I gave Claude a read-only window into my firewall. Not “pasted some logs into a chat” — an actual Model Context Protocol server wrapping the OPNsense API, so Claude Code could call leasesSearchLease, dnsReverseLookup, and dozens of other firewall functions on demand. Then I pointed it at a simple question — what is actually on my network, and where does it all phone home? — and got a genuinely uncomfortable answer.

This post is two things: how to stand up an OPNsense MCP server in Docker safely, and the little network-forensics session it enabled, which is the real reason to build one.

I self-host Immich for my photo library, and it has broken on me in two completely different ways — both instructive, and both sharing a reassuring punchline: the photos were always fine. The failures were in the plumbing around them, not the data.

The first was a storage problem wearing a data-corruption costume: thousands of “unsupported image format” and “input file is missing” errors for files that were perfectly healthy. The second was a self-inflicted supply-chain problem: an overnight auto-update yanked the database extension out from under the server and put it in a boot loop. This post is both stories, because together they’re a decent field guide to operating Immich in a homelab.

Getting video off a disc is the part everyone talks about. The part that actually eats your evenings is everything after: a folder full of title_t00.mkv, disc1/, C3_t01.mkv files that mean nothing to a media server. Jellyfin wants very specific names and folder layouts, and if you don’t give them to it, you get “Unknown Movie,” mismatched episodes, and bonus features scattered as phantom entries.

So I extended a post-processing step into a proper Python pipeline that takes whatever came out of my ripping setup and turns it into a Jellyfin-perfect library: correct movie names with IMDb IDs, TV episodes matched to the right SxxExx, extras bucketed into the folders Jellyfin recognizes, then rsynced to the NAS and scanned in — with an ntfy ping at the end. This post is about that pipeline. It is deliberately not about disc decryption — it starts the moment you have plain .mkv files.