Lexicanum

Notes and references on the stuff I actually run. Each entry is a deep-dive: implementation steps, real configs, the failure modes I hit along the way. Guides are task-sequenced how-tos; reference docs explain how a system works and which option to pick. / searches everything.

Supabase

Where tenants live, what they cost, and how to move them - the largest cluster here.

Migrate a Supabase project to another region, end to endLogical replication cutover with measured downtime.

Running many tenants on one Supabase projectRLS isolation on a claim the tenant cannot write, with the tests that prove it holds.

Cloudflare Workers + Supabase: an architecture referenceWorkers at the edge, Supabase behind it - the canonical exemplar of the house style.

Supabase disaster recovery tiers: daily backups, PITR, warm standby - RPO, RTO, and costDaily backups vs PITR vs warm standby, on one RPO/RTO/cost axis - plus the billing restriction that takes the whole org down.

Supabase incidents: what a client can actually do - a resilience referenceIncident classes, client-side workarounds, and the measured numbers behind each - including a warm standby with portable sessions.

Where should a tenant live: one Supabase project per tenant, or manyThe placement decision and the cost model behind it.

All Supabase docs (23)

• Build a public-record entity graph on managed Postgres
• Consolidating one Supabase project per customer onto a shared project
• Migrate a Supabase project to another region, end to end
• Migrating a static MongoDB archive into Postgres with the Supabase MongoDB wrapper
• Migrating PBKDF2 password hashes into Supabase Auth
• Monitor Supabase with Grafana: dashboards and alerting
• Moving Supabase projects under one organization
• Promoting a tenant to its own Supabase project
• Running many tenants on one Supabase project
• Set up AWS PrivateLink to Supabase with OpenTofu
• Supabase preview-branch compute sizing & a CI parity model
• Supabase resilience runbook: probes, TTL levers, edge cache, warm standby
• Trusted-device MFA and impersonation audit trails on Supabase Auth
• Upgrade a Supabase project to a new Postgres major version, end to end
• AWS PrivateLink to Supabase: an architecture reference (reference)
• Cloudflare Workers + Supabase: an architecture reference (reference)
• Entity graphs on managed Postgres (reference)
• Stripe Sync Engine: schema projection, version drift, and the FDW alternative (reference)
• Supabase data residency and sovereignty (reference)
• Supabase disaster recovery tiers: daily backups, PITR, warm standby - RPO, RTO, and cost (reference)
• Supabase incidents: what a client can actually do - a resilience reference (reference)
• What a Supabase platform operation costs a client (reference)
• Where should a tenant live: one Supabase project per tenant, or many (reference)

Cloudflare

Workers, caching, tunnels, and the WAN - the edge provider half of the estate.

Magic WAN and its interoperabilityInterop with the IPsec/GRE estate, MTU/MSS arithmetic included.

Setting up Cloudflare Tunnel on Google Cloud RunPrivate ingress to a serverless container.

Caching with Cloudflare Workers: when to use whatCache API, Cache Rules, and KV - the decision criteria.

We have fraud detection at homeRandom Forest email classification, TLS fingerprinting, and weighted risk scoring on Workers.

All Cloudflare docs (6)

• GitHub Actions with Cloudflare
• Magic WAN and its interoperability
• Securing kubectl with Cloudflare Access for SaaS
• Setting up Cloudflare Tunnel on Google Cloud Run
• Caching with Cloudflare Workers: when to use what (reference)
• We have fraud detection at home (reference)

Kubernetes

k3s on ARM64: deployment, ingress, and observability.

ARM64 k3s cluster operations: Turing Pi, node management, and recoveryNode management and recovery on a Turing Pi cluster.

Full observability stack on k3s: Prometheus, Loki, Jaeger, Grafana, and Cloudflare LogpushPrometheus, Loki, Jaeger, Grafana, and Cloudflare Logpush.

Traefik on k3s: custom deployment, plugins, middlewares, and Cloudflare TunnelCustom deployment, plugins, middlewares, and Cloudflare Tunnel.

All Kubernetes docs (3)

• ARM64 k3s cluster operations: Turing Pi, node management, and recovery
• Full observability stack on k3s: Prometheus, Loki, Jaeger, Grafana, and Cloudflare Logpush
• Traefik on k3s: custom deployment, plugins, middlewares, and Cloudflare Tunnel

Networking and DNS

The self-hosted edge and the resolvers behind it.

Caddy reverse proxy with Coraza WAF and management dashboardThe self-hosted edge: WAF, dashboards, and the deploy pipeline.

Gloryhole DoT DNS service interop with Magic WAN and VyOSRunning a DoT service across the WAN and the router.

Recursive DNS on GL-MT3000: Unbound behind AdGuard HomeA travel router as a recursive resolver.

All Networking and DNS docs (3)

• Caddy reverse proxy with Coraza WAF and management dashboard
• Gloryhole DoT DNS service interop with Magic WAN and VyOS
• Recursive DNS on GL-MT3000: Unbound behind AdGuard Home

Homelab and self-hosting

The services that run on the home network, and the network they run on.

Multi-site Vaultwarden: PostgreSQL, R2 sync, and Cloudflare load balancer failoverPostgreSQL, R2 sync, and Cloudflare load balancer failover.

Docker Servarr stack security: hardening media automationHardening the arr stack without breaking it.

Monitoring a self-hosted stack behind a policy-drop edgeWhat observability looks like when the firewall defaults to drop.

Tailscale homelab reference: overlay as second path and management planeNixOS authkey provisioning, multi-path SSH aliases, and the failure modes that happened.

All Homelab and self-hosting docs (10)

• Add Prometheus monitoring to a Compose Postgres stack
• AirGradient ONE on ESPHome, fully local
• Multi-site Vaultwarden: PostgreSQL, R2 sync, and Cloudflare load balancer failover
• Self-hosting Matrix + Element Call on k3s with Cloudflare and VyOS
• Singapore weather alerts and live maps with Home Assistant and Grafana
• Docker Servarr stack security: hardening media automation (reference)
• Home IoT: an ESPHome fleet on a Flint-bridged VLAN (reference)
• Media transformation architecture (reference)
• Monitoring a self-hosted stack behind a policy-drop edge (reference)
• Tailscale homelab reference: overlay as second path and management plane (reference)

Workstations and tooling

Hardware tuning and the tooling around the machines.

Creating QMK, VIA, and Vial keymapsKeyboard firmware from source to flashed keymap.

Extending your Terraform configuration with the http providerCalling the underlying API directly when the provider falls short.

Tuning a USB4 10GbE adapter on WindowsGetting real 10GbE out of a USB4 adapter - the exemplar guide.

A cross-client memory store for coding agentsOne Postgres for every agent client's session history, and the lessons from seeding 640k messages.

All Workstations and tooling docs (7)

• Creating QMK, VIA, and Vial keymaps
• Extending your Terraform configuration with the http provider
• Reclaiming disk space from WSL2 and Docker Desktop
• Setting up Steam Deck (Steam OS) with Nix
• Tuning a USB4 10GbE adapter on Windows
• A cross-client memory store for coding agents (reference)
• Benchmarking local models for agent work (reference)

Contributing

Every page has an Edit this page link in the right rail that opens the source on GitHub. PRs welcome.