Home-Lab on Margrop Blog

Stop Fighting Over the Remote: Use DSM Scheduled Tasks to Lock a Kids' Video Folder Automatically

Sun, 05 Jul 2026 06:50:00 +0800

Short version

This is not an account lockout guide. The goal is narrower and cleaner: lock one kids’ video folder on a Synology DSM 7.2.1 NAS during selected hours, while leaving the account, password, homework folders, photo folders, and other shares alone. The script inserts one temporary deny ACL entry with synoacltool, removes that entry during open windows, backs up the ACL before each change, and verifies the result after each operation.

One sentence let Claude upgrade Ubuntu 22.04 to 24.04: a near-zero-screen-time cross-LTS run

Fri, 19 Jun 2026 10:58:00 +0800

TL;DR

A remote home-lab box had been sitting on Ubuntu 22.04.4 LTS (jammy, kernel 5.15) for a long time. After one sentence — “upgrade the box at 192.168.103.182 to Ubuntu 24.04” — Claude opened a tmux session to babysit the run, brought up a fallback sshd on port 1022 so a mid-upgrade sshd restart would not strand me, then drove do-release-upgrade -f DistUpgradeViewNonInteractive end to end. Twenty-five minutes later the host came back: kernel 6.8.0-124, every service still listening.

This is not a tutorial on do-release-upgrade; the Ubuntu docs already cover that. This is about what an Agent does once it gets an SSH handle on a box, why it does each step, and which pitfalls you have to clear out of the way before letting it loose.

Ubuntu shutdown stuck for 90 seconds? A Python asyncio service that won't honour SIGTERM, and how to fix it

Fri, 19 Jun 2026 10:58:00 +0800

TL;DR

After upgrading my home proxy box to Ubuntu 24.04, systemctl reboot stopped being fast: SSH would hang on for 90 seconds before the box actually shut down. journalctl made it obvious: smart-proxy.service: State 'stop-sigterm' timed out. Killing. — systemd sent SIGTERM, waited 90 seconds, nobody reacted, and SIGKILL was the only option left.

The root cause is not systemd’s fault and not Ubuntu’s fault. It is Python’s asyncio runtime not actually ending its child tasks when SIGTERM arrives — it is parked on a socket.recv and never voluntarily looks at the signal queue.

The fix has two halves, both required: (1) a systemd drop-in that lowers TimeoutStopSec from the default 90s down to 20s on the affected Python units; (2) inside the Python service itself, walk asyncio.all_tasks(), .cancel() the in-flight connection handlers on SIGTERM, and wrap self.stop() in asyncio.wait_for(..., timeout=10) as a safety net. After both halves, the same reboot drops from 90 seconds to one second.

Synology locked root behind three doors — I spent twenty minutes teaching it how to let me back in

Thu, 18 Jun 2026 16:30:00 +0800

TL;DR

Synology DSM, by design, ships with SSH disabled and root login prohibited — both sensible defaults. This guide walks you through “doing it the right way”:

Control Panel → Terminal & SNMP → Enable SSH (open the gate)

Log in as a normal user, then sudo -i to become root (borrow the landlord’s key first)

Edit /etc/ssh/sshd_config and set PermitRootLogin yes (tell the bouncer “root is family”)

synouser --setpw root xxx to set a root password, and append your public key to ~/.ssh/authorized_keys (hand back a key that can never be lost)

Total time: about twenty minutes. I’ll explain why every step exists using a “key and lock” metaphor, give you a 3-second vi crash course, list the error messages you’ll see, and answer the seven most common questions.

I dockerized AnythingLLM and the container turned into a wound-up squirrel — restarting forever until I handed it that magic 1000:1000

Wed, 17 Jun 2026 20:30:00 +0800

TL;DR

AnythingLLM, Mintplex Labs’ “stuff-anything-in-a-LLM” desktop, ships an official Docker image. In the happy path one docker run is all you need. But the in-container user anythingllm is picky: the host directory you bind-mount has to be owned by 1000:1000, otherwise it can’t write its own SQLite file, the Prisma migration step on startup crashes, and the container enters a restart-crash-restart loop. The fix takes under a minute: chown -R 1000:1000 /your/data/dir, then docker compose up -d again, and it dutifully listens on 3001.

I’ll also explain why Prisma’s file:../storage/anythingllm.db relative path is a footgun, give you a Portainer-ready stack file, and finish with a Q&A on the most common gotchas.

Home Network 1000Mbps but Games Stutter? A Complete Guide to Diagnosing and Fixing Bufferbloat

Sat, 30 May 2026 09:00:00 +0800

The Short Version

Your router has a hidden enemy called Bufferbloat — and it’s likely the reason your games lag even when your bandwidth test shows perfect speeds. When a router buffers too aggressively, download traffic fills up the queue and real-time traffic (games, video calls) gets stuck waiting behind thousands of buffered packets. Your speedtest stays at 950Mbps, but your game ping explodes from 50ms to 500ms.

In this article, I walk through the complete diagnosis and resolution of a Bufferbloat problem in a real home network environment using a multi-WAN iKuai gateway + ImmortalWrt soft router setup. The fix: deploying SQM (Smart Queue Management) + Cake qdisc on the ImmortalWrt layer, which reduced latency under full-speed download from ~300ms+ down to a stable ~12ms with zero configuration complexity.

All internal IP addresses, device hostnames, and network topologies have been sanitized for privacy.

After Buying a Domain, Use Cloudflare Tunnel to Turn Home Services into Public HTTPS

Thu, 21 May 2026 11:38:00 +0800

Short version

The previous two posts covered the cheap-domain part and the Cloudflare DNS part: buy a low-cost .xyz domain for personal lab use, then move the domain to Cloudflare for nameservers, DNS, DDNS, email routing, and basic automation. This post continues with the next practical step: use Cloudflare Tunnel to expose an internal web service as a public https:// hostname. The important point is that visitors use standard HTTPS on port 443, while your home router does not need to forward ports 80 or 443 and your origin IP does not need to be exposed.

This article follows these two posts:

“Ten Years for 80 Yuan: Why I Prefer 6-Digit .xyz Domains for Personal Sites”
Original link: https://mp.weixin.qq.com/s/tbefnWGFI0QBFlRVcYjVEw
“Do Not Waste That 80-Yuan Ten-Year Domain: Put It on Cloudflare First”
Original link: https://mp.weixin.qq.com/s/h0o-vtGB_zj1aptaumBztQ

Those posts already covered buying a cheap .xyz domain, moving nameservers to Cloudflare, creating DNS records, using DDNS, and setting up email-related records. This post assumes that your domain is already active on Cloudflare. We will focus on one thing: publishing an internal web service through Cloudflare Tunnel with a clean public HTTPS hostname.

All examples in this article use documentation placeholders such as example.xyz, nas.speedtest.example.xyz, 192.0.2.10, localhost, and <TUNNEL_TOKEN>. No real domain, account, token, zone ID, private network address, or personal information is included.

Ten Years for 80 Yuan: Why a 6-Digit .xyz Domain Is Good Enough for Personal Labs

Tue, 12 May 2026 19:10:00 +0800

Short version

If the domain is for a home lab, personal testing, temporary demos, API callbacks, development services, or other non-formal websites, I would first look at low-cost .xyz domains. In China, Tencent Cloud often makes this especially convenient for domestic users. For some pure numeric .xyz names with six or more digits, the checkout page may show a very low first-year and renewal price. If the price is 8 RMB per year, buying 10 years costs only 80 RMB.

This is not a recommendation for company websites, public products, serious brands, payment systems, or long-term marketing pages. For those, a readable and trustworthy brand domain is still worth the money.

When people start building a personal website, home lab, NAS callback endpoint, temporary API, reverse proxy, monitoring page, or small side project, they often overthink the domain name. Should it be a .com? Should it be short? Should it look like a real company? Should it use pinyin, English words, initials, or a private nickname?

My practical answer is: first decide what the domain is supposed to do.

If it is a serious public identity, choose the name carefully. If it is just a personal utility domain, do not spend too much money or attention on the name. In that case, the domain is not a brand asset. It is a stable handle for DNS, HTTPS, reverse proxy rules, ACME certificates, third-party callbacks, object storage, and temporary services.