Home on Michael Köster

Layered Backup for a Kubernetes Homelab: snapper, btrbk, and a Raspberry Pi

Fri, 15 May 2026 00:00:00 +0000

Running Kubernetes on a single VPS is convenient — but it concentrates risk. Every application, every PVC, every bit of state lives on one machine. If that machine disappears, so does everything else. Backup is not optional here; it’s the difference between a recoverable incident and a weekend rebuild.

This post explains the backup strategy I settled on for my homelab and why the layers are the way they are. The full technical reference — including step-by-step restore commands — is in the homelab documentation.

Self-Hosted Cloud on a VPS: Fedora Server + MicroShift + GitOps

Tue, 12 May 2026 00:00:00 +0000

A complete walkthrough of running a Kubernetes-based self-hosted stack on a single VPS — WireGuard VPN, GitOps with Flux, Btrfs snapshots, wildcard TLS, and a full application suite including Nextcloud, Vaultwarden, Paperless, a mail stack, and monitoring. Everything bootstrapped from scratch. Every step documented.

This is written for a Linux administrator who wants to replicate the setup. All personal identifiers have been replaced with generic placeholders.

Last updated: 2026-05-15

Changelog
Why MicroShift?
Architecture Overview
Prerequisites
Step 1 — Base System
Step 2 — Btrfs Storage Layout
Step 3 — Firewall & WireGuard
Step 4 — MicroShift
Step 5 — GitOps with Flux CD
Step 6 — Wildcard TLS with cert-manager + acme-dns
Step 7 — Services
Step 8 — Operations & Automation
Step 9 — Backup & Disaster Recovery
Key Lessons Learned
Repository Structure

Changelog

What changed on 2026-05-15 (2):

Hardening a Self-Hosted Mail Server: fail2ban, Postfix, and Dovecot

Sun, 10 May 2026 00:00:00 +0000

My home server runs a full mail stack — Postfix, Dovecot, Rspamd, ClamAV — on MicroShift. It’s exposed directly to the internet on ports 25 and 587. That means it gets attacked. Here’s how I protect it, what the attacks look like in the logs, and how I recently tightened the configuration after spotting a gap.

The Threat Landscape

Two distinct attack types show up regularly in the logs:

1. SASL Brute-Force — Attackers try username/password combinations via SMTP AUTH or IMAP. The pattern: multiple IPs, each trying a different username, typically in parallel waves.

One Month of MicroShift: A Homelab Retrospective

Sun, 03 May 2026 00:00:00 +0000

One month in. The migration from Gentoo + Docker to Fedora Server 43 + MicroShift is complete and everything is running in production: mail stack, Nextcloud, Vaultwarden, Paperless, Collabora Online, monitoring, and this website — all on a single VPS, orchestrated by Kubernetes, managed by GitOps. So far, so good.

But let me be honest about the complexity. The full documentation runs to eight major sections covering base system, storage, firewall, WireGuard, MicroShift, GitOps, TLS, and eight services with their operational scripts. Behind that documentation are 368 commits across two repositories in four weeks — 232 in the GitOps manifests repo alone, 136 in the runbook. That’s not a “deploy and forget” setup. Every one of those commits represents something that had to be figured out, fixed, or explicitly decided.

Btrfs vs. OpenZFS: Why Snapshot Space Accounting Is Hard

Sun, 26 Apr 2026 00:00:00 +0000

Both Btrfs and OpenZFS are copy-on-write filesystems with native snapshots. On the surface they look similar. Under the hood, they handle one fundamental question very differently: who owns a block of data, and how do you account for it when snapshots share it?

I ran into this the hard way. Enabling Btrfs quotas on a system with hundreds of snapshots crashed my Kubernetes cluster every hour — reliably, for the same reason, until I figured out what was happening.

Running a Self-Hosted Cloud on MicroShift

Sun, 19 Apr 2026 00:00:00 +0000

My home server runs a full self-hosted stack on a single VPS: Nextcloud, Vaultwarden, Paperless-NGX, a complete mail stack (Postfix + Dovecot + Rspamd + ClamAV), Collabora Online, and monitoring via Grafana Cloud — all on MicroShift, managed by Flux CD, behind a WireGuard VPN.

The whole thing runs on Btrfs with hourly snapshots sent to a Raspberry Pi. A GitHub Action creates a snapshot before every GitOps push. grub-btrfs registers every snapshot in the GRUB menu. If something breaks, rolling back takes thirty seconds.

About

Mon, 01 Jan 0001 00:00:00 +0000

About me

I started out researching artificial intelligence at TU Clausthal, writing papers and presenting at conferences in Budapest and Taipei — which taught me to think in systems and explain complex things clearly. Then the real world called, and I ended up deep in enterprise infrastructure: SANs, hypervisors, data center migrations, and everything in between.

Over the years I’ve led teams at Funke Technology and Rossmann, growing from systems architect to running a department of more than 50 people. When the Server, Storage & Cloud team got split in 2023, I chose my own successor for the infrastructure half — trained them up, handed it over — and took the cloud side myself as Head of Cloud Platform. Since April 2025 I’m one level up, with five departments reporting to me as Head of Hybrid Platform Services & Datacenter: Central Systems (IBMi, output management, EDI), Database & Automation (Oracle, Postgres, MSSQL, Redis, Automic), Server, Storage & Compute, Cloud Platform, and BIT — which covers data center operations, UPS, power backup, passive cabling, and the compute infrastructure at our warehouse locations. That progression feels right: I like building things that outlast me.

Activities

Mon, 01 Jan 0001 00:00:00 +0000

Organizer (4)

Agent Contest: Multi-Agent Programming Contest
Co-Organizer (with Tristan Behrens, Jürgen Dix and Federico Schlesinger)
Sep. 2012, Clausthal-Zellerfeld, DE.

Agent Contest: Multi-Agent Programming Contest
Co-Organizer (with Tristan Behrens, Jürgen Dix and Jomi Hübner, Federico Schlesinger)
Sep. 2011, Clausthal-Zellerfeld, DE.

Agent Contest: Multi-Agent Programming Contest
Co-Organizer (with Tristan Behrens, Jürgen Dix and Jomi Hübner)
Sep. 2010, Clausthal-Zellerfeld, DE.

Board Games

Mon, 01 Jan 0001 00:00:00 +0000

List of my Board Games

Adel verpflichtet
A la carte
- A la carte - Dessert
- A la carte - Die Beilage (Spielbox)
Blox
Bohnanza
- Bohnanza Erweiterungs-Set
Carcassonne Big Box
- Carcassonne - Abtei & Bürgermeister
- Carcassonne - Brücken, Burgen und Basare
- Carcassonne - Burgfräulein & Drache
- Carcassonne - Die Schule (Gimmick)
- Carcassonne - Händler & Baumeister
- Carcassonne - Wirtshäuser & Kathedralen
Cuba
- Cuba - El Presidente
- Cuba - Gimmick (Spielbox)
Die Fürsten von Catan
Die Säulen der Erde
- Die Säulen der Erde - Erweiterung
- Die Säulen der Erde - Gimmick (Spielbox)
Dominion Basis
- Dominion Alchemie
- Dominion Blütezeit
- Dominion Hinterland
- Dominion Intrige
- Dominion Seaside
- Dominion Gimmick - Carcassonne
- Dominion Gimmick - Geldversteck
- Dominion Gimmick - Gesandter
Donna Leon - Gefährliches Spiel
Einfach genial (Würfelspiel)
Flussgeister
Freitag
Kuhhandel Master
Land Unter
Niagara
- Niagara - Flussgeister
- Niagara - Diamanten Joe (Gimmick)
Ohne Furcht und Adel
- Ohne Furcht und Adel - Die dunklen Lande
Pandemie
- Pandemie - Auf Messers Schneide
Siedler von Catan + Erweiterungen
Smallworld
Stone Age - Der Weg ist das Ziel
- Stone Age - Gimmick (Spielbox-Almanach)
- Stone Age - Mit Stil zum Ziel
Thurn und Taxis Big Box
- Thurn und Taxis - Alle Wege führen nach Rom
- Thurn und Taxis - Glanz und Gloria
- Thurn und Taxis - Gimmick (Spielbox)
Tobago
Ubongo 3D
Zug um Zug Europa

Impressum

Mon, 01 Jan 0001 00:00:00 +0000

Angaben gemäß § 5 TMG

Betreiber

Michael Köster
Lehmkuhlenweg 21
38179 Schwülper

Kontakt

E-Mail: postmaster@koester24.de

Hinweis

Dies ist ein privater Web- und Mailserver.

Publications

Mon, 01 Jan 0001 00:00:00 +0000

Books and Collections (2)

T. Behrens, J. Dix, M. Köster, J. Hübner
The Multi-Agent Programming Contest: Environment Interface and Contestants in 2010
In: Annals of Mathematics and Artificial Intelligence, Vol. 61, No. 4, Springer, 2011, Netherlands.
The original publication is available at www.springerlink.com

T. Behrens, M. Dastani, J. Dix, M. Köster, P. Novak
The Multi-Agent Programming Contest: History and Contestants in 2009
In: Annals of Mathematics and Artificial Intelligence, Vol. 59, No. 3, Springer, 2010, Netherlands.
The original publication is available at www.springerlink.com

Raps

Mon, 01 Jan 0001 00:00:00 +0000

Stress

ts, du willst stress? ich geb dir gern was ab #angebote
du chillst jetzt, während ich schwer zu tragn hab #paketbote
und kapierst nichts, zwar er-wart-bar #hammerstrophe
aber da das keine hilfe ist, verdammt-es karma #katastrophe
ist der crash nur ne frage der zeit: akti-endrama #dann kolchose
ist der crash nur ne frage der zeit: fernfahrer #handvoll tote
ich bin am ende des weges ang-elangt, mann #Tal - sohle
trotzdem fehlt mir respekt für all die versager #angeberpose

Home on Michael Köster

Layered Backup for a Kubernetes Homelab: snapper, btrbk, and a Raspberry Pi

Self-Hosted Cloud on a VPS: Fedora Server + MicroShift + GitOps

Table of Contents

Changelog

Hardening a Self-Hosted Mail Server: fail2ban, Postfix, and Dovecot

The Threat Landscape

One Month of MicroShift: A Homelab Retrospective

Btrfs vs. OpenZFS: Why Snapshot Space Accounting Is Hard

Running a Self-Hosted Cloud on MicroShift

About

About me

Activities

Organizer (4)

Board Games

List of my Board Games

Impressum

Betreiber

Kontakt

Hinweis

Publications

Books and Collections (2)

Raps

Stress