How Tailscale Keeps My Home Server Reachable When the Operator Machine Changes
The server stays the service anchor while the laptop or desktop can change; the tailnet keeps the relationship stable.
TOPIC
Linux & Systems
Lessons, explainers, experiments, and implementation notes.
Putting a PBX in Docker Did Not Remove the Networking
Containerizing a SIP service added another address and NAT boundary, which made port publishing, advertised addresses and RTP ranges more important rather than less important.
A Docker Healthcheck Must Test the Dependency You Actually Need
A process can be alive while the service contract its neighbors depend on is broken.
mDNS and Tailscale Fail in Different Ways
A .local name and a Tailscale peer can refer to the same host while depending on different discovery systems.
SSH Access Is Infrastructure, Not a Deployment Step
Remote deployment is unreliable when host identity, user and access policy are rediscovered every time.
Laptop-to-Desktop Failover Needs Agent State, Not Hope
A second worker is useful only if it knows what the first worker already changed.
One Ingress Is Easier to Reason About Than Three
Every extra reverse proxy adds another place for routing, TLS and headers to disagree.
Swap Provides Space, but Time Is the Price
Swap is sometimes treated as a direct replacement for RAM, but memory moved to storage has to be read back when active work needs it again. Swap creates room while introducing a time cost.
Where Tailscale Serve Fits Beside Caddy and a Public Cloudflare Tunnel
Private tailnet publishing and public internet publishing are different ingress jobs, even when they reach the same container.
Using `dig` to Stop Treating DNS Like a Black Box
`dig` gave me a way to separate resolver configuration, authoritative answers, record types and response timing instead of reducing DNS to 'name works' or 'name fails'.
Ubuntu 18.04 on a Lab Machine: The Networking Commands I Kept Reusing
Ubuntu 18.04 was a good excuse to stop relying on desktop network icons and start reading interface state, routes, sockets and DNS configuration directly from the system.
Observability Became Useful When Every Graph Had an Operational Question
Dashboards improved once I stopped collecting attractive metrics and started collecting evidence for specific failure modes.
Why Tailscale Became the Control Plane for My Home Infrastructure
I do not use Tailscale as a generic VPN. I use it as the stable identity and reachability layer between my laptop, desktop and home server.
A Home Server Became Production the Day I Needed a Recovery Time
The difference between a lab box and production infrastructure is not the hardware; it is whether failure has a documented recovery path.
The Execute Bit on a Directory Is Really a Path Permission
A protected parent directory can block a perfectly readable child file because directory execute controls traversal.
Full RAM and Memory Pressure Are Not the Same Thing
On Linux, a high used-memory number does not automatically mean the system is under pressure. Cache consumes memory too and can often be reclaimed. A full-looking memory graph and work actually stalling for memory are different events.
Tailscale with Docker: Host-Level Tailnet or Per-Container Sidecar?
I choose the networking boundary before I add Tailscale to a Docker stack, because the two patterns create different operational models.
Understanding Small Linux Parts Makes Larger Systems Legible
One reason I like Linux is that its parts can be followed. Behind a command, you can trace processes, files, permissions, and network relationships. You do not need to understand everything at once for the larger system to start opening up.
Docker Networks Hid Less Once I Drew the Packet Path
Container networking stopped feeling magical when I separated host routing, bridge interfaces, NAT and the application socket.
systemd Logs Became Part of My VoIP Troubleshooting
Service state, bind failures and restart loops often explained a broken PBX before I needed to inspect a single SIP packet.
Why systemd Stop, Disable, and Mask Are Different
Stopping a service now, preventing automatic startup at boot, and making the service impossible to start are different operational intentions. systemd's stop, disable, and mask reflect those distinctions.
Linux Routing Tables: The Moment `ip route` Replaced Guessing
Once I started reading Linux routes as prefix decisions instead of interface settings, multi-interface hosts and lab gateways became much easier to debug.
Building a Small Home Lab from an Old PC and a Cheap Switch
A useful home lab does not need enterprise hardware. A spare PC, a small switch and a few isolated network experiments are enough to learn a lot about real interfaces, routes and services.
sngrep Became the Fastest Way to Answer the First SIP Question
Before opening a full packet capture, sngrep gave me a quick view of call legs, response codes and dialog timing directly on the server.
SSH Keys Made My Home Lab Feel Like a Real Network
Moving from local console access to SSH keys changed the lab from a collection of machines into something I could actually operate and troubleshoot remotely.
tcpdump Became My First Tool Before Wireshark
On a headless Linux box, tcpdump was faster than moving captures around blindly. A narrow capture at the right interface often answered the question immediately.
How I Add a Linux Machine to My Tailnet Without Turning It into a Snowflake
Joining a machine is easy; making its identity, hostname, access and role predictable is the part that matters later.
Production Infrastructure Became Easier Once Git, Runtime State and Secrets Had Different Jobs
Most operational confusion came from mixing desired configuration, live state and credentials into the same place.
Prometheus Metrics Changed How I Looked at a Mobile Core Lab
Logs explain individual failures; metrics show whether the system is drifting before the failures become obvious.
tcpdump on a PBX Taught Me to Trust the Wire Before the GUI
On a headless PBX, a narrow tcpdump capture often answered the important question faster than a full GUI trace: did the signaling or media packet actually reach the server?