Jevell's Lab

Jevell's Lab

Sign in Subscribe

Building a GitOps VM Provisioning Platform on Proxmox — Part 3: Terraform & the GitLab State Backend

Building a GitOps VM Provisioning Platform on Proxmox — Part 3: Terraform & the GitLab State Backend

Part 2 got Vault holding every secret behind a trusted TLS endpoint, with CI jobs able to authenticate using nothing but a short-lived GitLab-issued JWT. Now we put that to work. This is the Terraform layer — the code that actually turns "I want a VM" into a running

Building a GitOps VM Provisioning Platform on Proxmox — Part 2: Vault, Secrets & the JWT Trust Chain

Building a GitOps VM Provisioning Platform on Proxmox — Part 2: Vault, Secrets & the JWT Trust Chain

In Part 1 I made a claim I now have to back up: no credential in this pipeline is stored in GitLab. Not the Proxmox API token, not the SSH keys — nothing. That's not quite the whole truth. Exactly one value lives in GitLab's CI variables,

Building a GitOps VM Provisioning Platform on Proxmox — Part 1: Architecture & Proxmox Prep

Building a GitOps VM Provisioning Platform on Proxmox — Part 1: Architecture & Proxmox Prep

I got tired of clicking through the Proxmox UI every time I wanted a VM. Not because clicking is hard — because clicking isn't reproducible. I'd spin up a VM, install Docker, add my SSH key, set up a user, and a month later I'd

Automate Tactical RMM SSL with acme.sh & acme-dns

Automate Tactical RMM SSL with acme.sh & acme-dns

I manage endpoints for multiple clients using Tactical RMM — an open source, self-hosted Remote Monitoring and Management platform. If you're not familiar with RMM tools, the short version is: it's how I keep an eye on every workstation and server across every client without driving to

Traefik: My Reverse Proxy for VPS and On-Prem

self-hosted Featured

Traefik: My Reverse Proxy for VPS and On-Prem

If you run more than one service on a server, you quickly run into a problem: you only have one IP address and a limited number of ports, but you want clean URLs like ghost.yourdomain.com and keycloak.yourdomain.com, not yourip:8080 and yourip:8443. You also want

Self-Hosting acme-dns on a Hetzner VPS with Docker

Self-Hosting acme-dns on a Hetzner VPS with Docker

If you've ever tried to issue a wildcard TLS certificate — the kind that covers *.yourdomain.com — you've run into a hard requirement: the DNS-01 ACME challenge. And if you want to automate that challenge without handing your entire DNS zone over to a script, acme-dns is

Containerized Postfix SMTP Relay to Microsoft 365 with Certbot and Docker Compose

Containerized Postfix SMTP Relay to Microsoft 365 with Certbot and Docker Compose

Running a Containerized Postfix SMTP Relay to Microsoft 365 with Certbot and Docker Compose If you manage a Microsoft 365 tenant and need internal applications, printers, UPS units, or other devices to send email through Exchange Online, an SMTP relay is the standard solution. This post walks through building a

Why I'm Writing this, and What to Expect

Why I'm Writing this, and What to Expect

Over fifteen years of managing enterprise infrastructure, I've accumulated a specific kind of knowledge that rarely shows up in documentation: the workarounds, the edge cases, the "this should work but doesn't on Alpine Linux" moments that cost real hours to figure out. This blog