Posts

During the hot Ferragosto weekend, I decided to take a break and try out Libvirt. It had been on my to-do list for a long time, but I never had the motivation (or maybe just laziness?) to try it as a replacement for VirtualBox. The stack I’m going to use will be, KVM (Kernel-based Virtual Machine) built directly into the Linux kernel to handle CPU and memory virtualization, while QEMU emulates the remaining hardware components like storage and graphics. Libvirt acts as the management layer bridging everything together, allowing me to control my VMs through both a graphical interface (virt-manager) and the command line (virsh). ...

These are my notes explaining on how to run models on an Arch Linux machine using the OpenVINO model server inside a Docker container. My Medion notebook is equipped with both an Intel NPU and an Intel ARC GPU. I tried running models on both. Requirements Install required driver packages: GPU: intel-compute-runtime NPU: intel-npu-driver Add the user to groups render and video: sudo usermod -aG render,video "$USER" To check that everything has been installed on the local machine, run the following code snippet inside a Python virtual environment with the openvino package installed. ...

Since starting to work on my Home Cluster, I have already tried three different deployment strategies for managing workloads. To provide context for the new approach, it is helpful to review how the workflow has evolved. Initially, I used OpenTofu, deploying everything with the helm_release resource from the Helm provider. This was straightforward and fully controlled from the IaC repository. Later, I introduced Argo CD, adopting a hybrid strategy. OpenTofu continued to deploy workloads using the helm_release resource until Argo CD was fully operational; then it created Argo CD applications using the argocd_application resource. While this approach was effective, it resulted in duplication and unnecessary coupling between OpenTofu and Argo CD. ...

After MinIO’s decision to remove all the features from the community edition, I switched to Garage. After the initial deployment test, I quickly realized that many manual steps were required before it could be used. For example, you must create a layout for storing the buckets and then create the buckets themselves. As usual I decided to come up with my overcomplicated solution: Use a Kubernetes job to bootstrap the layout. Create an Admin Garage API token with a K3s job. Use my Terraform Garage provider to deploy buckets. The idea behind my home cluster is that everything should be automated as code and deployed with Argo CD. As I mentioned, I created a bootstrap process to prepare Garage to create buckets. ...

This article will be very similar to Integrate Dnscrypt-proxy with a Home DNS Server, with the main difference that instead of using Dnscrypt-proxy to forward DNS queries to your preferred DoH nameserver, I will use systemd-resolved. At the moment, systemd-resolved only supports DoT (DNS over TLS). Support for DoH is still under development (issue #8639). Configure systemd-resolved Make sure it’s running and that /etc/resolv.conf points to it. sudo systemctl enable --now systemd-resolved Symlink /etc/resolv.conf to the stub resolver: ...

I decided to buy a new laptop so is become the time perform a new installation of Arch, in the past I already installed it from scratch, trying to fine tune every single settings, was really funny but this time I will opt for a more chilly approach and I will use Archinstall. Because I would like to use different technologies I will test my installation first in VirtualBox leveraging the installation over SSH as I explained on a past article Install Arch with SSH ...

For learning purposes, I started looking into IPv6. First, I enabled a Unique local address subnet to leverage K3s dual-stack on my Home Cluster. Then I thought it would be cool to be able to connect to my home from abroad, so I started investigating VPNs. It is at this point that I discovered that my ISP currently is only offering IPv4 behind CGNAT for mobile devices (My Mikrotik connects to internet over LTE. Surfing the web I learned about tunnel broker is a service that provides IPv6 connectivity over an existing IPv4-only internet connection by encapsulating IPv6 traffic inside IPv4 packets. ...

In my K3s home cluster, I use Longhorn as the storage engine for my stateful workloads. Since I’m just starting out and shutting down the cluster every day (to safe my power bill), I’ve noticed that Longhorn takes a long time to be ready, with a messy startup involving a lot of errors and pods going into the CrashLoopBackOff state. Spoiler: It’s always DNS :) Troubleshooting I decided to take a look, so I began my troubleshooting journey by analyzing one of the affected pods. ...

This blog post was initially intended to explain how to migrate from iptables to nftables — there are plenty of similar posts all over the internet. However, I soon realised that I was also running Docker on my laptop, which still does not natively support nftables at the time of writing. I therefore decided to write a dual-aim article: switching to nftables and allowing Docker containers to access the network. Update - 2025-12-07: Docker 29 introduced experimental support for nftables, more details in the page Docker with nftables Update - 2026-08-23: Optimized nftables rules for Docker 29 ...

Why I Did It At first, this was a learning project. I wanted to understand the real nuts and bolts of Kubernetes — not just on paper, but on actual, bare-metal hardware in my home. But over time, it became something more. It became my platform — the place where I host the things I care about, where I experiment, where I break things and fix them again. What I Wanted To learn how things really work under the hood To automate everything — no clicking, no guesswork To host my own services with security and flexibility in mind To power things down when I don’t need them, and boot them up instantly when I do What I Built The stack is simple but powerful: ...