Homelab on Thomas Schwery

DNS as Code with DNSControl

thomas@inf3.ch (Thomas Schwery) — Sat, 03 Oct 2026 18:30:00 +0000

I manage the DNS zones for three domains: inf3.ch, inf3.xyz and schwery.me. They hold the records for my servers, my websites, a few personal services and of course the email. I don’t change them often, maybe a few times a year, and that is exactly the problem: every time, I had forgotten how a record was configured and why. Since 2017, these zones are in a Git repository and are deployed to Amazon Route53 by a GitLab pipeline, so that the history and the reason of each change stay next to the configuration.

A Home Lab on Talos and ArgoCD

thomas@inf3.ch (Thomas Schwery) — Sun, 23 Aug 2026 18:30:00 +0000

Back in 2017 I wrote about my small Kubernetes cluster in OpenFaaS and Kubernetes and Kubernetes Persistent Volumes and RBD. At the time, the nodes were Debian machines that I installed by hand and initialised with kubeadm, and the volumes came from a small Ceph cluster at home. The git repository behind that cluster is still the same one today, with the first commit “Initial import” from September 2017 and about 2900 commits since. Almost everything else has changed.

A WireGuard Hub with Ansible

thomas@inf3.ch (Thomas Schwery) — Sun, 28 Jun 2026 18:30:00 +0000

My machines are spread over a number of places that are all behind some kind of NAT: the home network behind an OPNsense firewall, a Mikrotik router on another site, a Raspberry Pi at the chalet, and the laptops that move around with me. A few years ago I solved the “how do I reach home” question with an SSH access through a Tor Hidden Service. It worked, but it was slow, it only gave me SSH, and only allowed me to connect to a server, not link multiple networks together.

Backup archives migration to Borg

thomas@inf3.ch (Thomas Schwery) — Thu, 21 Nov 2019 18:30:00 +0000

Last weekend I found a number of encrypted hard-drives that were used to do periodic backups from 2006 to 2014. At the time, the backups were made using rsync with hard-links to save only one occurrence of the file if it was not changed since the last backup.

I wanted to check that everything was still there and upgrade this to a Borg repository so that I can profit from compression and deduplication to reduce these backup size further down and store them in a more secure way.

Automatic deployment on AWS S3 and/or FTP

thomas@inf3.ch (Thomas Schwery) — Tue, 24 Sep 2019 18:30:00 +0000

A number of websites I maintain are built and deployed automatically through GitLab pipelines, either on an AWS S3 bucket that is then used by AWS CloudFlare, or to an SFTP server of an hosting provider.

In this article I will summarize the necessary configuration to GitLab-CI and the necessary variables in the CI/CD settings.

Deploy to AWS S3

We first need to inject the credentials necessary for the GitLab runner to GitLab. Go to your project, Settings -> CI / CD -> Secret variables and set two variables:

GitLab runners on Hetzner Cloud

thomas@inf3.ch (Thomas Schwery) — Tue, 10 Sep 2019 18:30:00 +0000

Because my different projects use a lot of pipelines for tests and deployments, I wanted to use the different possibilities of the cloud to reduce the load on my GitLab server and instead run these short-lived containers on other virtual machines.

In this post, I will explain the different steps needed to install a GitLab Runner and the necessary adapter for Docker Machine in a container that can be deployed on your server, configure the runner to launch new Hetzner Cloud servers and deploy a shared cache to centralize the cache storage between theses machines. The configuration presented here is based on the official GitLab container configured and launched through Docker Compose.

SSH access through Tor Hidden Service

thomas@inf3.ch (Thomas Schwery) — Mon, 11 Mar 2019 18:30:00 +0000

I have a number of computers that are connected to different networks, sometimes accessible from the Internet, sometimes behind a NAT that I can configure, sometimes behind NAT that I cannot modify and sometimes behind multiple obstacles.

Recently, I discovered that there is a very easy way of dealing with this: Tor Hidden Services. Usually when we think about Tor, we think about the anonymity part of the network, but it also provides a connection that is unfiltered and thus allow access to our services even if they are behind NAT, have a dynamic IP address or are protected by firewalls.

Kubernetes Persistent Volumes and RBD

thomas@inf3.ch (Thomas Schwery) — Sun, 03 Dec 2017 15:00:00 +0000

Since the number of stuff I’m deploying on my small Kubernetes cluster is increasing and manually managing the volumes is beginning to be a pain, I decided to start learning about the Storage Classes, Persistent Volumes and Volume claims.

Even if at first it seems to be intimidating, it was really easy to integrate them with my small Ceph cluster that I also play with.

Ceph

On the Ceph side, the configuration consists of creating a new pool and user that will be used by our Kubernetes cluster.

OpenFaaS and Kubernetes

thomas@inf3.ch (Thomas Schwery) — Sun, 27 Aug 2017 18:30:00 +0000

Recently there has been a lot of news about OpenFaaS and I wanted to try it out. As the rest of my tests have been done on Kubernetes, I looked more closely to the FaaS-Netes.

Everything here was done on a local minikube deployment and using my test Docker registry deployed on a server in the local network.

Deployment

The first deployment was really easy. Once minikube is operational, it’s only two commands to deploy everything needed : git clone https://github.com/alexellis/faas-netes and then kubectl apply -f ./faas.yml,monitoring.yml,rbac.yml.

Ubiquiti Unifi at home

thomas@inf3.ch (Thomas Schwery) — Sun, 20 Aug 2017 18:00:00 +0000

I have been using the same router with OpenWRT installed for now 8 years and recently my network was beginning to become somewhat insufficient. I have a number of servers in my home, a number of mobile devices connected by Wifi and the router is in the living room whereas we both have a desktop computer on an another floor, without cabled network in the home.

Until now, the network was using a single router in the living room, a Devolo dLAN650+ to distribute the network both to the servers in an another room and to the office. It worked well in our small appartement but now that we are living in a house and the office is upstairs, the power network in the house is split and the connectivity between the living room and the office is insufficient and connecting every device using the Wifi grinds the network to a halt for some reason.

Now with OwnCloud

thomas@inf3.ch (Thomas Schwery) — Tue, 07 Feb 2012 18:43:05 +0000

After a long pause in this blog, I just updated the broken edition method. Before, the only method to add new notes in this blog was using SVN, which was broken when I migrated to Mercurial.

Now, I shared a folder with WebDAV, using ownCloud so that I can access these notes from anywhere using either a mounted folder in my home directory or the online interface.

As soon as an entry is added or modified, a small watch script launch a blog recompilation :