Aswin's Homelab
Self-hosted homelab, home automation, and the debugging behind it.
Latest posts
11Governing a one-person GitHub org without locking myself out
I wanted every public repo in my org to enforce branch protection and required reviews. The catch: require one approval on a solo org and the owner's own PRs can never be approved — the repo bricks itself. The fix is a governance system that's careful about the exact order it does things.
Read43 red Dependabot PRs, and not one was the dependency's fault
My GitHub org had 43 open Dependabot PRs, most of them showing red CI. The obvious story is 'these upgrades break things.' The actual story is that a red check can lie exactly the same way a green one can — and telling the two apart is the whole job.
ReadA stranger emailed me about a leaked token. The scary part was the second one.
An unsolicited 'security alert' about a secret in one of my public repos turned out to be right — but chasing it down taught me two things worth more than the fix: 'revoked' in a dashboard doesn't mean a key is dead, and the leak I already knew about was hiding a second one I didn't.
ReadRebuilding my portfolio with an AI agent: the mistakes were the useful part
I rebuilt aswincloud.com pairing with an AI coding agent in my terminal. The interesting part wasn't 'AI wrote my site' — it's the loop that kept it honest: a bug I'd written and never noticed, an animation I swore was running but couldn't actually see, and two dependency bumps that quietly broke the build.
ReadA status page that survives its own death
A self-hosted uptime page for my home network — built on the one rule that makes monitoring trustworthy: 'no news' has to mean down, not up. The gadget is a Cloudflare Worker; the interesting part is the four ways it refuses to lie to me.
ReadI pasted the same crypto into four sites. Then I stopped.
Every self-hosted site I built needed the same login plumbing — signed sessions, password hashing, a constant-time compare. I copy-pasted it four times before admitting that's a security bug waiting to happen, and extracted it into one zero-dependency package that's public on purpose.
ReadTorrents by Telegram: a login that lies, and a rename button wired to SSH
A Telegram bot that adds torrents to my qBittorrent box — trivial. The parts worth writing down: getting a session that survives Cloudflare and doesn't trust its own login, and safely letting a chat reply rename files on my home server over SSH.
ReadTracking my own parcels: three carriers, three fights, one interface
Self-hosted shipment tracking for Indian couriers. Every carrier resists being tracked in a different way — one wants a phone call for API access, one only admits to its own shipments — so the real work is a uniform adapter over three hostile, inconsistent upstreams, plus a poller that only emails when something actually changed.
ReadGood Night Alert: an ESP32, an LDR, and three bugs I didn't expect
I wanted my Alexa to say 'good night' when I switch off the bedroom light. The gadget was trivial. Getting it reliable taught me more than the gadget did.
ReadA talking front gate: Sonoff door sensor → Alexa, and why it whispers at dawn
A door sensor that makes Alexa announce 'door open' — with a twist: it whispers between 6 and 9am so it doesn't blast the house awake.
ReadOne automation to watch every battery sensor in the house
A single daily Home Assistant automation that checks all my battery-powered sensors and only speaks up when one is actually running low — announced on Alexa and mirrored to Telegram.
Read