Networking on Tom Meurs

Tailscale for Homelab: Secure Remote Access Without Port Forwarding

Sun, 10 May 2026 18:45:00 +0100

TL;DR Tailscale puts every device I own on one WireGuard mesh, so I reach the cluster in the closet from a coffee shop without a single port forwarded on the router. Subnet router, exit node, the Kubernetes operator, ACLs, and Headscale for the part I’d rather host myself, in that order.

My homelab cluster runs in a closet at home. I don’t. I work from coffee shops, from a client’s office, and now and then from a hotel with WiFi that seems to resent me. I still want my own machines while I’m out there.

Cilium: eBPF Networking for Kubernetes

Wed, 08 Apr 2026 20:23:00 +0100

TL;DR Cilium is the CNI I run in every cluster. It replaces kube-proxy and its iptables chains with eBPF programs in the kernel, enforces network policies on identity and on HTTP paths, and Hubble shows me every flow and every drop. WireGuard between the pods, BGP to the switch, no sidecars. My production values are at the bottom.

The first time a service stopped resolving in one of my clusters, I spent an evening reading iptables chains. Hundreds of rules, generated by kube-proxy, evaluated top to bottom. I never found the problem. I restarted the node and it went away.

Kubernetes Network Policies: A Visual Guide to Pod Security

Sat, 08 Feb 2025 19:34:00 +0100

Picture this: an attacker pops a single pod in your cluster, maybe through a vulnerable image or a leaked token. From that one foothold, they can reach every database, every internal API, every secret-fetching sidecar you run. Nothing stops them, because by default nothing tries to.

Network Policies are the thing that stops them. They turn “one compromised pod” into “one compromised pod, and that’s it.” Everyone knows they should use them. Almost nobody actually does, because the YAML looks scary and the behaviour is weird until the mental model clicks.