own machines to a provider so they can run them for you - called “colocation”.

The problem is that homelab seems to cover experimentation as well as self-hosting services you use every day, which have different needs.

HomeOps, short for “Home Operations”, is my attempt at labelling the stable part of my homelab.

Purpose

My HomeOps setup is used to host the apps and services a few people depend on, so I can’t be breaking it every five minutes.

Some people call this “HomeProd”, short for “Home Production”, which separates it from the “development” or “staging” environment you use for experiments.

As such I treat it like a real production system: stable, reproducible, and intentionally boring to operate.

Architecture

The system is split over different machines, each with a different purpose.

• a NAS provides storage over the network
• a server hosts all the apps and services
• a rented VPS lets external users in securely through a “tunnel”
• a Raspberry Pi monitors it all

The whole thing is written down as Infrastructure as Code, with Terraform defining the infrastructure and Ansible for configuring it. This would let me reproduce it if a machine breaks and I need to set up a new one.

The server uses a hypervisor as an operating system and services generally get their own virtual machine. One of those VMs uses Docker to run most of the apps.

Key Decisions

Each of these deserve their own post later in the series.

Separating HomeOps from Homelab

I made this split after the data loss incident which taught me not to let others depend on apps I’m only trialing in my lab, especially without working backups.

Infrastructure as code

Everything is written down as code, so there’s as little manual setup as possible. This means I can see what’s going on by inspecting the code, and I can automate configuration.

Terraform and Ansible, not Kubernetes

When I started I wanted to compare Terraform and Ansible against Kubernetes for running a homelab.

I thought I’d prove that Kubernetes was obviously the better choice, but two years later I’ve found the Terraform and Ansible setup works just fine, so that’s what powers my HomeOps.

I use Kubernetes in its own environment where I run experiments.

Not highly available

One downside to my setup is that it’s not highly available. If a machine breaks then there’s nothing to fill in for it until I replace it. I could fix this by running more machines, but that increases the cost.

For now I can live with the downtime. So far nothing’s broken, although one day something will.

What this series will cover

In this series I’ll go over each part of the system in more detail, including the hardware, IaC, services that run on top, and how I let people access it from outside my home.

The aim is not to present this as the correct way to run a homelab, but to explain the choices I made, how they fit together, and why I use the apps that I do.

It will be split up so you can dive in and out at any point to read just the parts that interest you, with links to anything written earlier that provides necessary context.

It might be awkward in that the system builds up in layers, and things may only make sense for my particular setup, but I’ll try my best to generalise each part so it’s relevant on its own.

Next

Coming up first is the hardware I use.

Check back soon for the link, or subscribe to the feed for this series in your feed reader.

Or jump straight into the code, which is now on GitHub .

For pages that are really just lists you can treat them like posts on a blog.

My directory of indie web directories is one of those, it’s a collection of links that grows over time.

Since my site is built with Hugo, I:

• changed the page into a section
• made a file for each entry

and Hugo made a feed for it.

The only tweak it needed was in the RSS template, so that for this new section the <item><link> would point to the directory instead of my own site, which for me looked a bit like:

{{- $itemLink := .Permalink -}}
{{- if eq .Section "indieweb-directories" -}}
	{{- with .Params.link -}}
		{{- $itemLink = . -}}
	{{- end -}}
{{- end -}}

<item>
  <title>{{ .Title }}</title>
  <link>{{ $itemLink }}</link>

This works well for pages where updates are incremental additions, such as changelogs or collections.

It works less well for pages that are edited in place. You’d need to post what changed, which means keeping a history of revisions - something wikis do by publishing diffs.

Those updates can be harder to read, and while you could do it with Hugo, you’d have to write them manually. There’s no built-in way of creating them.

In my case it works, not because I’ve solved how to signal updates to a page, but because it turns out my page wasn’t even a page in the first place.

I too have been annoyed by GitHub’s performance lately, and that’s just from using it personally.

I can’t imagine what’s it’s like for those relying on it for paid work right now.

Curious to see where Ghostty ends up, and what impact this has on its contributions.

Related:

• The Missing GitHub Status Page
• Before GitHub

My inspiration was from a few weeks ago when Ricardo demonstrated his new setup at Homebrew Website Club London . I guess I was prompted into action by the How to unblock yourself and actually post more often session this weekend, but I’m trying to give credit where it’s due, since my demo was basically the same as his.

What I didn’t show, however, was all the work that’s been happening over the last few months to make my demo possible, which is why I’m posting this.

Also, I wanted to regain some nerd-cred because my demo was followed by Naty who showed us an updated stats page , which looks awesome and is something I’m going to have to steal.

Intro

My site’s powered by Hugo, which is a static site generator that turns files into a website.

I write posts on my laptop and push them up to GitHub, where the site gets generated with the new content and then deployed to my server. I’ve written about that before , which you don’t need to read for this, I’m just setting the scene.

With that setup I couldn’t publish from my phone, which is sometimes all I have on me.

The indie web has a solution for this called Micropub , which is an API for creating posts on your site, even if you use a static site generator like I do.

IndieKit

As mentioned, a few weeks ago at HWC Ricardo showed us his new setup, to which he’d added a Micropub server called IndieKit .

It was created by Paul Robert Lloyd , who I met (briefly) at an IndieWebCamp eleven years ago.

Side note - isn’t it strange that there’s millions of things on the web but you prefer using the things made by people you’ve met in real life?

IndieKit works by connecting to the place you store your posts, which for me is GitHub, and lets you write new ones from the web:

✨ Sparkles ✨

The other thing a Micropub server lets you do is use any Micropub client you want. You don’t have to use the one in Indiekit - which is perfectly fine by the way - you can use a different one if you like.

Or you could use multiple. Epilogue and indiebookclub both let you post about books you’ve read.

Or you could post from a native app, like iA Writer , a markdown editor that lets you post to WordPress, Ghost, and with Micropub: your own website.

The one Ricardo showed us in his demo, because it’s got a good interface for posting about songs and albums, was Sparkles .

I don’t post about songs or albums, but I do like how it looks, so I included it in my demo:

Bonus content

And that’s where my demo ended.

Here’s the extra footage.

Home server

I first tried running IndieKit on the Raspberry Pi that hosts my site.

The Pi doesn’t have any direct storage attached. That means I can’t reliably run a database on it and IndieKit needs one for some of the features I want from it.

I didn’t want to rent another server. I already have one at home, so I installed IndieKit there instead.

It works, I can access it from my phone, but only on my home network. Not much of an upgrade.

Tunnel

The next step then was to add it to the “tunnel” setup I have.

I rent a VPS, which lives in Nürnberg by the way, and have Pangolin running on it, which is a reverse proxy that sends traffic down a Wireguard tunnel that ends in my home.

and now I can post to my site, wherever I am 🎉.

Deleted scenes

Dan’s indie feed reader feed.city - which I discovered through IWC this weekend - caught me testing all of this and recorded my test posts .

Sometimes deleted scenes are deleted for a reason. They’re boring.

I only included them here as part of the Extended Edition theme I’ve chosen to use. Let’s skip forward.

Behind the scenes

When I use Sparkles to post to my site:

• I go to sparkles.sploot.com and enter my website’s address
• Sparkles sees the address of the Micropub endpoint I declare in the <head> of my site
  • which points at IndieKit
• Sparkles connects to IndieKit
  • by going to the VPS in Germany
  • through the tunnel into my home in the UK
  • and finds IndieKit on my home server
• I write a new post
• IndieKit sends it to GitHub
  • GitHub creates a new markdown file
• the change triggers my deployment pipeline
  • which builds the site
  • and pushes it up to the Raspberry Pi

This is more complex than a typical hosted solution but it means I can self-host IndieKit at home and access it from anywhere.

If you’re into that sort of stuff, stick around, I’ll be posting about the setup and sharing the code soon.

Sequel?

If you’re not, then I might see you at a future IndieWebCamp, hopefully in-person that time.

Maybe that’ll be IndieWebCamp Nürnberg 2026 and I’ll get to meet my VPS for the first time, as well as some of the wonderful people who made this weekend possible.

Today I’m working on:

• setting up IndieKit so I can post from my phone
• changing my /links page so posts tagged as link and links are also included

I’ll hopefully have at least one ready for demos later.

Sessions

The first session of the day was Running your own LLM to get out of big tech. The word was inevitably going to come up, so it was good to hear an indie approach that lets you keep your privacy whilst using it.

The second session was Private posts, which didn’t have a microphone nearby, so it wasn’t recorded.

After a long lunch the third and fourth sessions were about Feeds and Canvas animations. It was good to hear creative talks happening, especially about boring tech like RSS.

The last sessions of the day were Organising data and Homepage design. It turns out nobody really likes their current homepage, which was weirdly reassuring.

Bonus session

I say they were the last sessions, but there was actually a secret session right at the end of the day on How to unblock yourself and actually post more often. There were lots of good ideas mentioned, like Dan’s Polaroids project where he takes and publishes a Polaroid every day.

The one that stuck with me is the idea that you can write a brief summary about something that happened and then hit publish without spending too much time on it.

I’ll be joining in remotely this weekend. I do wish I was there with you all, maybe next time!

“They are selling you a solution to a problem they created. They want you to feel insecure. If you feel insecure, you pay the subscription.”

“You are not bad. You are a jazz musician in a world trying to sell ringtones.”

here’s a collection of articles that to some degree answer the question “Why have a personal website?” with “Because it’s fun, and the internet used to be fun."

(It still is, but it used to be, too)

Then I was introduced to Russel’s paradox , which asks if a directory should include itself?

The answer is no, you make another one .

all the signs are pointing to the fact that we might be in endgame for “open” as we’ve known it on the Internet over the last few decades

See also:

• Prepping for the endgame of the open web
• Some Thoughts on the Open Web

I get inspired by many things mentioned at HWC , but somehow the first to make it to my blog, based on a comment from the last meetup, is this:

📡 Broadcast

⏹️ Stop

To make this I was going to need to look up the Morse code alphabet, and then use it as part of a script.

I was feeling lazy so I used an LLM to do that for me, and it ended up writing the whole thing, including turning it into sound, which I hadn’t even asked it to do.

It didn’t just make it all, in seconds, it ruined any fun I might have had experimenting on a new thing, maybe even learning a thing or two.

So I present it here begrudgingly.

I am using this note to test I can send an RSVP .

If you see my name on this list then it worked.

I wrote that I was going to optimise my photos so they would be smaller and I could include them in my posts, since that’s all I was planning to do.

Then I realised I needed a video in my post. If you’ve read Museum memories you’ll know why.

The problem

My website is powered by Hugo, a static site generator that takes an input, like my markdown files where I write my posts, and outputs a website.

I store both my site code and content in Git, which also drives my deployment process: every change triggers a new build and deploy.

This is where it gets tricky with media files.

Photos

To include my own photos in a blog post I need to host them. I can do that in Hugo, but I would need to save the photos with Git so it’s part of the site and the deployment process. The problem with this is photos can be quite large, so they bloat the Git repository.

This isn’t really a problem with one blog post with a few photos, but it does become a problem when you do it over and over for many years.

I don’t know if I’ll be posting lots of photos, or doing it for many years, but I don’t like the idea of one day having a scaling problem, I’d rather fix it now.

Videos

Videos are even more of a problem. They’re much bigger than photos, and they don’t compress down as effectively.

A 7 MB photo can compress down to 200 KB, which might be tolerable in a Git repo.

A 15 second video might be 30 MB and only compress down to 15 MB.

A solution

Instead of keeping my photos and videos inside the Git repo I am moving towards separate media hosting for them. I wanted to publish my photo post before fully solving media hosting, so I’m using a temporary solution for now.

I have made a directory on my server and uploaded the videos there. I then changed my web server to serve the files in this directory at https://paultibbetts.uk/media/ and updated my post to use this URL for videos.

You can see the change in infrastructure code on GitHub .

It’s Temporary™

My web server has 50 GB of storage so there is a limit to how many photos and videos I can upload. This type of storage is relatively expensive and it’s awkward changing the setup.

A better solution for media hosting would be a storage bucket and a Content Delivery Network to serve the files, as mentioned in Changes to the Site .

I don’t know when that’s happening.

I have not been to many museums or galleries. I am not a cultured person.

My favourite museum is the city of Barcelona.

Museums

I grew up in Birmingham, UK, and I have been to a few museums there. We went on a school trip to the Science Museum and I’m pretty sure I’ve been down to London to go to the Natural History Museum.

They’re all great.

My favourite museum trips were all in Barcelona, and there must be something to that city because out of the three entries to this month’s carnival I’ve read there’s already one about a museum there .

Barcelona

I first went in 2017, staying for a week in a hotel in Eixample, a giant extension to the city that was started in the 1860s.

The Old Quarter, the historic core, dates back over 2,000 years. It was founded by the Romans as Barcino and some of their walls are still standing.

The development of other parts of the city, like Barri Gòtic and El Born, happened during the medieval period and were built right on top of what came before.

It’s chaotic and organic.

Eixample

Eixample, known in English as “extension”, is the complete opposite. It was designed as a uniform grid layout, and turned out to be very forward-thinking design.

The octagonal blocks give better visibility at intersections and make turning easier for vehicles, even ones we use now, which didn’t exist when the design was first conceived.

Museums

I mention all of this because the city itself is a giant museum. You can step back in time, in design, and urban planning, and wander through the narrow cobbled streets of the Old Quarter, then walk ten minutes to Eixample to see an extension, started two hundred years ago, that’s still celebrated for how modern it is.

Barcelona has free museum visits on Sundays (in most city-run museums), with free entry from 3pm onwards and all day on the first Sunday of the month.

I made a second trip later in 2017 for a month, and ended up staying six weeks. I visited most of the free museums whilst I was there,

as well as Castell de Montjuïc, the fort on the hill.

It was interesting to see how it was being used.

Barcelona does a really good job of preserving layers of its past, from Castell de Montjuïc, to Roman walls in the Gothic Quarter and entire neighbourhoods from the 1700s, like those uncovered in El Born.

These are curated spaces that preserve and display the history of the city itself.

I don’t have a favourite museum in Barcelona. Barcelona is my favourite museum.

Galleries

It’s also a giant street art gallery.

The residents communicate with posters, stickers and slogans:

To deter graffiti many property owners commission work for their shutters:

which is respected and left untouched.

The streets become a gallery, with guides offering tours of their own curated favourites.

Architecture

Speaking of streets, some of the best views are of the architecture.

Whether it’s an open public space…

or one of the many gold statues…

or an ornate entrance to a church…

it’s hard not to admire the intricate details and extravagance of Barcelona.

A lot of that is the result of Antoni Gaudí, a Catalan architect and designer, whose designs stretched from parks and gardens:

to one of the most ambitious Catholic churches in the world, started 143 years ago and still under construction:

Culture

Perhaps the biggest highlight of my first trip was its timing. I’d accidentally arrived during La Mercè, Barcelona’s annual festival that’s been going on since 1871.

Every corner of the city was filled with art and music…

as well as papier-mâché giants and castells (human pyramids, or “castles”)…

and the wildest fireworks show…

I’ve ever been to…

2017

What made 2017 special was the result of hundreds of years of history - it marked the first independence referendum hosted by the Catalan government.

The city was covered in flags, and signs that said “Si” - which meant yes, if given the chance to vote.

There were plenty of Si supporters…

They once interrupted a conversation I was having, and it was the highlight of my trip.

At, I think it was, 6pm, supporters of the vote leaned out their windows and started smashing pots and pans. It was a DIY siren to let everyone else know they existed, and that they wanted to vote.

It was deafeningly loud and an extremely effective way of communicating.

History

I’m no expert, but a brief history is:

• in the Middle Ages, Catalonia was part of the Crown of Aragon
• the War of Spanish Succession (1701-1714) saw Catalonia become part of Spain
• the dictatorship of Francisco Franco restricted Catalan language and culture from 1939 to 1975
• in 2006 Catalonia negotiated a new agreement with Spain
• Spain’s conservative party opposed it and it went to court for 4 years
• in 2010 the court ruled that parts of the agreement should be annulled
• Catalans saw the agreement as settled and not to be changed
• this sparked a resurgence in the independence movement

which led to the referendum in 2017.

The result

The Catalan government claimed that 90% of voters voted “Yes”, however they also recognised that it had only a 42% turnout.

Because of this, Spain ignored the result and then called it illegal anyway.

A month later Catalonia’s parliament declared independence.

The next day Spain dissolved the Catalan government, arrested several of its leaders, and the regional president Carles Puigdemont fled to Belgium.

Since then

Unfortunately, since then, the only notable things to have happened are trials and prison sentences followed by a new amnesty law that pardons some of those involved in the push for independence.

I wish this had a better ending, and that the Catalan people were given a legal vote to decide what they want to do. I don’t know if independence is a good or bad thing for Catalonia, I’m just a tourist with an admiration for its capital.

Memories

I met a Spanish man on a hiking trail once and tried to tell him how nice Barcelona is. It turned out he did not want Catalonia to become independent, so he didn’t want to talk to me, and he definitely didn’t want to see my photos.

Thanks for the IndieWeb Carnival prompt James . It gave me an excuse to put this on my blog and add support for photos and videos.

And it was good to reminisce.

Changes:

• Notes: shorter posts that don’t need titles
• Bookmarks and likes: a way to share links without writing full posts
• Replies: posts that are part of a conversation with another site
• Webmentions: now appear below posts

Ideas:

• serving media through a CDN
• dynamic image resizing with imgproxy
• publishing from my phone using micropub

Notes

My site now has notes . They are still posts but I treat them a bit differently.

Notes don’t need a title, and they’re usually shorter, but they’re effectively the same as the articles I’ve already been posting. The real difference will be what I end up classing as an article instead of a note.

I added them because I wanted to post moments in time without needing to write several paragraphs like I would in an article. This post was nearly a note, until I realised it was more than just recent changes and that I could write about future ones as well.

I think I will probably end up writing less articles now I have notes but when I do write an article it should mean that it’s taken more effort to write, and is therefore of higher quality, but I’m not guaranteeing anything.

Bookmarks

I’ve also added bookmarks , which I’m going to use to share links to interesting things around the web.

These are notes with a bookmark_of field set to the URL I’ve bookmarked. They are then displayed a little differently, with the link going to the bookmarked site instead of my own post.

<a class="u-bookmark-of" href="https://example.com/post">Example</a>

Using a different post kind for this makes it easier for me to share links, since I don’t need to write an article talking about it, or even a note saying what I like about it. I can just share the link.

Likes

Another type of link I’m going to share is a like , which is both a reaction and me sharing something. I don’t know if there’s going to be a system for deciding whether something is a bookmark or a like so I will make it up as I go along.

<a class="u-like-of" href="https://example.com/post">I liked this</a>

Because I don’t know what the difference will end up being, and they’re both just a link to something, I have also added a /links feed which includes both bookmarks and likes.

This will be my own curated version of the internet I want others to know about.

Webmentions

Speaking of likes, I got my first webmention like! Thank you Joe !

I was checking Google Search Console and found a page showing me what sites linked to mine when I saw Joe had liked one of my posts .

I run my own site because I enjoy doing so, but that interaction made it all seem worth it, and I want to post likes from my own site to share that with others going forward.

webmention.io

Joe was able to send me a like because I signed up to webmention.io , which now collects my webmentions for me.

It also provides a feed showing all the webmentions my site has received, which I’ve added to my reader so I’m notified of new ones.

To display the webmentions on my site I’m using webmention.js to show them below the post they are mentioning.

Replies

The other post type I’ve added recently is a reply .

These are notes that are in response to someone else’s post. I will use webmentions to tell them that I’ve written it, after which they could display my reply as a comment.

This now means that to write about a link I could:

• write an article about it
• share it as a bookmark
• share it as a like
• write a note about it
• reply to it directly

So to try and make a rule for them: replies are notes that are part of a conversation.

Where it gets confusing is that any type of post can also be a reply. I could publish a post as an article, and then include a line like

my entry for
<a class="u-in-reply-to" href="https://carnival.host/prompt.html">this month's IndieWeb Carnival</a>

and the post would be both an article and a reply.

If the site I’m replying to displayed my article in full, it might be as long as their original post. Because of that they might show only an excerpt, or just link to it instead.

So, for long articles that are technically also replies I will have to make sure I write a shorter summary that works well as a comment, which could be displayed in full.

The replies I write using the reply post type will be written as I want them to appear in the conversation.

Planned changes

My entry for this month’s IndieWeb Carnival is taking longer than I thought because it’s turned into a holiday photo dump.

This has had me questioning my setup, which is annoying because I thought it would last a bit longer before it needed changing.

I have not even finished my post about infra.paultibbetts.uk , which documents my infrastructure, and I am already thinking of changing it.

I do enjoy working on my site, maybe even more than actually using it, but I have other things I should be working on.

I don’t know when the following will get done.

Media

My draft Carnival post was starting to include photos from my phone, which were about 7 MB each. I hadn’t thought about photos before and didn’t have a process for them.

My site uses git for version control, which is great for text like code and content but it starts to get bloated when you fill it with 7 MB photos. I started thinking up a better system for this, which is coming up next, until I realised I could optimise my images before saving them in git.

The solution for now is to run a script that replaces the original image with a compressed version. The 7 MB photos shrink down to ~200 kB. I am still bloating my repo with images, but at a much more tolerable size.

CDN

A better solution is to store my photos separately, which lets me keep the repo slim by tracking only text files.

I could use my Raspberry Pi to host the photos, but it uses Network File Storage which is a bit slow and has only 50 GB of storage.

Instead I’m thinking of using a storage bucket, which could grow to any size, and then using a Content Delivery Network to serve the assets.

Edit

I needed a temporary solution, so in Added support for photos and videos I explain how I’ve set up my Raspberry Pi to host my media files until I get a storage bucket and CDN sorted out.

Dynamic Image Resizing

I might also use something like imgproxy to dynamically resize images.

When a user requests a smaller version of a photo, imgproxy would generate it on demand. That resized image would then be cached by the CDN, so future visitors can receive the optimised version immediately.

This might mean I can stop compressing photos manually and just use the originals.

Micropub

The final change to my site, which will really elevate it from a simple blog to a personal publishing system, is using micropub to let me post from my phone.

This would need hosting and hooking up to my git repo to manage my content. I would have the same problem as I do right now if I used it for photos, so I will need to wait until I have the storage bucket and CDN sorted before tackling this.

I’m considering using Indiekit as my micropub server, as it works with Hugo (which powers my site), and can also syndicate my posts out to social networks. It doesn’t look like it has a Micro.blog plugin yet, so I’d need to write one before I can selectively choose which posts to syndicate there.

Micro.blog

Which leaves me with a site that can do what I currently use my Micro.blog microblog for. I want to stay as part of the Micro.blog community, and will continue using their apps, but I can see myself migrating the hosting of my content to my own site in the future.

I could merge my Micro.blog posts into the notes on my own site and then syndicate future posts to the Micro.blog timeline, and for Micro.blog users nothing will seem to have changed, only where my content is hosted.

My feed might even get better, as I could filter out posts that I know the Micro.blog community wouldn’t be interested in.

This isn’t a remark against Micro.blog by the way - I think it’s an excellent service - I just believe that I was destined to outgrow it, since I always intended on working on my own site. I think of it more as graduating as a socially-capable indie website, and because Micro.blog is part of the indieweb I can stay part of its community.

I would be missing out on lots of features that Micro.blog has that I don’t yet support, so it wouldn’t be a seamless transition, but after implementing all the above ideas my site should be capable of hosting all of my post kinds in one place.

[…] the path back to feeling like you have some control is to un-spin yourself from the Five Apps of the Apocalypse and reclaim the Internet as a set of tools you use to build something you can own & be proud of

I use it to provision the infrastructure for my personal website.

This is why I built it, what it does, and how to use it.

Why I built it

I prefer writing down my infrastructure as code. It’s something I’ve been doing for years now, and I don’t think I could go back to doing things manually, no matter how small or simple the setup.

I’d decided to use a Pi from Mythic Beasts to host my site and saw that they had APIs available, but no Terraform provider.

Terraform is a tool I’ve been using for infrastructure for a while now, and I wanted to use it with Mythic Beasts because:

• I wanted a fully reproducible setup
• I didn’t want to click around the control panel
• their Pis are IPv6-only, so I’d need to also set up the proxy
• • I wanted to declare the Pi and the endpoints for the proxy in the same place

Plus, I’d never written a Terraform provider before, and I wanted to see what it was like.

What it does

Terraform is a tool for writing your infrastructure as code, and a provider is a plugin that lets it work with different infrastructure providers.

For example you can write:

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    mythicbeasts = {
      source = "paultibbetts/mythicbeasts"
    }
  }
}

resource "mythicbeasts_pi" "pi" {
	identifier   = "web"
	disk_size    = 10
	model        = 4
	memory       = 4096
	os_image     = "rpi-bookworm-arm64"
    ssh_key      = "ssh-ed25519 ..."
    wait_for_dns = true
}

then run terraform apply, and you would get a Raspberry Pi 4 from Mythic Beasts.

Resources

The provider uses the Mythic Beasts APIs to configure the following resources:

• VPS
• Raspberry Pi
• Proxy endpoint

The Raspberry Pis from Mythic Beasts are on an IPv6-only network, so the Proxy endpoints are to allow users trying to access from an IPv4-only network.

Data sources

Some of the settings for the resources require specific values, like the os_image to use, and data sources make it easy to get this info from the API.

For example, the mythicbeasts_pi_operating_systems data source can be used to get all valid os_image values for a Raspberry Pi 4:

data "mythicbeasts_pi_operating_systems" "four" {
  model = 4
}

where you would inspect the data to choose the right value to use.

Alternatively you could use Terraform to find the right value for you, for example to use “Bookworm” for “Arm64”:

data "mythicbeasts_pi_operating_systems" "four" {
  model = 4
}

locals {
  bookworm_arm64 = one([
    for image in data.mythicbeasts_pi_operating_systems.four.images :
    image.id
    if strcontains(image.id, "bookworm") &&
    strcontains(image.id, "arm64")
  ])
}

resource "mythicbeasts_pi" "bookworm" {
  model    = 4
  os_image = local.bookworm_arm64
  ...
}

where Terraform will find the image with both “bookworm” and “arm64” in the ID.

Attributes

Using Terraform for your infrastructure not only lets you write it down as code, with all the benefits that brings , but you can use the attributes of one thing as inputs for another.

For example: the Pis from Mythic Beasts are on an IPv6-only network and need endpoints set up on the proxy to let users access them from IPv4-only networks.

To do this you can get the attribute from a Pi, like the IP address, and then use that as the input for the proxy endpoint resource:

locals {
  domain = "example.com"
  subdomains = {
    apex  = "@"
    www   = "www"
  }
}

resource "mythicbeasts_pi" "web" {
	identifier   = "web"
	disk_size    = 10
	model        = 4
	memory       = 4096
	os_image     = "rpi-bookworm-arm64"
    ssh_key      = "ssh-ed25519 ..."
    wait_for_dns = true
}

resource "mythicbeasts_proxy_endpoint" "endpoint" {
  for_each = local.subdomains

  domain         = local.domain
  hostname       = each.value
  address        = mythicbeasts_pi.web.ip
  site           = "all"
  proxy_protocol = true
}

How to use it

The provider is available on the Terraform registry .

Authentication

The Mythic Beasts APIs require an API key for authentication.

When creating the key you must add permissions to work with the APIs you wish to use, such as:

• “Virtual Server Provisioning” for VPS
• “Raspberry Pi provisioning” for Pis
• “IPv4 to IPv6 Proxy API” for Proxy endpoints

Proxy endpoint domain management

The domain used for proxy endpoints must be registered with the Mythic Beasts control panel.

This can be done by registering the domain using their domain management or by adding it as a 3rd party domain .

Installation

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    mythicbeasts = {
      source = "paultibbetts/mythicbeasts"
    }
  }
}

provider "mythicbeasts" {
  keyid  = "your-keyid"
  secret = "your-secret"
}

Alternatively, credentials can be supplied via environment variables:

• MYTHICBEASTS_KEYID
• MYTHICBEASTS_SECRET

Examples

Examples of each resource and data source can be found at /examples .

These are also used to generate the documentation hosted by the Terraform registry .

How it works

The provider uses the newer Terraform Plugin Framework .

For it to work with the Mythic Beasts APIs I had to create a Go client, which can be found on GitHub . The client handles the APIs and means that the provider only needs to focus on Terraform itself.

The Mythic Beasts VPS API needs values that are only ever used when creating a VPS and so the provider uses the new write-only arguments feature, which is only available in Terraform v1.11.0 and later. Write-only is normally used for sensitive values like passwords but the VPS API doesn’t return every attribute so write-only is used for these values when creating the VPS and then they are forgotten.

Support

To make it clear, this is an unofficial provider that is not endorsed by Mythic Beasts.

It’s currently at version v0.1 and I wouldn’t consider it stable until it hits v1.0.

Right now it supports the APIs I need it to. Further features will be added as needed.

In use

I use the provider to provision a Raspberry Pi 4 from Mythic Beasts and set up the proxy endpoints for my personal website.

The whole setup, with Terraform to provision the Pi and then Ansible to configure it, is documented at infra.paultibbetts.uk .

What’s next?

The provider works with the VPS, Pi, and Proxy APIs, as these are what I currently use or have used in the past.

Mythic Beasts also have a DNS API which lets you manage the DNS records for domains.

If I were to add this to the provider I could change the management of my domain from Cloudflare over to Mythic Beasts, which would improve my website’s sovereignty .

These are used by some feed readers to show the full content, which means my posts are now fully readable through RSS.

This is how to do that.

You might already have one

If you’re using a static site generator like Hugo, or a CMS like WordPress, then you might already have an RSS feed.

If not, and you’re writing your site manually, or just want to understand what’s going on, here’s what an RSS feed looks like.

A minimal RSS feed

At a minimum an RSS feed contains:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>Example Blog</title>
    <link>https://example.com/</link>
    <description>Updates from my blog.</description>

    <item>
      <title>Hello World</title>
      <link>https://example.com/hello-world</link>
      <description>My first post.</description>
    </item>

  </channel>
</rss>

Required

<?xml version="1.0" encoding="UTF-8"?>

This line declares the XML version of the file and the encoding that it uses. UTF-8 supports text and emoji.

It’s strongly recommended to include this line so the file is read correctly.

<rss version="2.0">

This is the start of the <rss> element. The version="2.0" tells consumers that the feed conforms to the RSS 2.0 specification, the most widely supported version.

<channel>
  <title>Example Blog</title>
  <link>https://example.com/</link>
  <description>Updates from my blog.</description>

The <channel> declares the feed itself, so <title>, <link> and <description> are used to describe the feed and its contents.

These details should match what’s displayed on your site and will show up for users when adding or managing your feed in their reader.

The <link> should point to the URL of the <channel>, which is the site itself.

<item>
  <title>Hello World</title>
  <link>https://example.com/hello-world</link>
  <description>My first post.</description>
</item>

The <item> tag is used for each post in the feed.

An <item> must contain at least one of:

• <title>
• <description>

which means you could do:

<item>
  <title>My first post</title>
</item>

which is valid, but not very useful, or:

<item>
  <description>Hello, World!</description>
</item>

which is also valid, and slightly more useful, if only for microblogs and notes and other posts without a title.

<item>
  <title>An example</title>
  <link>https://example.com/posts/1</link>
</item>

Title + link is more practical, and may be all you need, but:

<item>
  <title>An example</title>
  <link>https://example.com/posts/1</link>
  <description>Hello, World!</description>
</item>

using all three is most common.

You could use the <description> for the summary of your post or for the whole thing.

There’s no upper limit on the amount of <item>s you can include in a feed, but there are some practical things to consider:

• RSS does not do pagination
• • everything is listed in one file
• if the file gets really big then it takes longer to download
• • aim to keep it under 500KB
• maybe only show your latest posts if you have lots of them

Optional

The fields mentioned above are all that is required for a minimal feed, but there are some optional extras that are recommended.

<item>
  ...
  <guid isPermaLink="true">
    https://example.com/posts/1
  </guid>
</item>

A guid, for “Globally Unique IDentifier”, gives each item in the feed a stable identity. This means feed readers can detect and remove duplicates correctly.

This is usually the permalink of the post. If so, isPermaLink defaults to true and can be omitted, however it it’s not the permalink, like a database ID, or the exact datetime the post was published, you would change isPermaLink to false.

Note that the L in PermaLink is also capitalised.

<item>
  ...
  <pubDate>Sun, 1 Mar 2026 14:00:00 GMT</pubDate>
</item>

The <pubDate> is used to show when an item in the feed was published. It can help feed readers understand the order of your posts and should be added.

<rss version="2.0"
xmlns:atom="http://www.w3.org/2005/Atom">

Changing the <rss> tag to include xmlns:atom="http://www.w3.org/2005/Atom" is also optional but recommended.

This tells whatever is reading the feed that anything defined with atom: comes from the Atom specification, and lets you use extra tags defined by the Atom spec.

This isn’t useful by itself, but it is used when you also add:

<atom:link
href="https://example.com/index.xml"
rel="self"
type="application/rss+xml" />

which defines the URL of the feed and helps feed readers know the canonical URL of the feed itself, which helps prevent duplicate subscriptions.

<lastBuildDate>Sun, 1 Mar 2026 14:00:00 GMT</lastBuildDate>

The <lastBuildDate> can be used by feed readers to know if the feed has changed.

Set it to the date of the most recent post.

<language>en-gb</language>

You should declare the language of the feed. It’s small, but it’s technically correct.

Things to remember

RSS is pretty simple but dealing with XML means you have to remember a few things.

XML must be well-formed

Writing an RSS feed is still writing XML, and so it must obey the rules of an XML file.

This means the file must not have any missing closing tags, or mix ups with the order in which you close them.

It also means you must handle special characters, otherwise the file is invalid and won’t be understood.

For example:

<title>Special & Character</title>

won’t work, because of the &, which must be escaped:

<title>Special &amp; Character</title>

No unescaped HTML in the description

The same happens with the <description> tag, which usually holds the summary or the contents of the post, and must not include unescaped HTML characters.

The first option is to escape all of the HTML in the description:

<description>&lt;p&gt;Hello, World!&lt;/p&gt;</description>

or the more common option is to wrap the HTML content in the description in a CDATA tag:

<description><![CDATA[
<p>Hello, World!</p>
]]></description>

where CDATA tells whatever is reading the XML file that everything inside this is raw text.

Dates must be written as RFC 822

If you do use <pubDate> or <lastBuildDate> to show dates you must ensure they are written using the RFC 822 format :

<pubDate>Sun, 1 Mar 2026 14:00:00 GMT</pubDate>

Serve the file with the correct Content-Type

When your server responds to a request to show the feed it should send:

Content-Type: application/rss+xml

so that feed readers recognise it as an RSS feed.

Most static web hosting handles this for you, I only mention it in case you are setting up a server and are messing with the Content-Type of the files you serve.

How to check your feed

There are a few ways to check you’ve written your feed correctly.

Open it in a browser

The file should open and look similar to what you wrote it as. If it doesn’t open, there’s a problem, and if it shows an error then you need to fix it.

Use a validator

You can use validator.w3.org/feed to validate your feed. It can work with the URL of your feed online or you can paste in its contents if you’re still working on it.

Add it to your reader

The best test is to add your own feed to your reader and check it looks the way you want.

Make sure it’s showing in the order you expect and you can edit posts without making duplicates in your reader.

Full example

Here is a condensed version of my own RSS feed, containing two articles and a note.

The note doesn’t have a <title>, which influenced the URL used for its <guid>.

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0"
	xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<title>Paul Tibbetts</title>
		<link>https://paultibbetts.uk/</link>
		<description>Recent posts by Paul Tibbetts</description>
		<generator>Hugo</generator>
		<language>en-gb</language>
		<lastBuildDate>Sun, 01 Mar 2026 12:41:46 +0000</lastBuildDate>
		<atom:link href="https://paultibbetts.uk/feed.xml" rel="self" type="application/rss+xml" />
		<item>
			<title>How to create an RSS Feed</title>
			<link>https://paultibbetts.uk/2026/03/01/how-to-create-an-rss-feed/</link>
			<pubDate>Sun, 01 Mar 2026 16:33:46 +0000</pubDate>
			<guid>https://paultibbetts.uk/2026/03/01/how-to-create-an-rss-feed/</guid>
			<description>In my last post I recommended starting with RSS to make your site followable. This is how to do that.</description>
		</item>
		<item>
			<title>Ways to make your feed followable</title>
			<link>https://paultibbetts.uk/2026/03/01/ways-to-make-your-feed-followable/</link>
			<pubDate>Sun, 01 Mar 2026 11:36:03 +0000</pubDate>
			<guid>https://paultibbetts.uk/2026/03/01/ways-to-make-your-feed-followable/</guid>
			<description>You’ve got 3 posts on your site and you want people to be notified about new ones. Here’s all the ways I can think of doing that.</description>
			</item>
		<item>
			<title>2026-02-15 14:54:58</title>
			<link>https://paultibbetts.uk/2026/02/15/2026-02-15-145458/</link>
			<pubDate>Sun, 15 Feb 2026 14:54:58 +0000</pubDate>
			<guid>https://paultibbetts.uk/2026/02/15/2026-02-15-145458/</guid>
			<description>Launched: infra.paultibbetts.uk A documentation site for the infrastructure that runs paultibbetts.uk.</description>
		</item>
	</channel>
</rss>

Here’s all the ways I can think of doing that.

Email

Some sites let you send out your posts as emails.

Don’t do it. It can be tempting, because it’s easy, but emails are for emails.

There are better options for your feed.

RSS

RSS stands for “Really Simple Syndication”.

It’s a standard format for publishing a feed so apps can subscribe to your updates.

Feed readers and podcast apps use it.

It looks a bit like this:

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
  <channel>
    <title>RSS Example Site</title>
    <link>https://example.com/</link>
    <description>Example site description.</description>

    <item>
      <title>Hello, World!</title>
      <link>https://example.com/hello-world.html</link>
      <description>My first post.</description>
    </item>

  </channel>
</rss>

You would host a file like this, link to it from the <head> part of your pages, and readers would check it occasionally for updates.

Its simplicity means it’s supported by almost all feed reading apps.

Because of this I’d say RSS is the best starting point for letting users subscribe to your posts and is worth adding to your site first, before the other alternatives.

Atom

RSS isn’t the only way to create an XML feed. Atom is another standard which is more formally specified.

In the early 2000’s, after Atom’s launch, there was a time called the “RSS vs Atom wars”. There was no real winner. Atom was decided to be technically better, but by then RSS had already become dominant.

These days you can add a few Atom elements to your RSS feed, like a rel=self link, to get the best of both worlds.

JSON

JSON feed is the one of the newer standards. It works in the same way as RSS and Atom but the data is presented as JSON instead of XML.

Web development has moved on from XML and these days JSON-based things are much more common. The idea is that by using JSON we allow developers to build new things like feed readers using modern techniques and tooling, instead of ones used only for legacy publishing steps like an XML-based feed.

It looks a bit like this:

{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Example JSON Feed Site",
  "home_page_url": "https://example.com/",
  "feed_url": "https://example.com/feed.json",
  "items": [
    {
      "id": "2026-02-28-153000",
      "url": "https://paultibbetts.uk/notes/2026-02-28-153000/",
      "content_html": "<p>Hello world</p>",
      "date_published": "2026-02-28T15:30:00Z"
    }
  ]
}

JSON feed is already supported by many feed readers and, at least in theory, makes it easier than XML-based feeds to make new ones.

I’d say it’s worth adding to your site after you’ve got an RSS feed, since those are more universally supported right now.

Microformats

Microformats is a standard for marking up the contents of your posts, and in doing so makes your feed followable without any other files.

Classes like h-entry and h-card help others to understand the content you’re publishing, and the h-feed class is used to identify feeds. This means readers using apps that understand microformats can subscribe to your content directly, without needing an XML or JSON file.

Right now most feed readers expect RSS or Atom feeds, so whilst I would suggest adding microformats, I would do it after adding an RSS feed.

Social media

There’s also social media, where you would post a link to your content on another site, like Facebook or Instagram.

It’s a great way to get your posts in front of users across the web on the apps they’re already using, but it’s no longer on your own site and you’re now at the mercy of whatever the algorithms think of your content.

I’d consider doing this as an extra, and only after making your own feed available.

For more information on posting out to social media the IndieWeb.org wiki has a great page called Publish Own Site, Syndicate Elsewhere (POSSE) .

ActivityPub

Another option is to use the ActivityPub protocol for your content.

ActivityPub is what powers Fediverse apps like Mastodon and making your content available through it makes your site part of the Fediverse itself. Readers can then subscribe using whatever Fediverse app they want.

This involves a lot of work, and is difficult to implement for static sites, so hosted solutions like Bridgy Fed can be used to do this for you.

All of the above

The best option could even be to do all of the above, to give your readers freedom to choose the method that works for them.

If you want the most compatible way to let others follow your posts: start with RSS.

Then add alternatives after.

I use it for my personal site and in my homelab.

This is what it does and how to use it.

What it does

An Ansible role is like a plugin that extends Ansible with the ability to do something, and in this case it’s to install and manage Caddy .

Specifically it:

• installs Caddy
• • defaults to using the apt package manager
• • or it can be given the URL to a specific binary
• • or it can be given a list of plugins
• can be used to manage Caddy
• • or completely uninstall it
• can write the Caddyfile from a template

Why Caddy?

I use Caddy because it manages TLS certificates automatically and, with a plugin, supports DNS-01 challenges .

DNS-01 is useful when services aren’t reachable by Lets Encrypt, like in a homelab, so private networks can also have TLS.

Design goals

The role was designed with the following in mind:

• idempotent and safe to re-run
• Debian and Ubuntu
• works on x86 and ARM
• supports installing with plugins
• can optionally write the Caddyfile

There are already Ansible roles for Caddy, like the one listed in the docs , but I needed a role that could install Caddy with plugins.

How to use it

The role is available on Ansible Galaxy .

Install

You can install it by adding:

- name: paultibbetts.caddy
  version: 1.0.0

to your requirements.yml file and then running:

ansible-galaxy role install -r requirements.yml

Variables

The variables for the role, as well as the default settings, can all be overridden.

The most important ones are the install method, the plugins to include, and whether the role writes the Caddyfile for you.

caddy_install_method: apt

The role defaults to installing Caddy via apt, the package manager for Debian/Ubuntu.

This means Caddy does not include any plugins but it does get updated when you run apt upgrade.

caddy_install_method: download

Alternatively you can change the install method to download.

Now you can pass in the URL of a specific binary using:

caddy_download_url: ""

Using this you could build a binary for Caddy (including plugins), host it, then pass that URL to the role and that specific binary will be installed.

This is currently the only way to install a specific version of Caddy that isn’t “latest”.

If you want to install plugins for Caddy and don’t want to build your own binary you can leave the download URL empty and pass in the plugins:

caddy_plugins:
  - github.com/caddy-dns/cloudflare

and the role will generate a URL from the download page .

caddy_caddyfile_template: "" | "{{ playbook_dir }}/templates/Caddyfile.j2"

The Caddyfile template variable lets you pass in a template of a Caddyfile for Caddy to use and it will be written to the appropriate place.

Letting the role write the Caddyfile means you can import the role, set its variables, and have all of Caddy configured by one thing - you don’t need to write extra tasks after installation to get it up and running.

Examples

The following examples show how the role can be used for a public website and for a private homelab reverse proxy.

In both instances Caddy acquires TLS certificates from Lets Encrypt, using Cloudflare to do DNS-01 challenges.

Example: Personal website

The role can be used to setup Caddy to host a personal website.

- hosts: server
  become: true
  roles:
    - role: paultibbetts.caddy
      vars:
        caddy_caddyfile_template: "{{ playbook_dir }}/templates/Caddyfile.j2"
        caddy_install_method: download
        caddy_plugins:
          - github.com/caddy-dns/cloudflare
        caddy_manage_systemd_env_file: true
        caddy_systemd_env:
          CF_API_TOKEN: "{{ vault_cf_api_token }}"

The download install method is used to install Caddy with the Cloudflare plugin , the Cloudflare API token is passed to Caddy from Ansible vault, and a template is provided for the Caddyfile, which could look like:

(cf_tls) {
    tls {
        dns cloudflare {env.CF_API_TOKEN}
    }
}

{% for site in web_sites %}
{{ site }} {
  import cf_tls
  root * {{ web_sites_root }}/{{ site }}/current
  file_server
  encode zstd gzip
  log
}
{% endfor %}

This sets up Caddy to use Cloudflare to do DNS-01 challenges with Lets Encrypt to get a TLS certificate for each site in web_sites.

Example: Homelab

The role can also be used to setup Caddy in a private network, like a homelab.

- hosts: homelab
  become: true
  roles:
    - role: paultibbetts.caddy
      vars:
        caddy_caddyfile_template: "{{ playbook_dir }}/templates/Caddyfile.j2"
        caddy_install_method: download
        caddy_plugins:
          - github.com/caddy-dns/cloudflare
        caddy_manage_systemd_env_file: true
        caddy_systemd_env:
          CF_API_TOKEN: "{{ vault_cf_api_token }}"

{
        acme_dns cloudflare {env.CF_API_TOKEN}
}

service.homelab.example {
        reverse_proxy <ip>:<port>
}

where the Cloudflare plugin is configured once and is then used to do DNS-01 challenges for any TLS certificates Caddy requests. Note this style has been deprecated and you should do it per host, like the earlier example for a personal website.

DNS-01 challenges are solved by writing a TXT record to prove domain ownership. This means Lets Encrypt is able to issue certificates for domains it can’t reach, which makes DNS-01 ideal when Caddy is running in a homelab.

Molecule Scenarios

Ansible Molecule is a way to run tests for an Ansible role.

The role includes molecule scenarios that test it works on x86 as well as Arm, because I use the role on a Raspberry Pi 4, as well as scenarios for the Cloudflare plugin and the Caddyfile templating.

In use

I use this role as part of the code that sets up the infrastructure for my website.

Terraform is used to provision the server, then Ansible is used to configure it, with this role setting up Caddy and the Caddyfile it uses.

The complete setup - Terraform, Ansible, Caddy, and the rest of the files - is documented at infra.paultibbetts.uk , where I explain how it all fits together.

It was simple and free, but it didn’t really feel like it was mine.

I’ve fixed that with a Raspberry Pi.

Why leave GitHub Pages?

GitHub Pages is excellent at what it does.

You upload the code for your site to GitHub and they will build and host it for you.
All for free.

So why leave?

Independence

GitHub is owned by Microsoft, one of the biggest companies on the planet.

I have no problem with Microsoft, or using their economies of scale to do something for free that would otherwise cost me money, but ultimately I didn’t feel very indie hosting my site on something I didn’t control.

Sovereignty

GitHub and Microsoft are companies based in the USA, and those of us in Europe are re-considering our dependence on US tech.

Moving has brought my website closer to home - physically, legally, and ethically.

Portability

The work to move from GitHub Pages to anything else has also made it easier to move it all again to another provider, should I ever choose to do so.

I’ve taken the script to build the site out of GitHub Actions and made it part of the code itself. This decouples the site from any specific CI platform and makes both hosting and deployment replaceable.

What it now runs on

There’s no good reason for using a Raspberry Pi for this, I just thought it would be cool.

It is some of the cheapest hosting I could find from a UK-based provider, but there are cheaper options and hosting in Europe works just the same and is even cheaper.

The Pi is from Mythic Beasts , a UK company based in Cambridge. It lives in London and runs on green energy .

I provision it with Terraform, which lets me write the Pi down as code, and then I configure it using Ansible, another tool that sets up the software it runs.

Ansible installs and manages Caddy, which is a web server that has been configured to serve my site.

Deployment is still handled by GitHub Actions but now it goes to the Pi instead of Pages.

From the outside it all works exactly the same, but now it’s on hardware I control, with a setup that’s more portable than it was before.

Under the hood

To make this all possible I ended up writing more code than I set out to.

There wasn’t a Terraform provider for Mythic Beasts, so I wrote one .

For that to work it needed a client to talk to their APIs, so I wrote that too .

And to set up Caddy using Ansible I wrote my own role . There were already others that did this but none of them did exactly what I wanted, so I made my own.

None of this was really required, I could have moved to the Pi without writing any code, but the change from a manual setup to an automated one - driven by code - has forced me to treat the infrastructure of my website as a real system, that can change and evolve over time.

What this means

As a result my setup is now reproducible, portable and more independent.

I can see all the parts that make up my infrastructure and swap them out for alternatives. I’m not tied down to a provider I can replace with a few lines of code.

And ultimately, there’s no difference to visitors of the site, who still get the same experience as before.

What comes next

Through doing this I can see that I might also be able to move my domain from Cloudflare to Mythic Beasts, another win for sovereignty.

If I did that, and moved the code hosting away from GitHub, I’d have a website that’s fully independent.

But that’s for another time.

Over the next few posts I’ll go over:

• how to use the Ansible role
• making a provider for Terraform
• the code that ties it all together
• the site that explains it all in-depth

Now

For now this post marks that this site’s no longer hosted by GitHub Pages.

It’s on a tiny computer, closer to home, set up by my own code.

That feels a bit more mine.

A documentation site for the infrastructure that runs paultibbetts.uk.

A Terraform provider for Mythic Beasts.

A client for the Mythic Beasts APIs, written in Go.

An Ansible role to install and operate Caddy web server.

Dispatch

Single-player story-driven narrative.

Dispatch might be the funniest game I’ve ever played. It’s extremely well written, absurdly well voice acted and expertly made by the team that used to be Telltale Games.

It gives a real glimpse into the life of a superhero dispatcher and kept me entertained the whole way through.

I’ll be playing whatever Adhoc Studios makes next. I hope it’s Wolf Among Us 2 or another season of Dispatch. Either way, I’m in.

It’s rated Platinum on ProtonDB, so it plays great on Linux.

Steam

Arc Raiders

Third-person PvPvE extraction-shooter.

I wasn’t expecting to like Arc Raiders as much as I did. It makes the sweaty extraction-shooter genre more accessible, even if it is still pretty sweaty.

Escape from Tarkov was a bit too much for me; Arc Raiders has a much better balance. It’s not for everyone, but it’s that well done you might enjoy it even if you don’t like similar games.

Whilst you can get shot by other players, it’s the Arc that are the real threat, and this mix of danger, plus the proximity voice chat, make it unlike any other game out right now.

It won The Game Awards’ Multiplayer Game of the Year , so don’t just take my word for it.

Embark ’s previous game, The Finals , made it onto last year’s list. Maybe we’ll see a third game on next year’s list?

It’s also rated Platinum on ProtonDB.

Steam

Battlefield 6

PvP FPS explosion-simulator.

Battlefield is back!

I’ve played BF games ever since the first one, set all the way back in World War 2. I didn’t buy BF5, and wasn’t that impressed by 2042, so I was happy to see Battlefield make a comeback with 6.

And it was quite the comeback. Two of my friends bought new computers just to play it, and its launch weekend was the most active my little Discord server’s ever been.

It’s moved away from the slower, more tactical feel of its earlier entries though. If that older style is what you’re after, games like Squad and Hell Let Loose now occupy that space.

With 6, Battlefield has settled into being a faster, more accessible squad-based shooter - and judged on those terms it’s an excellent game. No wonder it was the best selling FPS of the year .

Its only letdown is that it needs Secure boot to run the anti-cheat, which means you can’t play it on Linux, so it gets a borked rating on ProtonDB.

Steam

Dying Light: The Beast

First-person single-player/co-op story-driven parkour-action-zombie-killing.

The Beast is the best of the Dying Light series. Techland have improved on every part of the experience. And best of all, since I bought the deluxe edition of the second game, I got it for free!

It looks awesome, it runs well, and it’s loads of fun. I’m still playing through it in co-op, which lets up to 4 people be Kyle Crane, the protagonist from the first game.

Another Platinum rating on ProtonDB.

Steam

Jump Space

Mission-based co-op PvE for up to 4 players.

(Previously known as Jump Ship)

It’s still in early access but Jump Space is more than playable right now. It’s the chosen game for game night for us where once a week we crew a spaceship, fight some robots and one of us expertly puts out fires the others don’t even notice because they’re busy shooting space lasers.

Yet another Platinum rating on ProtonDB.

Steam

Anno 117: Pax Romana

Single-player city-builder.

Anno 117 is apparently very similar to Anno 1800 but in a different setting with different people, which is exactly what I wanted.

You build up an island, or a few of them, from humble beginnings all the way up to a mighty city, managing buildings, production, and trade.

It’s a more relaxing game than the other ones on this list. There is a bit of combat, but its main appeal to me is the city building and the setting.

It gets only a Gold rating on ProtonDB, which I can’t confirm, I haven’t yet tried it on Linux.

Steam

RV There Yet?

Co-op friendslop.

Friendslop is a new word for me. It’s meant to define the low-stakes co-op games that are sold at low prices so that everyone in the group can afford to play them.

I don’t know how true that definition is, I’ve only ever played it with one person, who I can safely say is not qualified to drive an RV, whilst drinking a beer, smoking a cigarette, cooking burgers, being chased by a bear.

I almost put Peak here, but so far I’ve had more fun in RV There Yet?.

This game gets the last Platinum rating on ProtonDB for games released in 2025, because this is the last of that list.

Steam

Not released in 2025

These weren’t released this year; they made the list anyway.

The Beginner’s Guide

Single-player narrative-exploration-art.

The Beginner’s Guide took me a decade to play, and I’m glad I finally did. It came out in 2015 and I got it this year as a Christmas present (thank you!). I played and finished it that same day.

It’s made by the same developer as The Stanley Parable , which I really enjoyed, and it was a very different experience for this one. Whereas TSP was an interesting game, I’d describe TBG as art. It doesn’t involve much gameplay, and instead uses the medium of video games to do interactive storytelling.

Despite the rest of my list, I think you might need to view video games as an art-form, not just zombie-killing-space-laser-shooting-explosion-simulators, to really appreciate this one.

It gets a Platinum rating on ProtonDB and was natively released on Linux. I had to change a setting to make it playable.

Steam

Ministry of Broadcast

Single-player platformer

Another Christmas present I’m really enjoying. It’s perfectly suited for the Steam Deck, so it also works well with a controller, and is the only game on this list where I get to lean back in my chair instead of forward.

It’s inspired by George Orwell’s 1984, which might be why I’m liking it so much. Though I don’t remember Winston falling off as many buildings as I have.

Platinum rated on ProtonDB.

Steam

Baldur’s Gate 3

Single-player / online co-op party-based RPG

I am still playing Baldur’s Gate 3. I am still in Act 1. I know.

This is such a good game that I can’t just turn it on mindlessly for 20 minutes. I need to settle in for an afternoon and play for a few hours at a time - to get into the right mind-frame and settle into being a powerful sorcerer.

Or whatever I am, I don’t know, I’ve never played D&D before. My character keeps wanting to kill things, and I am happy to oblige.

I am sorry bard, I don’t know what came over me.

Gold rated on ProtonDB, which is weird because it has a native Linux build .

Steam

TLDR: if you want to run Pangolin hassle-free, use a VPS with local SSD storage on an IPv4 network.

Pangolin

Pangolin is a “secure access platform” for safely exposing internal services. I’m using it to let friends and family reach a few apps in my homelab without giving them the keys to everything.

It’s a free, open-source alternative to Cloudflare Tunnel for those who like independence from Cloudflare, want to self-host the stack themselves, or prefer not to rely on a third-party network for media streaming, which is not its intended use-case.

If none of those things bother you then you’ll be fine using Cloudflare Tunnel or one of the alternatives. Read the terms and conditions first, media streaming is a bit of a grey area, I am not a lawyer and that wasn’t legal advice.

Alternatives

I already use Wireguard as a VPN, and I still use it myself to get into my home network. VPNs work, but they’re not fun to manage for friends and family and I wanted the ability to lock them down to certain apps.

There’s also Tailscale , Netbird , and ZeroTier , which use Wireguard to make a mesh network, but that’s more of the same VPN solution. I’d need to set up profiles and install clients on devices, and I wanted something easier. Tailscale now has its own Funnel project, but by the time I’d seen it I was already setting up Pangolin.

The last alternative to mention is that you can achieve a similar result by renting a server, adding it to your VPN, and setting up a reverse proxy on it. But then you’d need something else to make it secure, and you end up back at Pangolin.

Hosting

Pangolin needs to be hosted outside your network, so I needed to rent a server. It doesn’t need to be a big one, Pangolin can work with 1 vCPU and 1GB of RAM, but ideally it would be close to your internal network and the users that want to get into it.

I live in the UK, so my options were UK, Ireland or Europe. UK-based hosting turned out to be expensive, with Krystal charging £12 per month , whereas Hetzner, based in Germany, offers the same specs for £3.97 .

I should have gone with Hetzner. The extra latency would likely have been ~20ms and for Pangolin’s use case - web apps and media streaming - that wouldn’t have been noticeable.

But at the time I wanted my server to be based in the UK, so I carried on looking, until I found Mythic Beasts . Not only had they recently donated to the Open Rights Group , an organisation I also support, but they have a cluster of Raspberry Pis you can use.

My search was over. I wanted Pangolin on a Pi. I did some initial testing, and the early signs were good, so I signed up for a year.

Raspberry Pi

The Mythic Beasts Pis come with two obstacles to running Pangolin. The first is that they are IPv6 only, and the second is the storage they use. One of these involves a little workaround and the other makes it a bad choice for hosting Pangolin.

NFS Storage

Pangolin is actually more of a stack, with Pangolin as the control plane, Traefik doing reverse proxying, Gerbil running the tunnel and a thing called Badger to do the middleware that checks for authentication. The easiest way to run it all is with Docker Compose, and this is the first hurdle to running Pangolin on a Mythic Beasts Pi.

The Pis only have network storage available, and Docker doesn’t like that because NFS doesn’t provide the kind of guarantees Docker wants from a filesystem. Docker can work with NFS, but only using the vfs storage driver. Unlike the default overlay2 driver, which uses a layered filesystem, vfs doesn’t share layers, so every image consumes more space than it should.

So not only does NFS end up being slow, copying over lots of small files, it means the Docker images can’t do any of the space saving that would normally happen. I have 50GB of storage and it’s at 70% usage, even though the final images only take up 2GB, all because of the way vfs does its layering.

Did I mention that it’s slow? Starting up the containers takes about 15 minutes. Turning them off isn’t fast either. And upgrades? You won’t have room for the new images, so you’ll have to turn everything off to remove the old ones before you can start downloading the new ones. This means upgrades can take about an hour, with Pangolin down the entire time.

IPv6

The internet’s ran out of IPv4 addresses, by the way, so the Pis are IPv6 only. This means you have to do a bit of extra work to make Pangolin available for everyone.

IPv6 is the future but support for it is still mixed, so Mythic Beasts have an IPv4 to IPv6 proxy to allow users stuck on IPv4-only networks to get to your server. To use it you configure the proxy to forward requests to your domain on to the IPv6 address of the Pi.

The other end of the tunnel, the one in your home network, is managed by a service called Newt. It needs to speak to Gerbil on the Pi, and I was not successful getting it to run with the default pangolin.example.com address I was using.

Newt is configured by pointing it at Pangolin, which advertises the Gerbil endpoint it should connect to. Maybe it was Pangolin, or the proxy, or even something else; I could not get it to work. To make some progress I changed the base_endpoint in config/config.yml. First I tried the IPv6 address of the Pi, but that still didn’t work, so I created an AAAA record for Gerbil and pointed it at the Pi. This would do the same thing as the CNAME I’d used for Pangolin, except that went through the proxy and maybe that was messing things up. This time, it worked.

Mythic Beasts state their proxy :

will relay traffic for common services, such as HTTP and HTTPS

and I have a suspicion that Wireguard doesn’t count as a “common service”.

Home network

The final hurdle to getting this setup to work was my own network. Since the proxy doesn’t seem to forward Wireguard traffic, and I have to connect directly to the Pi with IPv6, my network needs to let me do that.

This means I need at least IPv6 egress. That doesn’t mean full IPv6 support everywhere, just enough to have a usable outbound path. I tried a bunch of different things to get it to work, and some of my changes actually made things worse, so what follows is what worked for me, in case your setup is similar, most likely it isn’t.

ISP router

I’m still using the router my ISP gave me, which has very basic IPv6 support. I’m with Vodafone and it’s the standard “WiFi hub” they gave out several years ago.

The right combination of buttons to press is under Settings -> Local Network and you want:

IPv6 Enabled

IPv6 ULA Disabled

The IPv6 toggle enables Router Advertisements (RA) from the router and this gives hosts a global IPv6 address, and also tells them what the default route for IPv6 traffic is, which is through this router.

The IPv6 ULA toggle disables Unique Local Addresses, which is a private IPv6 space used for hosts to speak to each other over IPv6, and is not necessary for Newt to reach Gerbil, so it can be disabled.

Mesh router

I’ve also got a pair of mesh devices I use as a wireless bridge between floors, since I’m not able to run an ethernet cable.

They’re definitely in bridge mode. However, in the admin panel under Settings -> Network -> Advanced, IPv6 was set to “Auto Configuration”, meaning they were also doing SLAAC and DHCPv6. This added to the confusion, not just for myself but for my devices, so I changed that to “Local Connectivity Only” to simplify things.

DHCP

My ISP router sucks, it even crashed when I double checked the settings I mentioned above, so I’ve moved DHCP off of it and instead do that with Pi-hole. It’s way more stable and lets me view the admin panel without crashing.

An extra benefit of this is that when Pi-hole tells a device what its address is it will also tell them to use it as the DNS server, which makes it an automatic setup. The device now gets ad-blocking and can see the custom DNS records I’ve set in Pi-hole without me doing anything.

RDNSS

Except now that my ISP router is doing IPv6, it’s also doing RDNSS, which is DNS for IPv6, and I can’t turn it off. This means it does the same thing that Pi-hole is doing but for IPv6 instead of 4. Since IPv6 is the future, every device on the network now prefers going to the router for DNS, instead of Pi-hole, so they lose the ad-blocking and custom DNS records I’ve set.

If I had a better router that let me turn on IPv6 and either disable RDNSS, or advertise Pi-hole as the IPv6 DNS server, then this wouldn’t be a problem. With my ISP router not letting me do that I could manually set every device to use Pi-hole for DNS, which is fine, unless you want to do it on Android.

Android

Most of the mobile devices in this house run iOS, which lets you manually set the DNS server, and allows you to enter an IPv4 address, which is fine for Pi-hole.

Android does it differently. It lets you set an IPv4 address, but if it sees RDNSS then it ignores your manual setting and uses that instead, which for me is the ISP router. So no ad-blocking or custom DNS records for Android devices.

This means if you’re in the kitchen and want to check Mealie to see the recipe for tonight’s meal you have to go out over the internet to come back and reach the server in the other room.

I don’t personally use Android, but as the architect of the setup it still feels bad.

Router DNS

There is a fix, although it’s not ideal, and that’s to set my router’s DNS to use Pi-hole. I had initially forgotten about doing this, because I thought it was already setup, but it turns out I’d turned it off for good reason.

Whilst it works, and the Android devices can now see apps in my homelab, all the traffic goes to Pi-hole through the router, so you can’t distinguish where it came from. I don’t really need this, but I remember now why I preferred Pi-hole handing out its own address as the DNS server.

What I could do to improve it

This project has made me question, well a lot of things. The ability to update my RSS feeds without toggling my VPN on and off is kinda nice, and I can share limited access to my homelab with my friends and family, so for now it can stay.

Here’s what would make it better:

Use a VPS with SSD storage on an IPv4 network

This is the most obvious improvement to the setup.

The NFS storage on the Pi makes it a bad choice to run Docker Compose setups like the Pangolin stack. It works, but startup and even shutdown take too long and so upgrades have far more downtime than they should. NFS is fine for storage for the containers, but it’s not suitable for running the containers themselves.

The IPv4 to IPv6 proxy that I’m using doesn’t forward Wireguard traffic, so I’ve had to set up IPv6 in my network, which has caused some manual work I wasn’t expecting.

To be clear, the Pi itself is not to blame for any of this, it’s more than capable of handling the Pangolin stack. It’s the fact it only has NFS storage that lets it down. The proxy not forwarding Wireguard can be worked around, and both are completely understandable tradeoffs that Mythic Beasts have made to make Raspberry PI hosting available in the first place.

The improvement would be to use a VPS, or even another Pi if I could find one, that uses fast local storage and is on an IPv4 network, or has a proxy available that also forwards Wireguard traffic.

If I hadn’t already committed to a 12 month contract for the Pi I would have already done this. If I can find an alternative use for it maybe I’ll move before the contract runs out.

Until then, I’m not doing this.

Host Pangolin without Docker

This is entirely possible, but goes against the point of using Pangolin. I wanted an easy to use system, and as soon as I start deploying each part of it myself and connecting all the parts together it’s no longer simple or easy to use.

The same goes for installing Wireguard manually on the Pi and reverse proxying through it into my homelab. I’ve already got a Wireguard server up and running, so that’s half the job already done, but then I’d need to setup something to secure access into that tunnel, and that’s what Pangolin’s for.

Blue/Green deployments

NFS means the Pi takes a while to run upgrades, so there’s about an hour of downtime.

I could get around this by spinning up a second Pi, installing the upgraded software, somehow sync the configs, and then switch the DNS to point to the upgraded Pi.

This wouldn’t solve any of the problems except the downtime, and it would cost me more money to do so. I’m not doing that. My friends and family will have to put up with the downtime.

They could chip in to cover the costs, but that turns the whole thing into a business arrangement and I don’t want to go down that road.

Get a better router

This is more of a homelab quality-of-life improvement than a Pangolin-specific fix.

Getting rid of the ISP router and replacing it with something better would mean I can stop using Pi-hole for DHCP and only use it for its original intended purpose, DNS.

It only needs the ability to change the RDNSS setting to advertise Pi-hole as the DNS server to be better than my ISP router. Forwarding DNS through the router works, but advertising Pi-hole directly would preserve the per-device visibility in Pi-hole that I originally had for all devices.

This may need to happen anyway, but I wasn’t looking to do this right now, so for now it isn’t a priority. When I do upgrade, OpenWRT, OPNsense and pfSense would all allow me to use Pi-hole for RDNSS.

Host my own IPv4 to IPv6 proxy

I could technically go back to IPv4 only in my network if the proxy I use to connect to the Pi also forwarded Wireguard connections. Since the current one doesn’t, the only options are to setup IPv6 in my home network or host my own proxy that can.

I picked the Pi because it was the cheapest UK-based hosting I could find, and this doubles the cost, so it isn’t really an option.

Also I don’t want to host a tunnel for my tunnel. That’s too many tunnels.

Would I do this again?

Absolutely not.

Am I glad I tried it?

Yes. That’s the point of a homelab.

I’ve just fixed a very niche problem that was both.

Home Network

My home network’s a bit unusual. The internet comes in downstairs, like the internet usually does, and I need it upstairs where my computers are. I’m renting, and the property owner doesn’t want wires going up and into walls, so I have to do it wirelessly.

WiFi is fine for most of my devices but a few of them are servers that don’t have adapters. They want to be plugged in, so I share the internet between floors with a pair of mesh routers and plug in the servers to the upstairs mesh device.

It all works great and I can recommend the mesh routers, although they’re a bit old and have probably been superseded by now.

Homelab

The problems started along with my homelab.

I was creating lots of virtual machines on one of the servers that weren’t being recognised by the router, so they wouldn’t join the network and had no internet access.

I couldn’t get onto the admin panel of the router because it’s the free one you get from the ISP and it wasn’t powerful enough to keep up.

I was getting annoyed.

DHCP

Then I found that Pi-hole, something I was already using for ad-blocking and DNS, could also act as a DHCP server . This would undoubtedly be better than doing it on the free ISP router that couldn’t keep up, so I disabled it on the router and enabled it in Pi-hole.

The way DHCP works is that something on your network needs to answer requests from clients telling them what their address is. Usually this is the router, but it doesn’t need to be.

So I set my instance of Pi-hole to handle DHCP.

And it all worked great.

Kind of.

DHCP over mesh WiFi?

The first clue that things weren’t quite right came when my devices wouldn’t reconnect to WiFi. The next was when my PC wouldn’t get a connection at all, until after I restarted the mesh router.

It took a while for me to connect the dots, but something about the mesh routers was making things weird.

If it didn’t work then that was fine, I would move on. But it worked some of the time?

Have you tried not doing that?

I spent a lot of time this week trying to diagnose the issue.

I even started preparing to replace the router.

I needn’t have bothered.

Moving the server with Pi-hole on it downstairs, where it doesn’t need to use the mesh routers, has fixed the issue.

Pi-hole now responds to DHCP requests and all my devices can connect to the network.

Summary

So if you ever have DHCP issues because your instance of Pi-hole is behind a mesh router, try not doing that and see if it fixes things.

So why, on the same day I said I was team IndieWeb, did I enter the Fediverse?

IndieWeb

I’ve been following the IndieWeb for a decade now and have recently started blogging again, slowly adding IndieWeb features to my site.

Right now it’s readable and followable, a bare minimum website experience, but with a little webmention magic it can grow into something more social. That’s the plan anyway.

I’d be able to write and respond to others on the IndieWeb that also do webmentions.

But not everyone wants to make their own website, or buy into a platform with strange features they don’t understand , so there’s a limit to how social it can really end up being.

Mastodon

Enter Mastodon, which erupted in popularity when Musk started to ruin Twitter. It’s a decentralised social network that works a bit like Twitter did but without as many nazis.

Mastodon is powered by ActivityPub , which means it’s part of the Fediverse - a whole network of apps that can all talk to each other.

My website isn’t connected yet because I haven’t added support for it. I do already have ActivityPub on my Micro.blog account, although it’s a little complicated.

Micro.blog

Micro.blog is a microblogging platform with both IndieWeb and Fediverse functionality. I use it at micro.paultibbetts.uk to post shorter content and links to my stuff around the web.

It speaks ActivityPub, so technically you can interact with me at @paultibbetts@micro.blog.

It also has an RSS importer, which I use to posts links from my main site to the Micro.blog timeline, so other users can follow my blog using Micro.blog.

What it does not do, unfortunately, is post those links to ActivityPub.

So I’m going to use Micro.blog to cross-post to my own Mastodon account.

Bluesky

So if I’m going to check out the Fediverse, and other non-IndieWeb social networks, why not check out Bluesky?

Bluesky is taking a different approach to Mastodon and the rest of the Fediverse.

It does not use ActivityPub, it uses the AT Protocol , something else I don’t yet understand or want to add to my own site. So again I’m using Micro.blog to cross-post for me.

POSSE

It’s all in an effort to Post to my Own Site and Syndicate Elsewhere.

I’m taking the IndieWeb approach and putting my content in one place and then posting links to it in as many places and on as many platforms as I can.

There are more advanced approaches than this, ones where I can pull back comments to my own site, but I’m not there just yet.

For now I’m building an online presence and testing out the future of social networking.

Follow me

Which changes how you can follow me, again.

You can follow my blog with RSS .

You can follow my microblog with RSS .

You can follow both using Micro.blog , Mastodon and Bluesky .

This is easier said than done, and there are lots of different ways of doing it.

This is what I did.

As a web developer

There are three paths to getting your own site.

Service

You could use an existing service like Micro.blog to host your site.

I already do this for my microblog because it comes with a bunch of features out of the box and gets me onto the IndieWeb, even while I don’t yet support all the IndieWeb features on my main site.

CMS

An alternative path is to use an existing content management system and add on IndieWeb features with plugins.

I’ve done this in the past with WordPress but I moved on from the WordPress world a while ago.

Self-starter

I decided I was more comfortable writing and doing it myself.

What it needs to do

Before I wrote any code I made sure to cover the basics.

Information about me

The homepage of my site needs to include a h-card with my name, an icon, and rel-me links to my social network profiles.

This is not only useful for humans but I can also use it to sign in to other sites using IndieAuth .

I used IndieWebify.me to check I’d done it correctly.

Publish content

My posts should be marked up using h-entry so that others can understand my content.

The original site design had words with titles, which makes them technically “articles”, although that could change in the fture.

How the site works

There are lots of different ways to do this.

In fact there are too many, so I kept it as simple as I could.

Static site generator

I want to write my content in Markdown , I would prefer doing that on my laptop instead of my phone, and I’m ok running commands to publish things.

Which means I can use a static site generator like Hugo to turn my markdown files into HTML.

Hosting

One of the best parts about using a static site generator is that it makes hosting simpler.

Once you have generated a static site you can upload the files to a web host and you’re done.

And you can automate it, so all you do is update it and it gets deployed automatically.

GitHub pages

I host copies of my code on GitHub so that others can view the source and I was planning on doing the same with my site.

This meant I could use one of GitHub’s other features, which is free hosting for static content .

All I would need to do is add a workflow for GitHub Actions to perform each time the code gets updated and the site gets deployed automatically.

IndieMark

There’s no official measure of a site’s “IndieWebness” but the closest right now is the still-in-development IndieMark which would score me a level 1.

Level 0 involves owning your own domain, something I have written about before , and having a personal site at that domain.

Level 1 involves:

• identity, I’ll be using this at my primary domain
• authentication using rel-me links to my external social network profiles
• posts with permalinks, h-entry markup and other microformats
• searchable by allowing robots to index my site, my content is written in HTML and no JavaScript is required to read it

View source

You can view the source code to see how I’ve abused Hugo and TailwindCSS into creating my own site, hosted on GitHub Pages.

I’ve already got one, so I thought I’d explain how I got it.

Ruler

Years ago I registered my name as my domain.

I’m not a company, so I didn’t want .com, but there weren’t many options, and so to make me “Paul Tibbetts from the UK” I went with .co.uk.

Some time later .uk was made available and to make it fair to the .co.uk owners who wanted to drop the .co you had to also own the .co.uk version to register it, so for a while I owned both.

This was all before the newer extensions like .blog and .dev came out. When they did I considered changing but decided against it.

Registrar

I registered my domain with Heart Internet because that’s who we used at work and I didn’t have any kind of preference.

They don’t expose my personal data when you run a whois query on the domain so I haven’t found a reason to move away from them.

Renewals are £9.99 per year.

Management

For a while I managed the domain using the interface on Heart Internet but since then I’ve moved it to Cloudflare .

To do this I changed the nameservers that the domain uses from Heart Internet’s to Cloudflare’s.

Records

There aren’t that many records right now.

@

The apex domain, as in the bare one without any subdomains (https://paultibbetts.uk), points to a really small landing page I made for myself.

I’ll be redoing this soon so I won’t talk about it yet.

www

I don’t use the www subdomain.

I know there are people who think this is wrong but growing up sharing links with others the moment I discovered you could get rid of it I did and haven’t looked back.

Maybe one day I will revisit this.

micro

micro.paultibbetts.uk is powered by Micro.blog .

I could run my main domain with Micro.blog but I want to have a go at doing that myself.

I followed the Micro.blog guide to set up a custom domain and used a CNAME on my domain to point micro to https://paultibbetts.micro.blog.

Emails

Once upon a time I hosted my own email server.

The company I worked at, Sixth Story, had an email address iwanttowork @ sixthstory that I thought was clever, so I wanted hire @ paultibbetts for myself. Applying for jobs as a web developer I thought it would help me stand out.

Even after all the work though I still found myself using my regular Apple email address because I knew it was more stable, and less likely to get marked as spam, so when Apple announced you can use custom domains with iCloud mail I got rid of my email server and used Apple’s instead.

This means I have some MX and TXT records to allow that to work.

In review

I have always been jealous of others with better domains than me.

Difficult to spell

I have trouble getting people to spell my surname correctly.

I don’t blame them, there’s lots of Bs and Ts, and saying “technically there’s 3 Ts” isn’t helpful when they’re typing the double T towards the end.

Potential fix

Aral’s ar.al domain is much better than mine. It’s short and easy to spell.

Maybe I could find a short domain and set it up to redirect?

Time for another disappointing trip to IWantMyName to see all the good domains have been taken.

Did you mean the other one?

I share a name with someone way more famous than me.

It’s spelt a little different but search engines will assume you meant the other Paul.

Potential fix

There are a few ways I can improve my search engine rankings.

I’m going to try writing lots of content to go on my domain, hoping that does it.

I will not do what the other guy did.

dot UK

My .uk address works whilst I live here but it wouldn’t if I moved.

Potential fix

I don’t have any immediate plans to move abroad so I’m not too concerned with this.

If I ever did I can setup redirects.

Not a cool internet name

Jeremy Keith’s adactio.com domain regularly reminds me I’m not creative enough to come up with a cool internet name.

Potential fix

Maybe another decade of thinking about it will help.

Reposted

This was originally posted on my microblog before this site existed and I wanted a copy of it here.

I’ve been a believer for over a decade.

Here’s why.

I own my data

I used to use the social networks. They’d make money from me being there, and that was my price of admission. Everybody did it. It was normal.

Except it isn’t normal, and it shouldn’t be thought of as normal.

We gave up our ownership for ease of use, and I think that’s wrong.

The IndieWeb puts content ownership first.

I am better connected

Since Musk bought Twitter I haven’t been able to view any tweets on my phone. It complains about me using an adblocker and refuses to load the page, even though I’m not using one.

I left Instagram before they stopped letting you include links in your posts.

And I’ve ran out of free Medium articles to read this month, so I can’t read your latest post on that platform.

But I’ve never had a problem using other people’s personal sites.

Everyone else being on the IndieWeb helps me, so I do the same for them.

I am in control

On the IndieWeb it’s up to me to choose how I’m represented online and what gets made available.

Which is how the web should be.

I want the web to be more open

The web was built on openness. Anyone could publish a page and send it to others.

Since then it’s consolidated into a handful of platforms that dictate how things happen and how posts get seen, if they get seen at all.

Which means the IndieWeb is more than having your own site, it’s a movement, to restore the web’s original promise: to be a network that connects people.

If you agree

Here’s how you can join in .

Dotfiles

Dotfiles are the files on your system that are hidden by default, which is done by adding a . in front of the name, hence “dotfiles”.

They’re used for settings and preferences and between them they configure your system just the way you like it. They are arguably the most important part of a developer setup.

Lots of developers will store their dotfiles on GitHub, and GitHub has a little site telling you why and how to do so.

But they aren’t enough to setup the whole system. What use is a dotfile that tells Git I want to use a certain tool for looking at diffs if that tool isn’t even installed?

So together with my dotfiles are my setup scripts. They install the tools that the dotfiles reference and then they install the dotfiles. Between them my developer environment is prepared and ready to use.

Sharing on GitHub

I’ve pushed my setup scripts up to GitHub. This is both a backup, in case I lose my local copy, and also part of the installation process.

If I had to setup a new machine from scratch I can download the install script from GitHub and use it to install the rest of the scripts. The script itself pulls other files down from GitHub, so it needs to be publicly available for me to do that.

But I also did it because I learnt so much about setting up my developer environment from other people sharing their setups and I wanted to do the same.

Usually it’s just the code itself that’s shared, since most devs will skip the readme and go straight to the code, but I added a little website as an experiment.

Digital Garden

The main reason I created a website for my scripts was to test out Astro and Starlight for creating documentation sites. It was pretty easy, and I liked the result, so I will most likely use them for something like this again in the future.

The other reason was to plant a seed in my digital garden.

Digital gardens are a bit like blogs, except they aren’t usually sorted by date. They’re more like notebooks that you share publicly. You might even go back to your notes and refine them over time, growing them from seedlings to full blown… idea bushes? I don’t know what to call them. Some people call them trees, which can grow fruit. That sounds good. Let’s go with that.

So the site is a seedbed in my digital garden. It’s a place for me to share my notes on developer environment setups and dotfiles and stuff. It’s not a project I want other people to use, in fact I’ll probably write up what the alternatives are and which one you should pick instead of mine.

Seedling 🌱

If you’re curious you can check it out .

It’s just a seedling right now, but who knows, maybe I can grow it into something fruitful.

So here’s my first post joining in with an IndieWeb Carnival; Take Two.

Regrets?

Right off the bat I’ll say yes, there are plenty of things I’d have liked a second take at.

I don’t see this as bad, to me this is growth. Looking back on something and seeing how you could have done it better shows wisdom and maturity.

It’d be easy to get stuck here though, wallowing in sadness and longing for what you could have had, so you have to accept it as take one and move on, which is the theme I’ll be sticking with for this post.

Take Two with Tech

I have a friend who wants to get into tech. They’ve tried before, and it didn’t stick, so this is their take two, and I want to let them know I’m proud of them for coming back.

It isn’t easy changing careers, or even considering it, when you have bills to pay and a lifestyle to maintain, but with tech it’s possible.

I’d even say a second take in tech is encouraged. Let’s look at Apple for a second. They didn’t invent the MP3 player, but they had a very popular second take on it.

First impressions matter and all that, but I think what counts in tech is the second take, and then the third, and all the improvements that reveal themselves with each iteration. My dad would probably include a reference here to WD-40 and the 39 complete and utter failures that came before it.

Personal Takes

You’re reading this on take seven two of my blog, something that could have been running for 10 years if I had stuck at it when I started it.

I’m no better with microblogging , which constantly feels like take two for me. My “how I got my website online” series stalled after the first post and needs redoing.

This week I am finishing off some work I started last week. It was only meant to take a few days, but I didn’t know what I was doing, so I had to make something just to find out what it was I was meant to be making in the first place.

All this whilst taking a second break from work. I tried it last year, went back to my job and then proceeded to burn myself out all over again.

So here I am, a year later, Taking a Break From Work and Switching Things Up: Take Two.

Kaizen (改善)

So it’s on to the next iteration.

And then the next.

As long as I’m continuously learning, always aiming to do better, that’s ok with me.

Cloud

The biggest problem with my homelab was that I kept breaking it.

I couldn’t get used to using mealie as a meal planner because I would go to use it and it didn’t work. Or it did, but I couldn’t connect to it properly. Or something else went wrong.

So for my first “release” I aimed for a “cloud”. Some people call it “HomeProd”.

I used things I was used to, and a few things I wasn’t, to make a simple, stable platform on which I could host my actual homelab.

Here’s what’s in it:

NAS

I have a machine dedicated to running TrueNAS Scale .

I bought the hype that I needed ECC RAM so that my data would be safe and so I also needed a server-grade processor, which meant a server-grade motherboard, and all the other bits to go with it.

At the time Scale had built-in Kubernetes so I used TrueCharts to set up some apps. And then they stopped working. And then there were all the updates with breaking changes. And then I got fed up.

This was meant to be a machine that did storage and I didn’t want to mess with it.

The TrueNAS devs thought the same thing and took out Kubernetes and replaced it with Docker, so I updated to follow and now I only run two storage apps on it.

Usage

• file storage over NFS to Linux and Mac and SMB for Windows
• object storage via MinIO installed as a Docker container
• backups for virtual machines via Proxmox Backup Server

and nothing else.

I just want it to do network attached storage, and I don’t want to mess with it.

Storage

• 2 NVME for 4TB of fast storage
• 1 SSD for 500GB internal storage
• 4 HDD RAIDZ2 for 10TB of slow storage

NUC

After getting burned trying to do server things on my NAS I looked for a replacement and found the Turing Pi , and then in true Kickstarter fashion it got delayed, and then delayed again.

I impatiently bought an Intel NUC.

I could have installed Linux on it and used it as a server but I wanted to use Terraform for Infrastructure as Code, so instead I installed Proxmox VE and used Terraform to create the virtual machines and LXC containers I needed with code.

This meant I could get some practise in using Ansible to configure things and try out K3s to run Kubernetes.

Usage

• compute for running services and apps
• experience using Proxmox
• practise using IaC with Terraform and Ansible
• a place to try out Kubernetes stuff
• a better GPU than the NAS for Jellyfin to use for transcoding

Services

• Pi-hole for blocking adverts as well as DNS and DHCP for my network
• Wireguard for a VPN so I can connect from out the house
• MySQL and Postgres databases for “cloud” things to use
• Caddy as a reverse proxy to provide access to my “cloud” apps and services
• Gitea for storing my git repositories
• Jellyfin to watch my own media content

Apps

• Mealie for recipe management and meal planning
• FreshRSS for my RSS clients to sync from

DeskPi

The last part of my “cloud” is the Raspberry Pi 4 I have on my desk.

(I named it before I heard about the company with the same name)

I had future plans for it, since it’s sat on my desk, so I installed the desktop version of Ubuntu and hooked it up to my second screen.

Then I installed Uptime Kuma on it to monitor all my services and apps.

Apparently I cheaped out when I bought it and got the 2GB version, so it’s really really slow and struggles with showing the dashboard.

I’ve been looking for a good excuse to buy a Raspberry Pi 5 but technically this works, so for now it can stay.

Lab

Now that the stable self-hosted part is out of the way I’m going to leave it alone and use something else for the new ideas.

My Turing Pi 2.5 has finally arrived, along with its case, 3 x RK1 compute modules and 3 x 1 TB NVME drives. I’m planning on using it as a cluster to run Kubernetes and potentially host my own website, but we’ll see about that.

Right now it’s on the bench in the lab.

Using both of them together, with a dynamic inventory to link them, has been technically possible for years but never obvious enough for me to work out.

Until I found the Terraform provider.

Ansible provider for Terraform

By using the Ansible provider you can teach Terraform what an Ansible inventory entry would look like next to the rest of its code.

You start by defining the provider:

terraform {
  required_providers {
    ansible = {
      source  = "ansible/ansible"
      version = "1.3.0"
    }
  }
}

and then you can define the Ansible inventory entry right next to the resource:

resource "proxmox_vm_qemu" "gitea" {
  cores = 1
	...
}

resource "ansible_host" "gitea" {
  name   = proxmox_vm_qemu.gitea.ssh_host
  groups = ["gitea"]
  variables = {
    ansible_user = "ansible"
  }
}

which means you don’t need to hardcode IP addresses anywhere.

You would need to terraform apply this plan so that Terraform adds these resources to the state file so that Ansible can use them.

Terraform plugin for Ansible

On the Ansible side you use a plugin to tell it how to use Terraform as its inventory.

Add the following to your requirements.yaml file:

collections:
  - name: cloud.terraform
    version: 1.1.0

and then install the collection using ansible-galaxy collection install -r requirements.yaml,

then create an inventory.yaml with the following content:

plugin: cloud.terraform.terraform_provider
# project_path: ../terraform # if your Terraform code is in a different directory
# state_file: mycustomstate.tfstate # if you wanted to define which state file

and set it as the default inventory in ansible.cfg:

[defaults]
inventory = inventory.yaml

You can confirm the plugin works by doing:

ansible-inventory --graph

which should return something like the following:

@all:
  |--@ungrouped:
  |--@gitea:
  |  |--192.168.1.211

🎉

What’s good about this is now you can be hands-off with IP addresses.

Terraform can request a new machine, wait for it to receive an IP address and then make it available for Ansible to use, without you needing to do anything.

Remote state

The Ansible plugin will default to using whichever backend you use for the Terraform state file, whether that’s local or in an S3-compatible location.

This means Ansible is always running against the current infrastructure, which helps when colleagues and automations are updating things a hundred thousand times a day.

In Conclusion

Using Terraform and Ansible together can cover all aspects of Infrastructure as Code.

The Ansible provider lets you keep all your resource code together in Terraform and then makes it available to Ansible, which uses a plugin to let it use the state file as its inventory.

What’s a homelab?

A homelab is a personal setup of computer stuff that some of us spend way too much time and money on.

Why would I want one?

Here’s a few reasons:

Learning

The biggest reason I wanted a homelab was for learning. I can get hands-on experience with tech I wouldn’t normally use, and as a DevOps Engineer that often ends up being useful at work.

Applications

There are loads of open source apps you can run for free at home.

You can block adverts , run your own Netflix and plenty more .

Services

You could backup your devices and centralise storage with a NAS, then setup a VPN and connect to it from anywhere.

How do I get one?

The biggest thing I want you to take away from this is that you already have one.

the homelab was inside you all along

Pretend for a moment you’re a mad scientist, hacking away at some computery stuff. There are several blinking lights and a faint computery hum fills the air.

What kind of computery stuff did you imagine?

Did it involve loads of blinky lights? You might be interested in networking. I bought a Ubiquiti switch and it’s way blinkier than my old one. It’s also 10 times faster.

Did you see yourself coding? Maybe you could setup your own git server, add on CI/CD and get your apps hosted on your own network. That’s what I’m doing.

Or maybe you want to try out AI on your own hardware?

Whatever it is, you can probably get started right now with the things that you already have. You don’t need to go and buy anything just yet. Start acting like a mad scientist doing computery stuff and eventually you’ll become one.

When I wanted to learn about Docker images I used my own laptop. Then when I was given a Raspberry Pi I tested out running Docker images on that and so my homelab doubled in size.

I didn’t realise it was called a homelab at the time. I was just doing computery stuff.

My Homelab v0

Macbook Pro (2012)

Raspberry Pi 1

Notebook

Pen for writing it all down, otherwise it’s not science.

There were also a few real technical difficulties starting a blog, which were more frustrating because usually I was the one who had caused them, but they were fixed pretty quickly.

No, the biggest problem came instead from me, not getting past the awkward part and making it a regular habit.

I made a slight effort earlier this year publishing a “plan” on Micro.blog but apparently it wasn’t the right time and I didn’t follow it up.

I was already aware of it, and making an effort to fix it, but I was burnt out.

What I didn’t write in my “plan” was that I would be taking some time off work for a while to recover. It’s not like I was stuck in bed, unable to move, but I had lost interest in coding and computers, which isn’t great when that’s what you do for money.

So I handed in my notice and took a break.

Two months later and I’m definitely feeling better.

The fact you are reading this at all is a testament to my newly rediscovered ability to sit down at a computer and not hate it.

I’ve also had the time to work on my homelab, on which I’ve made more progress in the last two weeks than I have in the last two years.

So maybe now is a good time to start blogging.