Articles

Setting up Caddy as a reverse proxy for my home lab

I’ve been juggling a Plex server, Nextcloud, and a little Go API all on the same Ubuntu 24.04 box. The goal was simple: a tidy public URL for each service, automatic HTTPS, and as little upkeep as possible. Caddy 2.7 fit the bill perfectly—its ACME integration is a one‑liner, and it ships with HTTP/2 out of the box.

1. Install Caddy

sudo apt update
sudo apt install -y debian-keyring debian-archive-keyring
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | \
  sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/caddy-stable-archive-keyring.gpg] \
  https://dl.cloudsmith.io/public/caddy/stable/deb/debian any main" | \
  sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install -y caddy

Caddy boots as a systemd service automatically. Just double‑check that it’s listening on the web ports:

The Problem

Running a rootless Podman container on a home‑lab server is great for isolation, but the logs it spits out can quietly eat up disk space. I once had a simple nginx container that, after a few days, filled a 20 GB SSD with log files. The container was running as my normal user, so I couldn’t just rm -rf /var/lib/containers/... without risking a permission error. The real issue was that Podman, by default, writes container stdout/stderr to files under /var/lib/containers/storage/overlay-containers/.../files/var/log/ and those files never rotate.

Recover a single file from a damaged Borg archive

When a Borg repository gets corrupted, the instinct is to dump the whole thing back. That’s usually overkill if you just need one config file. Borg actually gives you a fine‑grained extraction tool that can pull a single file even from a partially broken archive.

1. Verify the repository

borg check /srv/backups/myrepo

borg check will surface any integrity problems. If you see corruption, you can try to fix it:

Running a nightly backup from a home NAS to a desktop is a common task, but the copy can still hog the machine’s resources and make the UI feel sluggish.
The trick is to let the backup run with low CPU and I/O priority so the desktop stays responsive. Two simple tools—nice and ionice—are all you need.

Why the problem matters

When a rsync or tar job copies gigabytes of data, the kernel’s scheduler keeps the process in the foreground class. Even if you’re not actively using the machine, the backup can consume CPU cycles and saturate the disk queue. On a laptop or a desktop with a single NVMe drive, this shows up as a frozen terminal, delayed window redraws, or a sluggish browser.

When the disk is almost full

I’ve run a handful of home‑servers for years, and the first thing that usually trips you up is a suddenly full disk.
Caches from apt, Docker, Flatpak, and the like can balloon without you noticing.
A quick, automated cleanup that only kicks in when the root filesystem is >90 % used keeps the system sane without you having to remember to run a script every week.

On a small home‑lab server or a single‑user laptop, the root filesystem is often the first place that runs out of space. I ran into this on a 2025‑era Raspberry Pi running Ubuntu 24.04 LTS: the systemd journal kept growing until the root partition hit 95 % and the machine refused to boot. The fix was surprisingly simple once you understand how systemd‑journald works and how to steer its output away from the root filesystem.

When Clonezilla says root=UUID not found

Cloning a bootable SSD with Clonezilla is usually painless, but the new machine can stall at the kernel prompt with:

root=UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx not found

The kernel can’t locate the root filesystem because the UUIDs in the boot configuration still point to the original disk. The fix is a handful of targeted edits and rebuilds.

1. Verify the new UUIDs

Boot from a live USB, open a terminal and list the block devices:

Running containers without root is a lifesaver, but I hit a snag the other night. I had a small database container that wrote data to a named volume, and the next time I rebooted my machine the data was gone. Turns out the volume directory was being created under a transient mount that didn’t survive shutdown.

Why the Volume Vanishes

In rootless mode Podman keeps everything under ~/.local/share/containers/storage. When you do podman volume create, it records the mount point in a JSON file there. On reboot the user‑session systemd instance that owns the rootless runtime comes back up, but systemd doesn’t automatically remount the user‑created volumes unless you tell it to. The result? The container starts, and the volume looks like a fresh empty directory.

I was staring at a blinking screen of a freshly flashed router when I realized the whole LAN had lost its DNS mojo. I could ping 192.168.1.1 fine, but curl example.com slammed back with “Could not resolve host”. No amount of dig or nslookup helped until I dug into systemd‑resolved.

Why systemd‑resolved Holds on to Old DNS

systemd‑resolved is the default resolver on most recent distros. It keeps a cache of answers to cut down on DNS traffic and speed things up. The cache is keyed by the DNS server that answered and the TTL that server advertised. When a router’s firmware changes, its DHCP server may hand out a new DNS IP or a new list of servers. systemd‑resolved will keep the old server in memory until it gets a fresh lease or the cache expires. If the new server is unreachable, all lookups die.

Cleaning up old temp files is a daily chore that can quickly become dangerous if you use the wrong tool.
A single misplaced rm -rf can wipe out a whole directory tree, and that risk grows when you’re running scripts as root.
The combination of find and xargs (or -delete) gives you a precise, race‑condition‑aware way to target only the files you really want gone.

Why find + xargs beats a blind rm -rf

• Scope control – find lets you restrict the search to a specific path, depth, file type, age, size, or owner.
• Safety – -delete removes only the matched files; it never walks into a directory you didn’t ask for.
• Speed – xargs batches deletions, reducing the number of rm invocations.
• Robustness – -print0 + xargs -0 handles filenames with spaces, newlines, or other odd characters.

A minimal, production‑ready command

# Delete regular files in /tmp older than 7 days
find /tmp -type f -mtime +7 -print0 | xargs -0 rm -v

• -type f skips directories and symlinks.
• -mtime +7 matches files whose modification time is more than seven days ago.
• -print0 outputs a null‑terminated list; xargs -0 consumes it safely.
• -v gives you a quick audit trail.

If you prefer a single‑step solution and your find supports it, replace the pipe with -delete: