Security

01

15 min read

Self-hosted family SFTP: exposing a NAS without port forwarding using Pangolin + Newt + SFTPGo

Replacing an Internet-exposed SFTP with a Pangolin + Newt + SFTPGo stack: no port open on the NAS, outbound WireGuard tunnel, raw TCP SFTP served from a €3/month VPS. Including the traps: invisible provider firewall, SFTPGo defender useless behind NAT, broken PROXY protocol.

02

5 min read

Securing MCP API keys in Claude Code (and why it's urgent)

Your API keys are probably sitting in plain text in your mcp.json. Here's how to secure them with environment variable interpolation, a dedicated secrets file and deny rules.

03

9 min read

Internet censorship: technical solutions to stay connected

When a government blocks social media, there are technical solutions to bypass censorship. From a simple DNS change to a self-hosted VPN, an overview of methods ranked by difficulty.

04

14 min read

Sovereign VPN: Setting up your own server with Headscale in Switzerland

In this second part, we set up a self-hosted VPN with Headscale and an anti-censorship VLESS+Reality proxy (Xray) on a Swiss VPS. Both services share port 443 through nginx SNI routing.

05

5 min read

Secure remote access to your NAS with Tailscale

Setting up Tailscale as a WireGuard mesh VPN to access your NAS and entire local network from anywhere, without opening ports.

06

6 min read

Hardening your NAS Linux kernel to CIS Level 2 standards

Over 40 sysctl parameters, module blacklisting, GRUB settings and filesystem hardening to achieve CIS Level 2 security on Debian.