Lexicanum
Notes and references on the stuff I actually run. Each entry is a deep-dive: implementation steps, real configs, the failure modes I hit along the way. Guides are task-sequenced how-tos; reference docs explain how a system works and which option to pick. / searches everything.
Supabase
Where tenants live, what they cost, and how to move them - the largest cluster here.
Migrate a Supabase project to another region, end to endLogical replication cutover with measured downtime.
Running many tenants on one Supabase projectRLS isolation on a claim the tenant cannot write, with the tests that prove it holds.
Cloudflare Workers + Supabase: an architecture referenceWorkers at the edge, Supabase behind it - the canonical exemplar of the house style.
Supabase incidents: what a client can actually do - a resilience referenceIncident classes, client-side workarounds, and the measured numbers behind each - including a warm standby with portable sessions.
Where should a tenant live: one Supabase project per tenant, or manyThe placement decision and the cost model behind it.
All Supabase docs (22)
- Build a public-record entity graph on managed Postgres
- Consolidating one Supabase project per customer onto a shared project
- Migrate a Supabase project to another region, end to end
- Migrating a static MongoDB archive into Postgres with the Supabase MongoDB wrapper
- Migrating PBKDF2 password hashes into Supabase Auth
- Monitor Supabase with Grafana: dashboards and alerting
- Moving Supabase projects under one organization
- Promoting a tenant to its own Supabase project
- Running many tenants on one Supabase project
- Set up AWS PrivateLink to Supabase with OpenTofu
- Supabase preview-branch compute sizing & a CI parity model
- Supabase resilience runbook: probes, TTL levers, edge cache, warm standby
- Trusted-device MFA and impersonation audit trails on Supabase Auth
- Upgrade a Supabase project to a new Postgres major version, end to end
- AWS PrivateLink to Supabase: an architecture reference (reference)
- Cloudflare Workers + Supabase: an architecture reference (reference)
- Entity graphs on managed Postgres (reference)
- Stripe Sync Engine: schema projection, version drift, and the FDW alternative (reference)
- Supabase data residency and sovereignty (reference)
- Supabase incidents: what a client can actually do - a resilience reference (reference)
- What a Supabase platform operation costs a client (reference)
- Where should a tenant live: one Supabase project per tenant, or many (reference)
Cloudflare
Workers, caching, tunnels, and the WAN - the edge provider half of the estate.
Magic WAN and its interoperabilityInterop with the IPsec/GRE estate, MTU/MSS arithmetic included.
Setting up Cloudflare Tunnel on Google Cloud RunPrivate ingress to a serverless container.
Caching with Cloudflare Workers: when to use whatCache API, Cache Rules, and KV - the decision criteria.
We have fraud detection at homeRandom Forest email classification, TLS fingerprinting, and weighted risk scoring on Workers.
All Cloudflare docs (6)
Kubernetes
k3s on ARM64: deployment, ingress, and observability.
ARM64 k3s cluster operations: Turing Pi, node management, and recoveryNode management and recovery on a Turing Pi cluster.
Full observability stack on k3s: Prometheus, Loki, Jaeger, Grafana, and Cloudflare LogpushPrometheus, Loki, Jaeger, Grafana, and Cloudflare Logpush.
Traefik on k3s: custom deployment, plugins, middlewares, and Cloudflare TunnelCustom deployment, plugins, middlewares, and Cloudflare Tunnel.
All Kubernetes docs (3)
Networking and DNS
The self-hosted edge and the resolvers behind it.
Caddy reverse proxy with Coraza WAF and management dashboardThe self-hosted edge: WAF, dashboards, and the deploy pipeline.
Gloryhole DoT DNS service interop with Magic WAN and VyOSRunning a DoT service across the WAN and the router.
Recursive DNS on GL-MT3000: Unbound behind AdGuard HomeA travel router as a recursive resolver.
All Networking and DNS docs (3)
Homelab and self-hosting
The services that run on the home network, and the network they run on.
Multi-site Vaultwarden: PostgreSQL, R2 sync, and Cloudflare load balancer failoverPostgreSQL, R2 sync, and Cloudflare load balancer failover.
Docker Servarr stack security: hardening media automationHardening the arr stack without breaking it.
Monitoring a self-hosted stack behind a policy-drop edgeWhat observability looks like when the firewall defaults to drop.
Tailscale homelab reference: overlay as second path and management planeNixOS authkey provisioning, multi-path SSH aliases, and the failure modes that happened.
All Homelab and self-hosting docs (9)
- Add Prometheus monitoring to a Compose Postgres stack
- AirGradient ONE on ESPHome, fully local
- Multi-site Vaultwarden: PostgreSQL, R2 sync, and Cloudflare load balancer failover
- Self-hosting Matrix + Element Call on k3s with Cloudflare and VyOS
- Docker Servarr stack security: hardening media automation (reference)
- Home IoT: an ESPHome fleet on a Flint-bridged VLAN (reference)
- Media transformation architecture (reference)
- Monitoring a self-hosted stack behind a policy-drop edge (reference)
- Tailscale homelab reference: overlay as second path and management plane (reference)
Workstations and tooling
Hardware tuning and the tooling around the machines.
Creating QMK, VIA, and Vial keymapsKeyboard firmware from source to flashed keymap.
Extending your Terraform configuration with the http providerCalling the underlying API directly when the provider falls short.
Tuning a USB4 10GbE adapter on WindowsGetting real 10GbE out of a USB4 adapter - the exemplar guide.
A cross-client memory store for coding agentsOne Postgres for every agent client's session history, and the lessons from seeding 640k messages.
All Workstations and tooling docs (6)
Contributing
Section titled “Contributing”Every page has an Edit this page link in the right rail that opens the source on GitHub. PRs welcome.