Notes

One problem per page: summary, symptom, cause, fix, how to verify, and what did not work.

• Automatic docker compose pull updates slowly fill the disk with dangling images working verified 2026-11-09

  Each docker compose pull + up -d leaves the previous image untagged (dangling). Nothing removes it, so weekly auto-updates grow /var/lib/containerd without bound. Run docker image prune --force --filter until=336h after the post-update health check passes.

• Disable USB autosuspend on Linux (USB Ethernet adapter drops after boot) working verified 2026-11-09

  Add the kernel parameter usbcore.autosuspend=-1 and regenerate the bootloader config (update-grub on Debian/Ubuntu, grubby on Fedora). Verify with cat /sys/module/usbcore/parameters/autosuspend → -1, and check that the adapter’s power/runtime_status reads active.

• Don’t pass credential-bearing URLs on the command line: they are readable in ps and /proc/<pid>/cmdline working verified 2026-08-05

  A pre-authenticated upload URL passed as a curl argument was visible to every local user for the whole multi-minute upload. Feed secrets to curl on stdin with --config - (or from a 0600 file) instead of argv.

• Expose a home server behind CGNAT through a VPS over Tailscale (Caddy for HTTPS, HAProxy for TCP) working verified 2026-11-09

  Without opening anything at home: put the home server and a public VPS on one tailnet, terminate HTTPS on the VPS with Caddy reverse_proxy to the server’s MagicDNS name, and forward raw TCP (game ports) with HAProxy in mode tcp. Do public-side rate limiting on the VPS, because the backend only sees the VPS’s tailnet IP.

• Expose local TCP services without port forwarding using frp (frps on a VPS, frpc at home) archived verified 2025-10-11

  Run frps on a public VPS (bindPort = 7000, auth.token) and frpc on any machine at home with one [[proxies]] block per service (type = "tcp", localIP, localPort, remotePort). Both run as systemd services.

• Gate automatic updates on backup freshness (bash + systemd pattern) working verified 2026-11-09

  Let an unattended update job run only if a verified local backup and an offsite-upload stamp are both younger than a threshold; otherwise skip with exit 0 and push DOWN to a heartbeat monitor. A broken backup then surfaces as a red monitor instead of an update without a restore point.

• GitHub Sponsor button not showing despite FUNDING.yml: enable hasSponsorshipsEnabled per repository working verified 2026-11-09

  A FUNDING.yml (per repo or in your account’s .github repo) is not enough. Each repository also needs its Sponsorships feature turned on, either under Settings → General → Features → Sponsorships or in bulk with the GraphQL updateRepository(input: {hasSponsorshipsEnabled: true}) mutation. The REST repo object has no such field.

• Keep a Linux laptop running with the lid closed (systemd-logind HandleLidSwitch) working verified 2026-11-09

  Set HandleLidSwitch=ignore, HandleLidSwitchExternalPower=ignore and HandleLidSwitchDocked=ignore in a drop-in under /etc/systemd/logind.conf.d/, then reboot. Check the effective config with systemd-analyze cat-config systemd/logind.conf.

• kitty terminal over SSH: ‘xterm-kitty’: unknown terminal type working verified 2026-11-09

  Remote hosts don’t have kitty’s terminfo, so nano, less, tput and line editing fail with Error opening terminal: xterm-kitty. and similar. Connect with kitten ssh (it copies the terminfo and sets up shell integration), or copy the terminfo once with infocmp -a xterm-kitty | ssh host tic -x -o ~/.terminfo /dev/stdin.

• OCI Object Storage: versioning + fixed-key overwrites quietly bill terabytes archived verified 2026-07-02

  With bucket versioning on, overwriting the same object name daily keeps every old copy as a noncurrent version. 3.26 GiB of current objects carried 1.78 TiB of versions and cost $29.93–$58.56/month. oci os object bulk-delete does not remove versions; delete by version-id.

• Unattended offsite backups with the official Proton Drive CLI working verified 2026-11-09

  Run the official proton-drive CLI from systemd on headless servers: log hosts in as a separate editor account (Proton has no scoped tokens), store the session in pass with a passphrase-less GPG key, set a readable working directory, and purge the owner’s trash yourself.

• Uptime Kuma push monitors: 24.8-day interval limit and the always-DOWN query string working verified 2026-11-09

  Uptime Kuma push intervals cannot exceed 2147483 s (~24.8 days, Node.js 32-bit timer). Monitor longer cadences with a weekly re-push of the last result. Also push to the bare /api/push/<token> URL: pasting the UI’s ?status=up&msg=OK&ping= URL and adding your own status makes every heartbeat record as DOWN.