My lab has no Windows in it, and a directory should not be the reason to add some. FreeIPA gave me a Kerberos realm and an internal CA on a thin client, and a DNS migration that took the longest.

Six posts of proxying applications that cannot do SSO. Proxmox speaks OpenID Connect natively, so the right move was to get out of the way, and small disagreements made that harder.

Last post I deleted an application login and let the proxy gatekeep. This one keeps its login, and making the proxy a real boundary took a firewall rule and a lesson about who else talks to a service.

Tautulli has its own login and no way to accept an identity from a proxy. I deleted the account and let authentik be the single gate. Whether that is sensible or reckless depends on your network.

I put my identity provider on the internet through a tunnel, then went looking for where to put an access policy in front of it. The answer is a far smaller surface than I expected.

Thirty lines of nginx boilerplate per service, copied nine times, so any improvement meant nine edits. Caddy does it in two, and writing that up is what made me spot a hop left in cleartext.

Certbot on a timer, a deploy hook, and a Discord webhook whose only job was to tell me when the other two broke. Caddy does that work itself, so I moved the front door and deleted the rest.

Nine self-hosted services, nine login forms, nine passwords in my manager under slightly different names. I put an identity provider in front of all of them on a thin client, and published it to every interface on the box without noticing.

Three hundred dollars a year for Ghost(Pro) to host forty posts, with a members list four rows long and one of them me. I was paying for a CMS to serve what had always been a static site. Moving it to Hugo on Azure Static Web Apps changed not one post URL.

Two firewall changes in one maintenance window. By morning one box pings the gateway, cannot reach the Plex VM, and looks perfectly healthy in UniFi. Routing is fine. It is working from a cache written before I moved the network underneath it.