What I am actually defending against by self-hosting, what I accept instead, and why a written threat model stops scope creep in the lab.

How I passed the Intel GPU into both containers, enabled Quick Sync, proved a real Jellyfin transcode and checked Plex’s hardware path.

A practical way to carry an isolated Wi-Fi network across OpenWrt, managed switches and a UniFi access point without moving device management onto that VLAN.

What I learned while connecting Jellyfin and Navidrome to Authentik without breaking native media clients.

A practical checklist for changing a server hostname without leaving backups, SSH, monitoring or remote access pointing at the old name.

How a health script can run successfully while publishing an empty report, and how temporary files, validation and freshness checks prevent it.

A backup is not complete when the command exits: verify the snapshot, repository, monitoring and a representative restore.

An incremental way to improve logging, restart behaviour, health checks, exposure and backups without rebuilding a working Docker host.

A reference of every backup layer in my homelab, what data it protects, how fresh it is, and which failure each one actually recovers from.

What an isolated Navidrome database recovery rehearsal proved, how I kept it separate from production, and what remains untested.