Larvitz Blog

The useful part of a home automation dashboard is that it hides the plumbing. The screenshot above shows weather, heating, doors, windows, temperature, humidity, air quality, lights, and energy consumption. A light is a light, a thermostat is a thermostat, and a water sensor is either dry or it is about to make my evening substantially worse. Behind that dashboard, however, are three quite different device ecosystems. Most of the apartment uses Zigbee devices from Philips, IKEA, Xiaomi, Sonoff,…

I have a very predictable failure mode when reading the web. I open an interesting article, decide I will come back to it later, and leave the tab open. Then I do the same thing another twenty times. The tabs stop being a reading list and become archaeological layers. Browser bookmarks never fixed this for me. They are good at preserving a URL, but a URL and a title are not enough to answer the question I actually have two weeks later: why did I save this? Read-it-later services answer more of…

Some services do not need PostgreSQL, Redis, an object store, three containers, and a deployment manifest long enough to qualify as literature. Sometimes I need a wiki: a place for notes, runbooks, snippets, and the sort of documentation that is useful precisely because it is not public. DokuWiki fits that job unusually well. It stores pages as plain text files, needs no database, has a mature ACL system, and is available as a regular FreeBSD package. Put it in a Bastille jail and the entire…

Table of Contents Table of Contents The Source The Runbook Dependencies prepare_paste build_masala add_chickpeas serve Post-Incident Notes Every household has one dish that started as an accident and ended up in production. Ours arrived some years ago in a HelloFresh box - yes, the meal-kit subscription, our guilty pleasure phase - as an unassuming chickpea curry. We cooked it once, looked at each other, and knew this thing was not going back into the backlog. The subscription is long gone; the…

Table of Contents Table of Contents At a Glance Architecture The Host pf: Default Deny, Both Directions nginx: A Lazy Mirror with proxy_store The pkg Mirror (Port 8080) The freebsd-update Mirror (Port 80) The Release Mirror (Port 8081) What About Trust? Client Configuration The Proof: 15.0 to 15.1 Over the Mesh The Full Jail Lifecycle Operational Notes Public DN42 Service Lessons Learned C

FreeBSD 15.1-RELEASE was announced on June 16, 2026. If you’re running 15.0-RELEASE, you have a well-defined upgrade path - but the exact steps depend on how your base system is managed. The first question isn’t “which tool should I use?” but “how is my base system installed?” This article follows the official 15.1-RELEASE upgrading instructions, explains the pre-upgrade detection, walks through both supported procedures (distribution-set and packaged-base), and covers the boot-loader update…

The two previous articles in this series covered the things that store your data and the things that run your workloads. This one covers the part that nobody thinks about until it’s three in the morning and the machine won’t come back up: how FreeBSD actually boots, and - more importantly - how to make a bad boot recoverable. This is the third article in the FreeBSD Foundationals series. The first covered Jails, the second covered ZFS. We’re covering the boot process now because everything else…

A while ago I migrated burningboard.net to a multi-jail FreeBSD setup: nginx, Puma, Sidekiq, and the database each in their own jail, with the host doing all the PF and routing. That post ended on the architecture. What it did not cover is the question that matters the morning after you put real users on a thing: is it actually healthy right now, and if it is not, will I find out before they do? This is the observability half of that story. I run a completely separate machine whose only job is…

For the better part of a decade I carried two phones. A personal iPhone 12 in one pocket and a work iPhone SE (2nd gen) in the other, the SE being a pure work device and nothing else. It worked, in the sense that two separate slabs of glass technically do the job. But it never felt right, and it never felt like mine. The problem was not that the iPhones were bad phones. They were fine. The problem is that everything else I touch runs Linux or BSD, and an iPhone is a polite guest in that world…

Let me start with the thing nobody wants to say out loud: IPv6 is not “the future of the internet”. It is the internet. It has been a finished, deployed, standards-track protocol since 1998. Major mobile networks run IPv6-only internally. More than half of the traffic Google sees from many countries is already IPv6. The “future” framing is a comfortable lie we tell ourselves so we can keep treating IPv4 as the default and IPv6 as the weird optional thing the network nerd insists on. So let me…

I moved this February. New city, new apartment, top floor of a building that went up sometime in the 1970s, in the Rheinebene, which for the non-Germans reading this is one of the warmest and most reliably sticky regions in the country. The flat is rented, which matters more than it sounds like it should, and I work from home with a dedicated office. Come the first proper heat of June, that office is the problem child of the whole apartment: small, under the roof, and facing the sun. Air…

The most interesting thing about AI in 2026 is not which frontier model is winning this month. It is that the frontier became a commodity. GPT-5.5, Claude Opus 4.8, GLM-5.1, MiniMax-M3 - these are things I rent through clients and gateways that make switching providers close to a base-URL change. They are very good and almost none of the craft of using them lives in choosing between them. The part with actual craft in it moved somewhere less glamorous: onto the integrated GPU in my laptop. That…

A while back I put RHEL on a ZFS root, declared it cursed, and the homelab VM lived to tell the tale. That one worked, which is the dangerous kind of outcome, because it teaches you the wrong lesson. The wrong lesson is “the kernel does not care what filesystem holds root, so anything is possible if you disable enough checks.” This is the sequel where the kernel reminds me that it absolutely does care, thank you very much, and that “anything is possible” has an asterisk the size of a merge…

Table of Contents Table of Contents The Big Picture What this is, and what it is not The Hardware The vSwitch Fabric Solving the Two-Node Quorum Problem The Overlay Network: VXLAN Firewalling: One OPNsense per Node Replication and Migration Failure Modes Lessons Learned Conclusion References I have written a fair amount on this blog about FreeBSD, jails, and running my own AS. What I have never written about is the layer underneath a good chunk of it: a small Proxmox VE cluster built from two…

Table of Contents Table of Contents The Stack at Rest The Pipeline: Tag, Build, Push, Sign 1. Build 2. Push 3. Sign 4. Deploy Handoff Signature Verification: Design and Current Reality Registry authentication (operational) Host-side cosign verification in the deploy script (operational) Container policy enforcement via policy.json (target state) The Runner in the Same User Context The Deploy Bridge: sy

Table of Contents Table of Contents What mdo Actually Is Enabling mac_do Loader configuration Rule configuration The Rule Language Persisting versus live Day-to-Day Use Where mdo Is Not the Right Tool Optional: The Hardening Block Around It Wrap Almost every FreeBSD install I touch grows a security/sudo or security/doas package within the first ten minutes. It is reflex at this point. The pattern is: install base, create an admin user, pkg install sudo, drop a file in sudoers.d, move on. Modern…

Table of Contents Table of Contents What “Fedora Hummingbird” Actually Refers To Project Hummingbird: the image catalog Fedora Hummingbird Linux: the operating system The agentic framing Why the Model Is Useful The Image Catalog and the Registry Layout Rebuilding mastogreet on Hummingbird Python Array Syntax Everywhere No useradd, Because There’s a User Already Virtual Environment as the Transport Mechanism

Table of Contents Table of Contents What it actually is Why it matters A word on the marketing gap Practical onboarding Closing thoughts Further reading The entire Red Hat documentation site and the full Knowledgebase fit into a single OCI container that updates weekly, runs locally with a web UI and Solr search, and is included in every RHEL subscription that bundles Red Hat Satellite. I have it on my laptop. I use it daily. Almost nobody I talk to knows it exists. That paragraph is the…

If you board a German long-distance train often enough, you stop hoping for punctuality and start engineering around its absence. After three years of regular client travel I have come to think of Deutsche Bahn the way I think of any large distributed system I do not control: it has tail latency, hot shards, monitoring you can subscribe to, retry policies, SLA credits, and a small amount of folk knowledge about which paths through the topology are actually faster than the routing layer claims.…

“The server feels slow.” It is the most common ticket text in the world, and the least useful. Before you can fix anything you need to know whether the box is CPU bound, memory pressured, waiting on disk, saturating a NIC, or simply running a runaway process in one jail that is starving everyone else. On jail hosts, the second half of the problem is attribution: not just what is overloaded, but which jail is responsible. FreeBSD ships with an unusually complete troubleshooting toolkit out of…

Table of Contents Table of Contents What Distrobox Actually Does Why I Use It Multiple Distributions Per-Project Toolchains VSCode Integration is Excellent Atomic Desktops: Mutability Where You Need It What Actually Stays on the Host RHEL Userspace on Fedora A Few Patterns Worth Knowing Exporting Applications and Binaries to the Host Init Files and Reproducible Boxes Btrfs Subvolumes for Per-Box Snapshots

Table of Contents Table of Contents What an Execution Environment Actually Contains Why Containerize Ansible at All The Pieces A Worked Example: An EE for Homelab Automation execution-environment.yml requirements.yml requirements.txt bindep.txt Building It ansible-navigator: Running Plays Against the EE Other Navigator Subcommands Worth Knowing CI: Pinning the Image, Not the Tool Updating an EE

Table of Contents Table of Contents Why Ansible (and Not Just scp Plus systemctl) The Bot in One Paragraph The Container, Briefly The Ansible Layout Step 1: Fail Fast on Missing Configuration Step 2: Host-Side State Directory Step 3: Templated Configuration Step 4: Optional Registry Login Step 5: The Podman Secret Step 6: Generating the Quadlet Step 7: The Handler Chain What You Get

Table of Contents Table of Contents At a Glance What is DN42? Architecture The Registry The MikroTik Border Router Interfaces BGP Filters Firewall MSS Clamping NAT44 and NAT66 The Native DN42 VLAN The FreeBSD Service Jail A RouterOS ND Quirk What This Looks Like From The Outside Lesson

Table of Contents Table of Contents At a Glance Architecture: Four Edges and a Home Router The Fourth Edge: ixbgp at iFog and FogIXP Why a Fourth Edge Network Configuration FRR Configuration PF: Stateless Transit, Stateful Control Plane Direct Peering with Hetzner The Path Before The Path Now What Hetzner Sees What This Buys in Practice Bringing the Home LAN into AS201379

Most configuration management tools still assume they own the target. Ansible ships Python modules over the wire and runs them in place. Salt wants a minion on every host. Chef wants a client, Puppet wants an agent. Jails break that assumption in a satisfying way. A FreeBSD jail is supposed to be small - sometimes a single static binary, an rc.d script, and a few lines in rc.conf. Installing Python into every jail just so Ansible can run its setup module is, to borrow a phrase, the tail wagging…

My Lenovo ThinkPad T14s Gen 4 (AMD Ryzen) shipped with an Intel XMM7560 LTE Advanced Pro modem soldered to the mainboard. Useful little thing: real LTE on the go, no tethering dance, no MiFi puck in the bag. The catch: out of the box, the modem refuses to register on the network. ModemManager dutifully detects it, the SIM is recognised, but on my machine AT+CFUN=1 would come back OK while the radio quietly stayed dark. The reason is something called FCC lock, and the official fix from Lenovo is…