Posts on talanoff's blog

Arch: Secure Boot + sbctl + Dracut = playing with friends

Sat, 03 Jan 2026 14:13:30 -0500

Are you a security and privacy schizo who uses Arch for fun and playing games?
But you still somehow have friends?
And those friends play exclusively kernel-anticheat-invasive games?

I hear you.

Here are 3 magic commands, mon ami:

sudo sbctl create-keys
sudo sbctl enroll-keys --microsoft
sudo sbctl sign-all

Doesn’t work? Let’s unpack.

Prereq

First, let’s confirm you’re booting UEFI with TPM2:

sudo bootctl | head

You want to see something like this:

Services Behind VPN

Sun, 21 Dec 2025 15:53:05 -0600

TL;DR

You can access your homelab services from anywhere; valid HTTPS certs, no open ports on your home IP, everything locked behind WireGuard. It’s not as hard as it sounds, and once it’s running it’s basically invisible.

This post walks through the full setup: AdGuard for local DNS, nginx as reverse proxy, WireGuard tunnels, and HAProxy on a cheap VPS to route remote traffic home; optionally filtered through Cloudflare.

Why?

The standard advice is to forward ports 80 and 443 on your home router. It works. It also puts your home IP in every request log on the internet, leaves your router’s attack surface exposed, and means one misconfigured service is everyone’s problem. We do live in a society.

Hosting Your Own Email Server F%#cking Sucks

Tue, 23 Apr 2024 23:00:17 -0500

Discover why hosting your own email server is a nightmare! Bonus: 5-minute guide to take on the challenge! 🚀