Articles

Patching FreeBSD machines inside the DN42 overlay network without giving them clearnet access - a dual-homed VM that lazily caches pkg.freebsd.org, update.freebsd.org, and release tarballs from ftp.freebsd.org with nginx proxy_store, follows CDN redirects server-side, and serves everything over IPv6 into the mesh. Now also available as a public DN42 service at bsdmirror.chofstede.dn42.

FreeBSD 15.1-RELEASE is here, and the official upgrade instructions depend on whether your system uses distribution sets or packaged base. This guide walks through both supported paths, covers the boot-loader update, and explains the configuration merging process - all based on the official 15.1 upgrading documentation.

The third in the FreeBSD Foundationals series. This one covers how FreeBSD actually boots: the stages from power-on to login, BIOS vs UEFI, the loader and loader.conf, the difference between read-only tunables and runtime sysctls, the modern way to load kernel modules with kld_list, managing it all safely with sysrc, a practical security-hardening baseline, and - the headline act - boot environments with bectl, the undo button that turns a broken upgrade into a thirty-second reboot.

How I watch burningboard.net, my multi-jail FreeBSD Mastodon instance, from a separate observer host. A pull-based Prometheus stack reaching exporters across my own AS201379 backbone (locked down at the perimeter firewall, not by binding to unroutable addresses), Loki and Promtail for nginx logs, a textfile collector that fills the gaps FreeBSD exporters leave (ZFS, S3, pkg audit, Mastodon API stats), one Grafana dashboard that tells me at a glance whether the instance is healthy, and an Alertmanager ruleset that emails me before users notice.

For years I carried two iPhones, a personal iPhone 12 and a work iPhone SE, and neither ever felt at home in my Linux and BSD centric life. I finally collapsed both into a single Fairphone Gen6 running Android with separate personal and work profiles. Here is why I picked the Fairphone, how Android slots into a desktop Linux workflow far better than iOS ever did, which apps I kept, which I swapped, why finally being able to read GPG encrypted mail on my phone is a real upgrade, and where the device falls short.

A laid-back tour through the basics of IPv6: how the addresses are built, how to shorten them without losing your mind, how they map onto the IPv4 you already know, and how hosts configure themselves with SLAAC. Plus a short sidebar on NDP and why blocking ICMP on an IPv6 network is a self-inflicted wound. The premise throughout: IPv6 is the current internet protocol, IPv4 is a relic we are still dragging around, and dual-stack is a burden, not a destination. Updated 2026-06-12 with reader Q&A on privacy addresses, banning abusive clients, NAT64/DNS64, and port forwarding.

I moved into a top-floor 1970s apartment in one of the warmest corners of Germany, work from home, and needed the office to stay below “thinking is hard now”. A single-hose portable AC is a thermodynamically compromised machine, but most of what makes it bad happens at the window. Here is the personal story, a short detour into why these units leak, and the cheap XPS panel I cut to fix the part that actually matters.

The most interesting thing about AI in 2026 is not which frontier model wins this month’s benchmark. It is that the frontier became a commodity you rent through near-interchangeable clients, while the part with actual craft in it moved onto the integrated Radeon 780M in my laptop. Here is the tiered stack I actually run, with the local layer in detail because that is the unusual part, and the cloud layer kept brief because the pricing is on the vendors’ own pages and will be wrong by autumn.

A few months ago I bullied RHEL onto a ZFS root and it worked. This time I tried to get bcachefs running on RHEL 10, lost a whole evening to compile errors, and the kernel won. Here is the autopsy, plus what bcachefs actually is and why an out-of-tree filesystem and a conservative enterprise kernel are a terrible couple.

How I run a single quorate Proxmox VE cluster across two cheap Hetzner dedicated servers in two different datacentres, glued together with Hetzner vSwitches, a VXLAN overlay, an external QDevice for quorum, and one OPNsense firewall per node.