Terms that appear across this site, defined for a general technical reader. The posts link here rather than re-explaining each time.
Where a term names a specific piece of software, it links to that project. Almost all of them are free and open source, maintained by people who owe you nothing — there is a way to say thank you.
Infrastructure
Hypervisor — software that runs virtual machines. The physical server is the host; the virtual machines on it are guests.
Proxmox — an open-source virtualization platform: it runs many virtual machines on one physical server, and manages several such servers as a group.
Cluster — several hypervisors managed as one, so a virtual machine can move between them.
Quorum — the majority agreement a cluster needs before acting. Without it, a network split can leave both halves believing they are in charge, each writing to the same storage. That specific disaster is called split-brain.
QDevice / witness — a third machine that exists only to cast a tie-breaking quorum vote. It runs no workloads. Two-node clusters need one.
High availability (HA) — automatically restarting a workload elsewhere when its host fails. Not the same as no downtime; the machine still restarts.
Passthrough — giving a virtual machine direct hardware access, typically a GPU. Faster than emulation, but the device belongs to that one guest.
Storage
ZFS — a filesystem that checksums everything it stores and can detect and repair silent corruption. Favoured for data whose integrity matters more than its size.
RAIDZ2 — a ZFS layout surviving any two simultaneous drive failures.
BTRFS — another checksumming filesystem with snapshots, used here on the bulk storage tier. Chosen there for capacity and the appliance’s native support rather than for ZFS’s stronger guarantees.
SLOG / L2ARC — SSDs used to accelerate ZFS writes and reads respectively. Neither stores the only copy of anything.
NFS — a protocol for mounting remote storage over the network as if it were local.
Dataset — a named, independently-configurable division of a storage pool.
Networking
VLAN — one physical network divided into several logical ones that cannot talk to each other without deliberate routing.
RFC 1918 / private addressing — address ranges reserved for internal use and not routable on the public internet.
Reverse proxy — a server that accepts requests on behalf of others behind it, handling TLS and routing by name. This lab uses Caddy.
Tunnel — a persistent encrypted connection between two networks. Here it is established outward from home, so the home firewall needs no inbound ports.
Rathole — the self-hosted tunnel software in use. Rust, single binary, TLS-encrypted.
WireGuard — a modern VPN protocol; small, fast, and simple enough to audit.
Mesh VPN / Headscale — software that lets enrolled devices reach each other directly wherever they are. Headscale is the self-hosted coordination server for the Tailscale client ecosystem.
Split-horizon DNS — the same name resolving differently inside and outside a network. Here they are maintained as two deliberate records rather than one clever one.
TTL — how long a DNS answer may be cached. Short TTLs make failover fast and increase query volume.
Security and identity
Single sign-on (SSO) — one login for many services.
Identity provider (IdP) / Authentik — the system that owns accounts and authenticates users. Applications delegate to it rather than keeping their own user databases.
OIDC / SAML — the two common protocols for that delegation. OIDC is the newer and simpler one.
forward_auth — a fallback for applications that cannot speak OIDC: the reverse proxy checks with the identity provider before passing the request through. It is a gate in front of the app’s own login, not true single sign-on — you often end up logging in twice. Worth naming honestly rather than advertising as SSO.
MFA — requiring a second factor beyond a password.
ACME / Let’s Encrypt — the automated protocol and the free certificate authority that made real TLS certificates routine.
DNS-01 challenge — proving domain control by writing a DNS record rather than serving a file over HTTP. The only practical way to obtain a real certificate for a name that is not publicly reachable.
CrowdSec — intrusion detection that shares attacker-IP reputation across its user base. Valuable at an internet-facing edge; largely pointless internally, where attacks do not arrive from the public internet.
SIEM / Wazuh — Security Information and Event Management: collects logs from every host and alerts on patterns. Wazuh is the open-source one used here.
IoC — Indicator of Compromise. A concrete artifact suggesting a breach.
SBOM / Syft / Grype — a Software Bill of Materials lists everything inside a container image; Syft generates them and Grype checks them against known vulnerabilities.
CVE — a public identifier for a specific known vulnerability.
Operations
Runbook — a step-by-step procedure for building or operating something, written to be followed exactly.
Errata — corrections to those runbooks, discovered by reality.
Idempotent — safe to run repeatedly; the second run changes nothing. The core property that makes automation trustworthy.
Ansible — configuration-management software that applies a described state to a machine over SSH, without installing an agent.
Drop-in configuration — a small file in a .d directory that extends a main config. Ordering rules vary by program, and getting that backwards has its own post.
Pinning — specifying an exact software version rather than “latest”, so deployments are reproducible.
RTO — Recovery Time Objective: how long restoring service is allowed to take.
Blast radius — how much breaks when one component fails.