Lexicanum

Notes and references on the stuff I actually run. Each entry is a deep-dive: implementation steps, real configs, the failure modes I hit along the way. Guides are task-sequenced how-tos; reference docs explain how a system works and which option to pick. / searches everything.

Supabase

Where tenants live, what they cost, and how to move them - the largest cluster here.

Migrate a Supabase project to another region, end to endLogical replication cutover with measured downtime.

Per-project cost attribution on SupabasePer-project cost attribution on a single-org bill: the invoice settlement layer, the hourly estimator, and gateway metering - measured, not quoted.

Running a platform on the Supabase Management APIProvision, size, meter, and operate tenant projects through the Management API, measured against the live API on 2026-08-17/18.

Running many tenants on one Supabase projectRLS isolation on a claim the tenant cannot write, with the tests that prove it holds.

Cloudflare Workers + Supabase: an architecture referenceWorkers at the edge, Supabase behind it - the canonical exemplar of the house style.

Edge Function limits, one ceiling at a timeWhich Edge Function ceiling bit - count, size, secrets, runtime - and the deploy failures that only look like one.

RLS policy cost, measuredPolicy shape decides plan shape. Measured: the (select auth.uid()) wrap, index interaction, nested EXISTS policies, grant targets, and client filters.

RLS without Supabase Auth: JWT claims over the wireRLS is a Postgres feature - set request.jwt.claims yourself over the wire and per-user policies keep working with your own auth.

Supabase Auth end to end: tokens, trust, and what you can take in-houseEvery auth finding in one place: keys and verification, refresh, third-party issuers, claims and RLS, portability, lockdown levers, and a self-hosted GoTrue on a managed project.

Supabase compute and disk sizingCompute sizes and disk mechanics, end to end: per-size limits, autoscale defaults, the modification quota, read-only triggers - and the parts that are dashboard-only or disagree with the docs.

Supabase disaster recovery tiers: daily backups, PITR, warm standby - RPO, RTO, and costDaily backups vs PITR vs warm standby, on one RPO/RTO/cost axis - plus the billing restriction that takes the whole org down.

Supabase incidents: what a client can do - a resilience referenceIncident classes, client-side workarounds, and the measured numbers behind each - including a warm standby with portable sessions.

Where should a tenant live: one Supabase project per tenant, or manyThe placement decision and the cost model behind it.

All Supabase docs (68)

Cloudflare

Workers, caching, tunnels, and the WAN - the edge provider half of the estate.

Magic WAN and its interoperabilityInterop with the IPsec/GRE estate, MTU/MSS arithmetic included.

Setting up Cloudflare Tunnel on Google Cloud RunPrivate ingress to a serverless container.

Caching with Cloudflare Workers: when to use whatCache API, Cache Rules, and KV - the decision criteria.

We have fraud detection at homeRandom Forest email classification, TLS fingerprinting, and weighted risk scoring on Workers.

All Cloudflare docs (7)

Kubernetes

k3s on ARM64: deployment, ingress, and observability.

All Kubernetes docs (3)

Networking and DNS

The self-hosted edge and the resolvers behind it.

A XikeStor SKS8300 switch on OpenWrt: flash, config as code, and the way back to stockFlashing a XikeStor SKS8300 switch to OpenWrt, and running it as config in git.

Recursive DNS on GL-MT3000: Unbound behind AdGuard HomeA travel router as a recursive resolver.

knotea: one binary that is both your recursive resolver and your authoritative DNSAuthoritative for your zones, recursive for everything else, ad-blocking on the way - one Go binary.

All Networking and DNS docs (8)

Homelab and self-hosting

The services that run on the home network, and the network they run on.

Migrating a NAS without losing a byte: bulk-data moves with migctlA gate you cannot pass until the copy is provably complete, run before the source drives are wiped.

Declarative backups on a ZFS homelab: nix timers, sanoid, syncoidThree mechanisms, one matrix, and the container running cron that failed silently.

Docker Servarr stack security: hardening media automationHardening the arr stack without breaking it.

drawbridge: an mTLS-gated, route-allowlisted proxy for the Docker socketRoot-equivalent API, so the boundary is mTLS plus an allowlist - with an audit line per request.

Hot vs bulk: placing app state on a two-tier ZFS homelabNon-redundant NVMe or redundant HDD - the per-service call, and why 'appdata' means one thing.

Monitoring a self-hosted stack behind a policy-drop edgeWhat observability looks like when the firewall defaults to drop.

Tailscale homelab reference: overlay as second path and management planeNixOS authkey provisioning, multi-path SSH aliases, and the failure modes that happened.

Three NixOS hosts, one deploy interfaceThree NixOS hosts on a library flake, and the incident behind each deploy convention.

ZFS on NixOS: who owns the mountTwo mount managers, one mountpoint. Which one wins decides whether a rebuild survives.

All Homelab and self-hosting docs (28)

Forge and CI

The self-hosted Forgejo forge: repositories, Actions runners, releases, and the deploys they trigger.

Porting a GitHub Actions workflow to Forgejo ActionsMoving this site's build-and-deploy workflow from GitHub Actions to a self-hosted Forgejo runner, and every difference that broke a run.

Where Forgejo's data lives: storage, backups and cachesSix kinds of data, three protection mechanisms, and a command that silently does nothing if you run it after the config switch.

All Forge and CI docs (9)

Secrets

Where credentials live, how they are encrypted, rotated, and kept out of agent transcripts.

Keeping credentials out of coding-agent transcriptsA coding agent printed a token twice in one day. Patterns could not have stopped it; a registry of where secrets live did.

All Secrets docs (7)

Hardware design

Designing, ordering and bringing up open hardware: the GRIDDLE LX Hall-effect keyboard series.

All Hardware design docs (5)

Workstations and tooling

Hardware tuning and the tooling around the machines.

Creating QMK, VIA, and Vial keymapsKeyboard firmware from source to flashed keymap.

Extending your Terraform configuration with the http providerCalling the underlying API directly when the provider falls short.

Keeping Windows SMB credentials in sync with a sops-managed NixOS Samba serversops rotates the Samba password server-side; the Windows vault never finds out. The ladder that separates wrong-password from duplicate-connection, and the rotation sequence that prevents both.

Removing a stuck WinFsp or rclone drive letter on WindowsZ: stuck on a dead rclone mount: the full diagnostic ladder, every dead end included.

Tuning a 10GbE link end to endGetting a 10GbE link to its real ceiling, on Windows and on Linux.

A cross-client memory store for coding agentsOne Postgres for every agent client's session history, and the lessons from seeding 640k messages.

A kanban board for coding agentsOne Vikunja project and one bot user per repo, so an agent can claim a card, move it, and hand it back.

Declarative media player configs: VLC and MPC-HCPlayers whose config you can commit: vlcrc deltas, MPC-HC INI mode, and the registry half that stays behind.

Documentation over SSH for coding agentsA documentation mirror for coding agents, reachable over SSH or a stateless MCP endpoint, with the index that makes a lookup cheap.

GPU voltage-frequency curve control without AfterburnerGPU undervolting, P-states 2.0 memory offsets, and fan curves without Afterburner or FanControl.

All Workstations and tooling docs (43)

Contributing

Every page has an Edit this page link in the right rail that opens the source on GitHub. PRs welcome.