Notes

Investigations, writeups, and things I've looked into.

homelab 5 Apr 2026

WireGuard throughput: from 5 Mbps to saturating the link

Investigating why remote users were getting 5 Mbps through a WireGuard tunnel despite 400+ Mbps available on both ends. MTU fragmentation, TCP congestion collapse, and UDP buffer exhaustion.

homelab 2 Apr 2026

Deploying Authentik SSO across the homelab

Replacing per-service authentication with centralised SSO backed by Google OAuth. OIDC for Grafana, Immich, Portainer; forwardAuth for everything else.

homelab 26 Mar 2026

How my internal services were exposed to the internet

Found that my *.internal.gread.uk services were publicly reachable via the VPS TCP proxy. Built a three-layer defence to fix it.