My Threat Model, Written Down
What I am actually defending against by self-hosting, what I accept instead, and why a written threat model stops scope creep in the lab.
Practical technology, documented
Hi, I’m Tahir — a Senior Technical Support Engineer and homelab enthusiast based in the West Midlands, UK.
I write about troubleshooting, Linux, Docker, self-hosting, backups, privacy and the projects I build at home. Everything here is based on practical experience: what worked, what failed and what I would do differently next time.
About me · Explore my homelab · Read the blog
What you’ll find here
- Homelab and self-hosting — reliable services, networking and monitoring
- Backups and recovery — designs that are tested, not just configured
- Linux and automation — Fedora, Docker and useful workflows
- Troubleshooting notes — clear fixes for real technical problems
Latest notes
The blog contains step-by-step guides and lessons from maintaining a personal infrastructure at home.
Enabling Intel N100 Hardware Transcoding for Plex and Jellyfin
How I passed the Intel GPU into both containers, enabled Quick Sync, proved a real Jellyfin transcode and checked Plex’s hardware path.
Carrying an Isolated Wi-Fi VLAN Across OpenWrt and Managed Switches
A practical way to carry an isolated Wi-Fi network across OpenWrt, managed switches and a UniFi access point without moving device management onto that VLAN.
Authentik with Jellyfin and Navidrome: Two Different Paths to One Identity
What I learned while connecting Jellyfin and Navidrome to Authentik without breaking native media clients.
Docker, NFS and TrueNAS: Getting Permissions and ACLs Right
How I handled different numeric identities across Docker and TrueNAS without renumbering established users.
Nextcloud Desktop Sync Exclusions and Diagnosis on Linux
How to separate folder connections, exclude unsuitable data and diagnose a Nextcloud desktop sync that will not settle.
How to Rename a Homelab Server Without Breaking Everything
A practical checklist for changing a server hostname without leaving backups, SSH, monitoring or remote access pointing at the old name.
Monitoring the Monitor with Atomic Status Files
How a health script can run successfully while publishing an empty report, and how temporary files, validation and freshness checks prevent it.
My Post-Backup Verification Checklist
A backup is not complete when the command exits: verify the snapshot, repository, monitoring and a representative restore.
Practical Docker Hardening for a Homelab That Is Already Running
An incremental way to improve logging, restart behaviour, health checks, exposure and backups without rebuilding a working Docker host.