Blog

Building a guestbook meant real security decisions and three genuinely obscure OpenBSD rc.d bugs along the way. Here's the full stack, start to finish.

A single encrypted file, portable enough to copy anywhere, for the handful of things too sensitive to leave sitting around as plaintext.

I ran a full security assessment against my printer to see if the hardening actually held up. Turns out it's relatively secure, for a printer.

Route DNS queries through an existing WireGuard tunnel to keep them off your ISP's radar, no new protocols required.

How I wrapped a WireGuard tunnel inside a TLS WebSocket connection to make it (almost) indistinguishable from DNS over TLS traffic.

How I encrypted and authenticated traffic between my VPS and home server using mutual TLS and self-signed certificates from a private certificate authority.

A collection of hard-learned lessons for running Proxmox in my homelab.

A walkthrough of the OpenBSD installation process; from downloading the image to a working system.

Discover how granular network segmentation can transform a standard homelab into a hardened, high-performance infrastructure.

A deep dive into the architecture behind sandover.ca; from OpenBSD firewall rules to mutual TLS (mTLS) between a VPS and my home server.

Security through simplicity. A novel methodology that I explore, and defend in this blog post.

Route your traffic through a battle-tested, open-source, and more importantly secure VPN soluton.