Posts on Thariq's workplace

Self-Hosting Ente Photos Behind a Cloudflare Tunnel: Preserving Request Integrity Through the Proxy Chain

Wed, 22 Jul 2026 02:56:00 +0530

Summary

This is a complete account of standing up Ente — an end-to-end encrypted photo and video backup service — on a home server, exposed to the internet through a Cloudflare Tunnel, with mobile and web clients connecting to it from arbitrary networks. The straightforward part of this project was running docker compose up. The interesting part, and the reason this write-up exists, is a single architectural constraint that determines almost every other decision in the stack: Ente’s storage layer issues AWS SigV4 pre-signed URLs directly to the client, and pre-signed URL validation is byte-for-byte sensitive to header mutation along the request path. Any reverse proxy sitting between the client and the object store is a candidate for silently breaking uploads and downloads — and Cloudflare’s edge, which every hostname routed through a Cloudflare Tunnel passes through, is exactly this kind of proxy.

Setup RKLLM Runtime on CM3588 (Rockchip RK3588)

Sun, 01 Mar 2026 14:26:00 +0530

Why did I do this?

Like always being bored is the reason for anything I do with tech. With the AI hype threatening my job (LOL), I wanted to play around with LLMs for actual daily use and not just generating slop.

Since I own FriendlyElec’s CM3588 board with RK3588 with 32GB ram and 256GB storage it was overkill for my home lab use with CF tunnel, K3s cluster and containers just serving me my flac files, Immich and occasional side projects which I never use. I was aware that this board has an NPU but I never had the time to play with it and run a model off it. I did try ollama in my desktop but it never made any sense because of the resource usage and power consumption.

Securing K3s With Lets Encrypt

Wed, 14 May 2025 19:55:46 +0530

🔐 TLS Certificates for Homelab Using Cloudflare + Cert-Manager + Let’s Encrypt

With Traefik operational as the ingress controller in a K3s cluster, the next logical step is to provision HTTPS automatically using Let’s Encrypt certificates, Cloudflare DNS validation, and Cert-Manager. This ensures encrypted traffic across services in a self-hosted homelab.

☁️ Prerequisites

A domain managed by Cloudflare
An API token with DNS edit permissions
Traefik installed and configured as the ingress controller
A functional K3s cluster with outbound internet access

🔧 Step 1: Install Cert-Manager

Install cert-manager using Helm

Building a Homelab with K3s

Tue, 13 May 2025 22:48:10 +0530

🚀 Self-Hosting with K3s and Traefik

Set up a lightweight Kubernetes cluster using K3s on a Raspberry Pi, deploy Traefik via Helm, and prepare for self-hosted services with ingress routing and local TLS.

🧰 Prerequisites

A Linux host with root access (e.g., Raspberry Pi or any ARM64/x86_64 board)
kubectl installed on a client machine
Helm 3 installed on the cluster (https://helm.sh/docs/intro/install/)

⚙️ Install K3s without Traefik

Skip the bundled Traefik and gain full control by managing ingress via Helm

Running Valheim Server on FriendlyELEC CM3588

Sun, 04 May 2025 18:58:31 +0530

🚀 Running the Valheim Server Using Docker Compose

The Docker Compose configuration we used to deploy a Valheim server on the FriendlyELEC CM3588 board/Arm SBC

version: "3"

services:
  raspiheim:
    image: arokan/raspiheim:latest
    container_name: raspiheim
    environment:
      - SERVER_NAME=Raspiheim
      - SERVER_PASS=Raspipass
      - WORLD_NAME=Raspiworld
      - PUBLIC=disabled
      - CROSSPLAY=disabled
      - UPDATE=enabled
      - SAVE_INTERVAL=1800
      - BOX86=default
      - BOX64=default
      - NO_BUILD_COST=disabled
      - PLAYER_EVENTS=disabled
      - PASSIVE_MOBS=disabled
      - NO_MAP=disabled
    ports:
      - "2456:2456/udp"
      - "2457:2457/udp"
    volumes:
      - "/path/to/valheim/data:/data"
      - "/path/to/valheim/server:/valheim"
    restart: unless-stopped

💡 Note: Replace /path/to/valheim/data and /path/to/valheim/server with actual absolute paths.

From Need to Solution: Home server

Sun, 01 Sep 2024 12:23:17 +0530

What is a Home Server?

Let’s start with the basics: what exactly is “the cloud”? It’s just someone else’s computer sitting in a data center somewhere—likely in a different country or even a different continent—managed by your friendly neighborhood cloud vendor (think Google, Amazon, Apple… you get the idea).

Now, about servers. The word “server” might sound intimidating, but it’s really just a computer that’s designed and dedicated to doing a specific job. And yes, your smartphone can technically be a server. Heck, if you’re really feeling adventurous, you could even turn your toaster into one (please don’t try this at home, though).

CRUD Application with Spring boot 3.3 and GraalVM native Image

Sun, 18 Aug 2024 18:58:31 +0530

Prerequisites

Docker
Java 21
Clone inventory-service

Introduction

This article is the second part of Low memory footprint with Spring boot 3.3 and Graalvm native image. Here, we will be building REST CRUD resources and package as a native executable within a container. We are using flyway for database versioning and springdoc library for swagger documentation with a web UI.

Flyway

Flyway is a database migration tool that helps you manage and apply database changes within your application to achieve database environment parity.

Low memory footprint with Spring boot 3.3 and Graalvm native image

Sun, 18 Aug 2024 11:58:14 +0530

What is a Native Image?

GraalVM native image is an ahead-of-time compilation technology that generates native executables. Native executables have low resource usage and fast startup time in compact packaging.

It is an ideal candidate for serverless workloads in Java.

I use it to create hobby projects, so I don’t exhaust my free tier quotas on services like fly.io 😉

GraalVM Native Image is a broad topic with many resources and videos available for a deeper understanding. The Official documentation is a great place to start.