TPTito Pinardo Gutiérrez
← Articles
Español

Monthly changes Published on · 1U · IAC

What changed in September 2026: the whole homelab as code

September was the month the whole homelab became defined as code. On top of that, everything that had no reason to be open to the internet was closed, the assistant changed model and got a test suite, and two scares ended up as articles.

  • Terraform
  • Ansible
  • Proxmox VE
  • Linux / SSH hardening
  • Wazuh
  • Python

The whole homelab, as code

From 16 to 19 September, every service still set up by hand was rebuilt in a new container created with Terraform and configured with Ansible: DNS, the game servers, media, document management and the scripts. By the end, nothing on the server didn't come from the repo.

  • Plex moves to an unprivileged container, with the GPU for transcoding.
  • Document management is rebuilt isolated and without SSH.
  • The repo has a second copy on another disk of the server, and every commit is pushed there too.

Security: close and check

  • Basic hardening on every container (SSH, time and scheduled jobs), and later SSH with modern algorithms only.
  • The Proxmox firewall wasn't being applied on 11 containers even though the rules were written. Found by trying to get through it.
  • On 26 September, the admin panels that were published stopped being so: they're only reachable from home or the VPN, with two-factor.
  • A custom Wazuh policy checks on every container that the essentials are still in place.

Hermes, the assistant

The month it changed most. It moved from qwen2.5 to qwen3:8b, learnt to read and write the calendar, to hear about email as soon as it arrives and to check the state of the network and of Docker. And above all it got a test suite of real questions that runs before every change.

  • One log line per model call: that's how it showed only 66% of the model fitted on the GPU.
  • Reasoning only on the calls that need it: turns 25% to 40% faster.
  • If a figure doesn't come from any source (an amount, an address), it doesn't take it as good.

Maintenance and scares

  • A new playbook updates the Docker images, and monitoring shows which containers have a new version.
  • A one-line change in Terraform wanted to recreate the messaging server and the web gateway. The plan flagged it and it wasn't applied.
  • The write cache of the system disks is enabled on every boot.
  • Every container on Madrid time.