michaelharley

About 113 kWh for me. I have 2 Intel NUC type devices, with two drive enclosures. Plus my networking equipment which include POE cameras.

First thought is VPN port issue. I recall changing from Mullvad to ProtonVPN because Mullvad wasn’t’ doing the port forwarding correctly… or so says the robot.

I have and use pass for system secrets but for service where I’m logging in via the browser, I prefer KeePass.

I built myself a ‘new masked email’ workflow. I copy and paste the site url into the form and click create. It generates my random masked email, generates a strong password, prompts me for my keepass password then saves all the things and copies the generated password to the clipboard. Here are some screenshots. I did a test entry to demonstrate for you.

Dark-themed web form titled “New masked email”. The intro line reads “Mint a per-site alias at [redacted domain] and save a login to KeePass.” Below it are a “Domain or URL” field with the placeholder “amazon.com · https://infosec.pub/”, a “KeePass master password” field with the placeholder “used once, never stored” and the note “Used in memory to open the synced database, then discarded. Never written to disk or logs.”, and a teal “Generate & save” button.

New form.

The same form after a test run for google.com. A green check reads “Saved to KeePass · Logins / google.com (qvkk8729)”. Below it are the generated email “google.qvkk8729@[redacted domain]” and a random 30-character password, each with a copy button, the URL “https://google.com/”, and a “Mint another” link.

I type in my KeePass password and I get this screen while the entry is automatically saved to KeePass.

This all runs on an Intel NUC in my office and is accessible over my local network.

Uptime Kuma

I use 11ty to host my static site. I’ve used it for years. It’s well documented and learning resources.

Short version, and Deebster’s got the shape right: use a DNS-01 challenge. You prove domain control with a TXT record instead of serving a file over HTTP, so the hostname never has to be reachable from the internet. That’s what gets you a real Let’s Encrypt cert for a LAN-only name.

Mine’s acme.sh issuing a wildcard for *.lan.michaelharley.net via my registrar’s DNS API (Porkbun), with a deploy hook dropping it where Caddy reads it. Caddy’s own Cloudflare plugin is simpler, I just already had acme.sh. Local DNS is a wildcard rewrite on my router.