Recent
Review what changed across the public operator library without learning three different section names or jumping between landing pages.
Current Feed
Deploy the current Homepage project with Compose v2, configure real service links and built-in URL health checks, and keep Docker-socket access out of the first Lab so the...
Deploy Nginx Proxy Manager with persistent data, route one disposable backend through a real hostname, and validate HTTP-to-HTTPS behavior plus certificate issuance without exposing the admin interface unnecessarily.
Build a small service-health Lab where Prometheus sends HTTP probes through Blackbox Exporter, Grafana visualizes probe_success and latency, and a disposable web service provides...
Deploy Uptime Kuma v2 for endpoint checks and status pages, scrape its supported /metrics endpoint with Prometheus, and visualize response-time/status metrics in Grafana without...
Run a small Gitea instance from the current rootless container image, keep the web service behind an internal HTTPS boundary, and prove the catalog by creating, cloning, and...
Run Grafana's current Loki quickstart as an evaluation Lab, collect generated logs with Grafana Alloy, query them through Grafana, and capture the exact downloaded configuration...
Deploy a small Paperless-ngx Lab from the project's maintained Docker Compose files, ingest and OCR a test document, then use the supported document exporter/importer workflow to...
Create one small identity-provider Lab using either Authentik's official Compose bundle or Keycloak's current development container, then validate a realm/application/user flow...
Deploy Vaultwarden behind an HTTPS reverse proxy, keep the application bound to localhost, disable open signup after bootstrap, and create a consistent backup of the vault data...
Install Jellyfin on a supported Debian or Ubuntu host using the current signed repository workflow, validate playback and metadata, and prove that the server configuration and...
Define PowerShell, Terraform, and Azure CLI as Dev Container Features on an Ubuntu 24.04 base so the toolchain can be rebuilt from configuration instead of hand-installed scripts.
Build an independent secondary Pi-hole resolver, align the settings that should match the primary, and test both resolvers before advertising them together to clients.
Build a small k3s lab using the bundled Traefik ingress controller and local-path storage, then validate a complete service path before adding real self-hosted workloads.
Build a small PowerShell operations toolkit that records backup-file freshness, checks selected Windows services, writes durable daily evidence, and runs on a controlled schedule.
Build a repeatable VM backup-verification workflow that proves a selected recovery point can be restored into an isolated test target and records evidence before the restored VM is removed.
Build a current Home Assistant starter environment on a Raspberry Pi with Home Assistant OS, room-based Areas, a useful dashboard, and automatic backups stored beyond the device.
Build a maintainable Raspberry Pi container host with Docker Engine, the current Compose plugin, service health checks, and a controlled update workflow.
Build a scheduled Windows patch-evidence report with PowerShell and Get-HotFix, then validate the generated CSV and scheduled task.
Audit the freshness and completeness of known backup artifacts for a Windows file share without pretending file timestamps prove backup-job success.
Build a Proxmox Backup Server lab around a current datastore/repository integration and a safe manual recovery drill, then turn the drill into a repeatable monthly procedure.
Create one explicit Windows remote-admin path where RDP is reachable only over the intended Tailscale network and identity policy, then prove both allowed and denied access paths.
Collect a defined set of Windows events incrementally with PowerShell and Task Scheduler, prove the collector with a known test event, and avoid presenting raw CSV export as a complete log-management platform.
Use a Raspberry Pi as a dedicated Mosquitto and Zigbee2MQTT utility node, with Home Assistant as a separate consumer, explicit authentication, stable Zigbee device mapping, and end-to-end message validation.
Build an onboarding script around explicit package IDs, idempotent settings, reboot handling, logging, and a rerun-safe validation report.
Build a disposable three-node Proxmox cluster, verify quorum and network requirements, create one reusable guest template, back it up, restore it, and document placement decisions...
Use Windows LAPS for supported local administrator password management and PowerShell for read-only local Administrators-group drift reporting instead of inventing a password-rotation secret store.
Collect SMB share ACLs, NTFS ACLs, inheritance/ownership, and group-membership evidence without auto-remediating permissions or pretending one ACL layer equals effective access.
Inventory machine-wide installed applications from 64-bit and 32-bit uninstall registry views, normalize duplicate records, and document what registry inventory does not cover.
Build a parameterized PowerShell health-check pack with testable AD, DNS, DHCP, and certificate functions, structured results, and controlled negative tests.
Build an ntopng visibility dashboard around one explicit traffic-observation topology, then prove traffic from the intended VLANs actually reaches the sensor and is attributed correctly.
Build a small-office monitoring path that proves one SNMP device, one syslog event, and one routed alert end to end instead of installing three disconnected products.
Turn a vendor-neutral NAS idea into a completion-oriented backup exercise: define protected data and RPO/RTO, configure versioned local snapshots plus one concrete offsite target, and prove a file restore.
Build one complete GitHub Actions pipeline for a disposable Docker service: test, build, publish a versioned image, deploy it, deliberately fail the new version, and roll back to the previous digest/tag.
Build a two-client WireGuard lab with split DNS, explicit routing, resolver selection, firewall/NAT boundaries, and deterministic failover/teardown tests.
Build a WireGuard transport to a hardened jump host, then enforce MFA at the administrative login boundary instead of implying that WireGuard itself provides MFA.
Collect DHCP scopes/leases and DNS records read-only, then run explicit stale/conflict checks instead of changing execution policy or treating raw exports as an audit conclusion.
Build one observable event path from a disposable camera/test stream through Frigate and MQTT into a Home Assistant automation, with pinned configuration and payload-level validation.
Use a disposable ZFS dataset to prove snapshot, replication, retention, destructive-change recovery, and rollback between two TrueNAS systems.
Use one known-compatible metering device to distinguish instantaneous power (W) from accumulated energy (kWh), validate Home Assistant statistics, and prove a threshold automation safely.
Build one concrete two-interface Raspberry Pi travel-gateway topology, route only home-lab subnets through WireGuard, and prove behavior from a genuinely external network.
Build a Raspberry Pi monitor with a supported digital temperature sensor, explicit wiring/calibration checks, durable readings, and a controlled service-alert test.
Connect one current calendar/event source to one notification target, implement explicit quiet-hours logic and escalation exceptions, and prove behavior before, during, and after the quiet window.
A read-only Active Directory stale computer report for last logon, OU, operating system, enabled state, and cleanup planning.
Collect non-replicated lastLogon values from every writable domain controller, calculate the newest observed logon per account, and export evidence suitable for stale-user or stale-computer cleanup decisions without relying on replicated lastLogonTimestamp alone.
PowerShell scanner that checks fixed local drives on Windows servers for root ACL entries where Authenticated Users have broad access. Produces console and CSV evidence so admins can review exposure before any ACL changes.
Reusable starter for Azure Arc onboarding waves using a host CSV, dry-run expectations, per-host logging, and repeatable result tracking suitable for tickets, change records, and post-wave reporting.
Preflight checklist for onboarding Windows servers to Azure Arc. Confirms supported OS state, outbound connectivity, proxy/TLS behavior, local admin rights, target Azure placement, tagging, pilot scope, and rollback notes before any agent install.
Starter template for an Azure Workbook plus Resource Graph evidence pack that shows patch compliance, pending updates, unsupported coverage, and patch-group drift across Azure and Arc-enabled machines.
Operator-ready planning template for Azure Update Manager patch waves covering scope, maintenance windows, reboot tolerance, exclusions, soak periods, rollback contacts, and stop-go criteria before scheduled patching.
A restore-drill evidence template for proving backups are usable, measuring recovery time, and turning failed assumptions into repair tasks before an outage.
A ready-to-fill restore-test record with scope, isolated restore evidence, application/data validation, measured RPO/RTO, failures, assumptions, cleanup, owner signoff, and a management/change summary.
Create the local PowerShell helper file that every Ops Stack reporting-compatible script can share. This guide walks through the folder structure, the helper contract, the commented PowerShell implementation, a sample validation run, and the artifacts the helper creates so a new reader can build it from scratch and prove it works.
A read-only certificate inventory that finds local-machine store certificates nearing expiration and captures certificates presented by known TLS endpoints for review.
Capture resource-specific cloud state and request-path evidence before changing DNS, gateways, identity, endpoints, or storage access.
Choose whether an automation failure needs logic repair, context repair, retries, or better observability before you change the workflow.
Decide whether a cloud failure should be validated from DNS, identity, gateway, or storage first.
Decide whether a container failure should be validated from runtime, registry, network, or ingress first.
Compare image, runtime, service, DNS, policy, and ingress state between a healthy and failing container path before redeploying or changing shared platform configuration.
Compare concrete host, service, package, resolver, route, and authentication state between a healthy and failing Linux system before restarting or rewriting configuration broadly.
Compare WAN, switching, routing, VPN, and policy state between a healthy and failing path before renewing leases, reloading devices, or loosening access controls.
Decide whether an identity or Windows access failure should be validated from DNS, LDAP, Kerberos, or SMB first.
Choose between SSH, service, package, and network validation branches before changing a Linux host.
Choose between WAN handoff, switching, VPN, and policy validation branches before changing the network edge.
Use this when you need to choose the right file-migration path instead of defaulting blindly to Robocopy, PowerShell, rsync, or storage replication.
Compare Windows repair paths before reaching for SFC, DISM, restore workflows, update rollback, or full rebuilds.
A read-only DHCP scope report that surfaces high utilization, exhausted ranges, and cleanup candidates.
A read-only disk-pressure report that captures low-space context and returns targeted cleanup candidates from known folders without deleting, compressing, or moving anything.
A read-only two-client DNS failure workflow that collects the same evidence on the affected and known-good Windows clients, compares suffix, resolver, cache, and query paths side by side, and narrows the first actual delta before any reset.
A read-only DNS audit that compares forward and reverse lookup results across host lists and expected DNS servers.
A read-only file share audit that records SMB share permissions, NTFS access, and ownership evidence for review.
A practical guide to free network scanning options for host discovery, port inventory, and safe scan scoping.
Compare a working identity or protocol path against the failing one before you change AD, DNS, trust, or service settings.
A read-only IIS inventory that correlates sites, bindings, ports, host headers, app-pool identities, content paths, and certificate thumbprints for migration or renewal work.
Two-phase review checklist for identifying inactive AD user accounts, validating inactivity evidence, applying exclusions, capturing approval, and preparing rollback details before any disable action.
A compact operator note format for capturing symptoms, checks, decisions, and follow-up while the issue is fresh.
A read-only PowerShell inventory starter for collecting installed applications from local or remote Windows endpoints.
Operator checklist for launching an internal IIS-hosted site with evidence capture for IIS role presence, site folder layout, bindings, app pool identity, DNS readiness, browser validation, and rollback notes.
One authoritative path for monitoring 10–20 internal HTTP/HTTPS endpoints: define endpoint semantics, deploy Uptime Kuma, set retry and maintenance policy, add TLS/auth checks, alert, retain history, and prove the monitor with a controlled outage.
A read-only local administrator audit that records privileged group membership across Windows endpoints for review.
A ready-to-fill monthly record that turns patch-compliance methodology into a defensible reporting package: population reconciliation, denominator rules, unknown/stale systems, exclusions, applicability, evidence coverage, exceptions, signoff, and management summary.
A read-only pending reboot check for Windows servers before patching, application installs, or maintenance-window closure.
Classify the automation failure, compare the real interactive and unattended runtimes, improve observability, and make the smallest evidence-backed correction before rewriting code.
Plan cloud app publishing and access troubleshooting around path validation, service boundaries, safe changes, and rollback.
Isolate container failures by separating image, runtime, service-networking, and ingress branches before changing the stack.
Plan file-share and data migrations around scope, tool choice, validation, rollback, and evidence before running the copy path.
Isolate identity and Windows protocol failures by mapping the failing boundary before changing DNS, AD, SMB, or auth settings.
Separate Linux host access, service state, package-source, and network-path failures before making broad system changes.
Separate provider handoff, switching, VPN, and edge-policy failures before making broad network changes.
Use an incident-lead decision model that separates known evidence from assumptions, identifies the likely failure domain, preserves evidence, chooses the smallest discriminating...
Concrete PowerShell reporting pattern for turning host-check results into an HTML operations summary with a status rollup, per-host table, failure section, saved local artifacts, and optional email delivery.
Use the Ops Reporting Foundation helper to turn PowerShell checks into consistent HTML, CSV, JSON, and log artifacts. Start here after creating the helper file, then plug health checks, patch checks, certificate scans, AD hygiene checks, and other collectors into the same reporting pattern.
A concise read-only connectivity triage script that separates DNS, ICMP reachability, and expected TCP-port failures before escalation.
The primary production file-migration workflow: plan, dry-run, pre-seed, freeze writes, final delta, validate data/metadata/access, and make an explicit GO / STOP / ROLLBACK decision before the destination becomes authoritative.
Read-only PowerShell reporting script pattern to identify likely Microsoft NPS or other RADIUS-capable Windows servers using multiple evidence sources: NPS service presence, NPAS role/feature state, IAS/NPS event log activity, UDP 1812/1813 listener evidence, and registry indicators. Designed for migration discovery, audit support, and authentication troubleshooting.
A structured check for RDP failures before changing firewall rules, user rights, or server policy.
A read-only RDP triage script pattern for DNS, TCP 3389, listener state, firewall evidence, sessions, and event logs.
A safer starting point for repeatable Windows file copy jobs with logging and dry-run review.
A safer Robocopy job template with dry-run review, log capture, exit-code interpretation, and migration evidence.
A read-only scheduled task inventory that highlights failed runs, missed runs, disabled tasks, and ownership gaps.
Combine configuration discovery with runtime authentication evidence, SPN/Kerberos review, owner approval, an observation window, and explicit DISABLE / HOLD / ROLLBACK criteria before retiring a domain service account.
A read-only configuration-discovery pass for service-account assignments in Windows services, scheduled tasks, and IIS application pools, designed as the first step of—not a substitute for—the full retirement evidence workflow.
Compare a working and failing user's identity, token, Kerberos, share ACL, NTFS ACL, inheritance, and effective-access path to identify the first authorization delta before changing permissions.
A practical Sysinternals first-response map for process, file handle, startup, network, login, and registry symptoms.
A simple monitoring starter for internal services, homelab systems, and small-office status checks.
Use this when you need a validation model that proves a migrated target is ready before users, apps, or cutover steps depend on it.
Compare the successful interactive context with the actual automation runtime before rewriting a script.
Capture the exact symptom, Windows context, relevant logs, rollback signal, and validation criteria before SFC, DISM, reboots, uninstalls, Safe Mode, or other repair commands change the evidence you still need.
A read-only Windows Firewall audit that records enabled allow rules, ports, profiles, and address scopes.
Separate discovery, evidence coverage, baseline assessment, and verified compliance so a Windows patch report shows both what is known and what could not be proved.
A read-only Windows Server health snapshot that returns one compact row per host for uptime, disk pressure, memory headroom, stopped automatic services, and recent system errors.
A Windows Server-specific observe, compare, repair, validate workflow for one server that fails a monthly update while a peer succeeds, with proxy, update-source, servicing, applicability, CBS/DISM, and before/after evidence.
A patch readiness and repair evidence pack for reboot state, servicing health, update logs, and approved repair actions.
A staged Windows Update troubleshooting path that starts read-only and escalates only when needed.
A packet-capture triage guide for DNS, TLS, DHCP, SMB, RDP, retransmissions, and sensitive-data handling.
