Homelab

How I put code-server behind a FortiGate, a Caddy proxy chain, and Entra ID single sign-on so its built-in terminal never faces the raw internet.

Taking the hand-built FortiGate and Proxmox EVPN fabric and reproducing it entirely in code, one Terraform workspace driving both platforms, with every wall I hit along the way written down so you do not have to hit them too.

What this overlay actually buys you on the security side, beyond writing firewall policies, plus an honest list of what it does not buy you, and an FAQ on VXLAN and EVPN versus plain VLANs.

Measuring the throughput cost of VXLAN on a small FortiGate with no VXLAN offload, by A/B testing the same VM over an overlay segment versus a plain VLAN, and tracing the ceiling back to the silicon.

Swapping the static VXLAN peer list for a BGP EVPN control plane across a FortiGate and a three node Proxmox cluster, and every place the two platforms tripped me up by disagreeing on what to state versus what to derive.

Standing up a single stretched Layer 2 segment between a FortiGate and a Proxmox host using unicast VXLAN, and proving the data plane before adding any complexity.

How I set cache, aio, iothread, and discard on Proxmox VMs, decided by how each VM is used rather than the OS inside it, plus the ZFS foundations that keep those choices safe to leave alone for years.

How I pick a Proxmox VM CPU type: host versus the x86-64-vN virtual types, the Spectre and Meltdown flags those types quietly leave off, and why host is usually the wrong default on Windows.

How I carve up the /56 that Cox delegates over DHCPv6-PD across a FortiGate edge and a Brocade ICX core, why the prefix keeps changing, and the plan for automating the renumbering.