https://blogs.damiendye.uk/en/tags/homelab/ Recent content in Homelab on Damien Dye's Blog Hugo en-GB Fri, 09 Oct 2026 18:30:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-ssh-certificates/ Fri, 09 Oct 2026 18:30:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-ssh-certificates/ Using step-ca as an SSH certificate authority: signing host keys so clients stop asking to trust them, signing user keys so servers need no authorized_keys, the two sshd_config lines and one known_hosts line it takes, what was refused in testing, and renewing host certificates. https://blogs.damiendye.uk/en/certificates/step-ca-client-certificates-mtls/ Fri, 09 Oct 2026 18:20:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-client-certificates-mtls/ Using step-ca to issue client certificates for mTLS, tested with nginx and Caddy. The 24-hour limit and how to raise it, a CRL that rejects everyone until its scope is fixed, the root CRL nginx needs, publishing CRLs over HTTP, the refresh job that stops them lapsing, and the PKCS12 file and CA certificates a phone needs. https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-mtls-nginx-caddy/ Fri, 09 Oct 2026 18:00:00 +0100 https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-mtls-nginx-caddy/ Locking the Home Assistant app to a client certificate with nginx or Caddy at home instead of Cloudflare. What changes when Cloudflare leaves, both configs tested over IPv4 and IPv6, why nginx can check revocation and Caddy cannot, the Home Assistant proxy settings, and what to install on the phone. https://blogs.damiendye.uk/en/certificates/step-ca-in-a-container/ Fri, 09 Oct 2026 17:50:00 +0100 https://blogs.damiendye.uk/en/certificates/step-ca-in-a-container/ Smallstep's step-ca in a Podman or Docker container as the certificate authority for everything inside the house: why it beats self-signed and public certificates for internal names, the two passwords the image makes, trusting the root, internal HTTPS over ACME, and renewing services that cannot do ACME. https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-over-cloudflare-mtls/ Fri, 09 Oct 2026 16:30:00 +0100 https://blogs.damiendye.uk/en/homeassistant/home-assistant-app-over-cloudflare-mtls/ Reaching Home Assistant from the Android app away from home without putting a login page on the internet. The options compared on cost, risk and battery, why Cloudflare Access does not suit the app, the free-plan client certificates and WAF rule that do, the Home Assistant proxy, ban and URL settings, and building the PKCS12 file the phone needs.