Self-Hosting on Linux Colorado

Speaker-Diarized Call Transcription on a CPU — No Cloud, No GPU, No Hugging Face Token

Tue, 18 Aug 2026 00:00:00 +0000

I wanted a speaker-labeled, timestamped transcript of a two-person phone call — the kind an LLM can actually reason about (“what did the customer commit to?”, “when did the price come up?”) — without shipping the audio to a cloud speech-to-text service.

One hard constraint shaped every decision: it all had to run on hardware already in the rack. No new GPU, no API keys, no “just use the cloud for the hard part.” A 35-watt desktop chip that already earns its keep running other things.

It worked. And, as usual, the interesting parts weren’t in the happy path — they were in why the whisper I already had running couldn’t do the job, how to diarize speakers on a CPU with no Hugging Face token, and a genuinely great debugging story that ends with a 114-byte file quietly corrupting every timestamp in the system.

A note on the transcript examples below: the real test call involved an actual third-party business and named individuals who never agreed to be quoted. Every name, company, and phone number in the excerpts here is synthetic — invented for illustration. In many US states, Colorado included, recording calls and reusing what was said carries real legal weight. If you build one of these, redact before you publish. I’m practicing what I preach.

Cheap Phone Service and Whole-House Intercom with FreePBX + SignalWire

Sun, 16 Aug 2026 00:00:00 +0000

Business phone service — RingCentral and the like — runs $20–35 per seat per month, locks your desk phones to their firmware, and puts your dial tone at the mercy of someone else’s cloud. I replaced all of it with a self-hosted PBX that costs a few dollars a month in actual usage, keeps every phone on hardware I own, and adds something the commercial offerings either charge extra for or simply don’t do: push-to-talk intercom between rooms. Dial the kitchen, it answers itself on speaker, you talk.

The whole thing is four Docker containers on one host, one DNS record on another, and a single SIP trunk in the cloud. Everything else is a text file.

A note on the examples: this runs on my real network with real family phone numbers on it. Every phone number, personal name, and account identifier below is synthetic — invented for illustration and drawn from the 555-01xx range reserved for fiction. The configuration is real and copied verbatim from the running system; only the personal data is swapped. If you build one of these, keep your own credentials and family numbers out of your blog. I’m practicing what I preach.

A Valid TLS Cert for a LAN-Only Home Assistant: Traefik, DNS-01, and Split-Horizon DNS

Sat, 15 Aug 2026 00:00:00 +0000

Here’s a puzzle that trips up a lot of homelabbers: you want a publicly-trusted TLS certificate for a service that is only ever reachable on your LAN. No port forwarding, no exposing the box to the internet — but also no browser warnings, no self-signed-cert clicking-through, and no private CA to install on every device.

The specific thing that forced my hand: I wanted to connect Claude.ai’s remote MCP connector to my Home Assistant instance, and that connector flatly refuses plain HTTP. It demands a valid https:// endpoint. My HA is a sealed Green appliance at 192.168.1.18:8123, LAN-only, and I had no intention of exposing it to the world.

The answer is a nice combination of three ideas — a Let’s Encrypt DNS-01 challenge, a wildcard certificate, and split-horizon DNS — wired together with Traefik. This post is the worked example.

Letting Claude Read My Firewall: an OPNsense MCP Server, and What It Found on My Network

Fri, 14 Aug 2026 00:00:00 +0000

I gave Claude a read-only window into my firewall. Not “pasted some logs into a chat” — an actual Model Context Protocol server wrapping the OPNsense API, so Claude Code could call leasesSearchLease, dnsReverseLookup, and dozens of other firewall functions on demand. Then I pointed it at a simple question — what is actually on my network, and where does it all phone home? — and got a genuinely uncomfortable answer.

This post is two things: how to stand up an OPNsense MCP server in Docker safely, and the little network-forensics session it enabled, which is the real reason to build one.

Two Ways My Self-Hosted Immich Broke — and Neither Was Corrupt Data

Thu, 13 Aug 2026 00:00:00 +0000

I self-host Immich for my photo library, and it has broken on me in two completely different ways — both instructive, and both sharing a reassuring punchline: the photos were always fine. The failures were in the plumbing around them, not the data.

The first was a storage problem wearing a data-corruption costume: thousands of “unsupported image format” and “input file is missing” errors for files that were perfectly healthy. The second was a self-inflicted supply-chain problem: an overnight auto-update yanked the database extension out from under the server and put it in a boot loop. This post is both stories, because together they’re a decent field guide to operating Immich in a homelab.

After the Rip: Auto-Naming a Home Media Library for Jellyfin with Python, TMDB, and ffprobe

Wed, 12 Aug 2026 00:00:00 +0000

Getting video off a disc is the part everyone talks about. The part that actually eats your evenings is everything after: a folder full of title_t00.mkv, disc1/, C3_t01.mkv files that mean nothing to a media server. Jellyfin wants very specific names and folder layouts, and if you don’t give them to it, you get “Unknown Movie,” mismatched episodes, and bonus features scattered as phantom entries.

So I extended a post-processing step into a proper Python pipeline that takes whatever came out of my ripping setup and turns it into a Jellyfin-perfect library: correct movie names with IMDb IDs, TV episodes matched to the right SxxExx, extras bucketed into the folders Jellyfin recognizes, then rsynced to the NAS and scanned in — with an ntfy ping at the end. This post is about that pipeline. It is deliberately not about disc decryption — it starts the moment you have plain .mkv files.

jf-barcode-search: Scanning Barcodes to Query Jellyfin — and a Checklist for Open-Sourcing a Homelab Repo

Tue, 11 Aug 2026 00:00:00 +0000

Here’s a problem specific to people who rip their own discs: you’re standing in a thrift store holding a $3 Blu-ray, and you genuinely cannot remember whether it’s already in your library. Pull out your phone, squint at a media app, type the title, hope you spelled it like the metadata does… by which point you’ve put it back.

So I built jf-barcode-search: point your phone camera at the barcode on the case, and it tells you instantly whether that title is already in your Jellyfin library. It’s a small Flask app, and this post covers both what it does and — because I decided to open-source it — the pre-flight review that makes a homelab repo safe to publish, which is a checklist worth having regardless of what you’re releasing.

/ipad-internet off: A Claude Code Skill That Cuts One Device's Internet at the Firewall

Mon, 10 Aug 2026 00:00:00 +0000

I wanted one command — /ipad-internet off — that instantly cuts the household iPad’s internet, and /ipad-internet on to give it back. Simple ask. The interesting part is doing it correctly: instantly (no waiting on a config save), reversibly, without disturbing the LAN (AirPlay, printers, local media should all keep working), and — most importantly — in a way that can never accidentally knock a different device offline.

It ended up as a Claude Code skill backed by a careful bit of OPNsense / pf design. This post is about that design: why it uses a pf table instead of editing the config, how it survives the iPad’s shifting IP and Apple’s private Wi-Fi MAC, and the ownership guard that makes the “wrong device” failure mode structurally impossible.

Teaching the House to Announce the Mail Truck: A Zero-Shot CLIP Classifier on the Homelab

Sun, 09 Aug 2026 00:00:00 +0000

I wanted my house to say, out loud, “the mail truck is out front” — the moment the USPS truck pulls up, spoken through the same Home Assistant TTS pipeline that runs the rest of the place. Not “a vehicle was detected.” Specifically the mail truck.

The gap between those two sentences is the whole project. My NVR (Frigate) is very good at “there’s a truck in the driveway zone” and completely incapable of “that’s a USPS LLV.” Closing that gap meant adding a small second-stage classifier that looks at the snapshot Frigate already captured and decides what kind of truck it is — running on hardware I already own, with no cloud vision API. It ended up as a zero-shot CLIP classifier, and along the way it picked up a second job I never planned: catching the garbage truck too.

Moving My ADS-B Receiver Outdoors: Ultrafeeder on a Raspberry Pi, Done Right

Sat, 08 Aug 2026 00:00:00 +0000

I run an ADS-B receiver at home — it decodes the transponder broadcasts from aircraft overhead, plots them on a live map, and feeds the data to FlightAware. It started life the lazy way: an RTL-SDR dongle plugged into a server indoors, with a run of coax to an antenna. That works, but it’s the wrong topology if you want range, and I wanted to move the whole thing up high and outdoors.

Two things came out of that project worth writing down. First, a diagnostic detour that taught me the map wasn’t lying to me even though it looked like it was. Second — the real content — how to relocate an SDR receiver to the top of a mast without breaking MLAT, which is the part most “just put a Pi outside” guides skip.

Aiming an OTA Antenna With Data: Prometheus + Grafana on an HDHomeRun FLEX 4K

Fri, 07 Aug 2026 00:00:00 +0000

Aiming an over-the-air TV antenna is traditionally a two-person job with a lot of yelling: one person on the roof rotating the mast, one inside shouting “better… worse… BETTER… no, worse again.” The feedback loop is slow, the signal bar in the tuner’s web UI updates lazily, and you can never quite tell whether that last nudge helped.

I wanted a tight feedback loop: a live graph, updating every few seconds, of the exact signal metrics that matter — so I could rotate the antenna and watch a line move in real time. My tuner is an HDHomeRun FLEX 4K, and it turns out you can scrape per-tuner signal quality straight into Prometheus and chart it in Grafana. This post is how I built that, the one exporter that actually does the job, and the surprise ending where the data explained a “broken” channel that wasn’t broken at all.

"0 Detections, Hundreds of Alerts": The Frigate Terminology Trap That Isn't a Bug

Thu, 06 Aug 2026 00:00:00 +0000

I opened my Frigate dashboard one morning and my stomach dropped: 0 detections, hundreds of alerts. My first read was the obvious one — the object detector had fallen over, and Frigate was now firing blind, alerting on raw motion instead of actual objects.

That read was completely wrong. Nothing had broken. The detector was healthy, running OpenVINO inference at ~10 ms per frame the entire time. What had actually happened is that I didn’t understand what the words “Alert” and “Detection” mean in modern Frigate — and once I did, the “outage” evaporated and turned into a five-minute config change.

This is a post about a debugging story with a satisfying anticlimax, and about a genuinely confusing bit of Frigate’s UI vocabulary that trips up a lot of people running 0.14 and later.

Building a Headless AI Workstation: Ubuntu Server + RTX 3060 + Ollama, Zero-Touch from a USB Stick

Wed, 05 Aug 2026 00:00:00 +0000

Several of my homelab projects want a local GPU for inference — running a vision LLM for OCR, offloading work that would otherwise hit a cloud API, keeping a small model resident and fast. So I built a dedicated box for it: a Dell Precision 3640 (i3-10105F, 16 GB) with a Gigabyte RTX 3060 12 GB, running Ubuntu Server and serving a vision model through Ollama.

Two things made this worth writing up. First, the actual GPU-serving setup has a few non-obvious choices (which driver, no CUDA Toolkit, exposing the port safely). Second — the fun part — I made the whole install zero-touch: plug in a USB stick, walk away, and the box comes up on a static IP with SSH pubkey auth ready, no monitor or keyboard ever attached. This post covers both, and both live as reusable docs/scripts in my infra-config repo.

Backing Up a Homelab as Code: Docker Configs to a Private Git Repo, Without Leaking Secrets

Tue, 04 Aug 2026 00:00:00 +0000

If my main Docker host died tomorrow, how fast could I rebuild it? For a long time the honest answer was “slowly, and from memory.” The fix is to treat the box’s configuration as code: every docker-compose.yml, Dockerfile, and config file committed to a private git repo, so reimaging is a git clone and a handful of docker compose up commands.

The trap is that a live Docker tree is a minefield of secrets — .env files, TLS private keys, API tokens hardcoded into compose files — and pushing any of them to GitHub, even a private repo, is a bell you can’t fully un-ring. This post is the repeatable procedure I landed on: what to commit, what to never commit, and the automated checks that keep the second category out.

"My NAS Is Out of RAM and My Download Is Stuck" — Two Homelab Myths, Debunked

Mon, 03 Aug 2026 00:00:00 +0000

Two things happened on the same day that looked like problems and weren’t — at least not the problems they appeared to be. My NAS was reporting almost all its RAM in use, which sounds like a leak or an imminent crash. And a TV show I’d grabbed through LunaSea on my phone had downloaded fine but then “wouldn’t import” into the library, which sounds like a broken automation pipeline.

Both are among the most common false alarms in a self-hosted media stack. Neither was what it looked like. Here’s what was actually going on, and the real fixes.

The Mail Truck Classifier Cried Wolf: Tuning Zero-Shot CLIP With Real Data

Sun, 02 Aug 2026 00:00:00 +0000

A while back I taught my house to announce the mail truck: Frigate spots a vehicle out front, a small service crops the snapshot and runs zero-shot CLIP against a list of text prompts, and if it decides “USPS truck” or “garbage truck,” Home Assistant says so out loud through Piper. That post ended on an optimistic note — a garbage truck scoring p_trash 0.995, and a line about how a labeled dataset for future tuning would “build itself from real events.”

This is the reckoning with that optimism.

Because the classifier worked, and then it would not shut up. 143 garbage-truck announcements in seven weeks, on a street where the garbage truck comes exactly once a week. The house had become the boy who cried wolf, and my family had — correctly — started ignoring it. This post is about actually fixing that: what 200 real detections showed, why the obvious fix is a trap, and the one idea worth stealing even if you never touch CLIP.