I gave Claude a read-only window into my firewall. Not “pasted some logs into a chat” — an actual Model Context Protocol server wrapping the OPNsense API, so Claude Code could call leasesSearchLease, dnsReverseLookup, and dozens of other firewall functions on demand. Then I pointed it at a simple question — what is actually on my network, and where does it all phone home? — and got a genuinely uncomfortable answer.

This post is two things: how to stand up an OPNsense MCP server in Docker safely, and the little network-forensics session it enabled, which is the real reason to build one.

I self-host Immich for my photo library, and it has broken on me in two completely different ways — both instructive, and both sharing a reassuring punchline: the photos were always fine. The failures were in the plumbing around them, not the data.

The first was a storage problem wearing a data-corruption costume: thousands of “unsupported image format” and “input file is missing” errors for files that were perfectly healthy. The second was a self-inflicted supply-chain problem: an overnight auto-update yanked the database extension out from under the server and put it in a boot loop. This post is both stories, because together they’re a decent field guide to operating Immich in a homelab.

Here’s a problem specific to people who rip their own discs: you’re standing in a thrift store holding a $3 Blu-ray, and you genuinely cannot remember whether it’s already in your library. Pull out your phone, squint at a media app, type the title, hope you spelled it like the metadata does… by which point you’ve put it back.

So I built jf-barcode-search: point your phone camera at the barcode on the case, and it tells you instantly whether that title is already in your Jellyfin library. It’s a small Flask app, and this post covers both what it does and — because I decided to open-source it — the pre-flight review that makes a homelab repo safe to publish, which is a checklist worth having regardless of what you’re releasing.