<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet type="text/xsl" href="feed.xsl"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <id>https://thought-lite.vercel.app/</id>
    <title>Shane Tobar</title>
    <updated>2026-04-13T00:04:32.923Z</updated>
    <generator>https://github.com/jpmonette/feed</generator>
    <author>
        <name>Shane Tobar</name>
        <email>stob419@gmail.com</email>
        <uri>https://www.shanetobar.com</uri>
    </author>
    <link rel="alternate" href="https://thought-lite.vercel.app/"/>
    <subtitle>My personal site</subtitle>
    <logo>https://thought-lite.vercel.app/favicon-96x96.png</logo>
    <icon>https://thought-lite.vercel.app/favicon.ico</icon>
    <rights>CC BY-NC-ND 4.0 © 2025 Shane Tobar</rights>
    <entry>
        <title type="html"><![CDATA[We've Lost the Plot with Kon]]></title>
        <id>whats-up-with-kon</id>
        <link href="https://thought-lite.vercel.app/note/whats-up-with-kon"/>
        <updated>2026-04-07T22:37:56.000Z</updated>
        <summary type="html"><![CDATA[a report no one asked for, by nobody]]></summary>
        <content type="html"><![CDATA[<p>Kon Knuppel is having a great rookie season, do not get it twisted. Maybe even ROY. But all of the sudden we’re having discussions on All-NBA or a generational prospect. This is beyond insane. He has surpassed rookie expectations. This is whilst his team has had its healthiest season.</p>
<p>Knueppel is the product of genuine talent but also a team built to support him. The 3pt stats everyone talks about are great, but propped up by a LaMelo Ball having his healthiest season, Miller taking up defensive attention, Bridges having a decent year<sup><a href="#user-content-fn-1" id="user-content-fnref-1" data-footnote-ref="" aria-describedby="footnote-label">1</a></sup>, Diabate and Kalkbrenner, and having partially experienced the <a href="https://en.wikipedia.org/wiki/Cold_fusion" rel="nofollow noopener noreferrer" target="_blank">Cold Fusion</a> that is Collin Sexton.</p>
<p>I believe we are hovering the 90% mark of Knueppel, that is Duncan Robinson or Malik Beasley with a slight edge in ball movement. I could even see a Desmond Bane outcome. That’s unbelievable as a rookie! Approaching Sixth Man of the Year, maybe an All-Star appearance or two. The discourse around him feels like the perception is going to falter in the coming years towards Tyreke Evans<sup><a href="#user-content-fn-2" id="user-content-fnref-2" data-footnote-ref="" aria-describedby="footnote-label">2</a></sup> as growth stagnates.</p>
<p>My reasons for that are due to game tape I’ve seen and a bit of historical review.</p>
<p>The top historical rookie leaders in 3pt makes, excluding Knueppel, are the following:</p>
<ol>
<li>Keegan Murray</li>
<li>Donovan Mitchell</li>
<li>Damian Lillard</li>
<li>Brandon Miller</li>
<li>Saddiq Bey</li>
<li>Anthony Edwards</li>
<li>Luka Doncic</li>
<li>Landry Shamet</li>
<li>Steph Curry</li>
<li>Kyle Kuzma</li>
</ol>
<p>Knueppel breaks this record by a pretty sizeable 50+ makes. Looking at the list, we can start to gather how someone was able to do that. Keegan Murray was an always ready shooter who benefited from a fast pace Kings offense. Mitchell became the focal point of the offense almost immediately. Same goes for Lillard. Miller was thrust into that position by a hospital squad Hornets. I barely knew what happened with Bey, he is forever an enigma<sup><a href="#user-content-fn-3" id="user-content-fnref-3" data-footnote-ref="" aria-describedby="footnote-label">3</a></sup> to me. Antman is a flamethrower. Luka is Luka. Shamet was one of the only shooters on a 76ers team trying to compete. Steph was in an era where deep midranges ruled the shot chart. Kuzma was a needed offensive option on a tanking Lakers with Lonzo.</p>
<p>Not a single player on this list had the luxury of being an auxiliary scorer, having an elite passer, AND playing in the 3pt era that we are in now. None of these players had a LaMelo. Knueppel is <a href="https://www.pbpstats.com/season-stats/nba?EntityType=Player&#x26;EntityId=1642851&#x26;StatType=Totals&#x26;Table=Scoring" rel="nofollow noopener noreferrer" target="_blank">assisted on his 3pt attempts higher than seven of the top ten above</a> (Murray, Bey, and Shamet were higher). From this year, the runner up in 3pt makes (VJ Edgecombe<sup><a href="#user-content-fn-4" id="user-content-fnref-4" data-footnote-ref="" aria-describedby="footnote-label">4</a></sup>) has a 10% decrease in the percentage of threes assisted. Few had multiple quality scorers to take the heat off of them. What we’re witnessing is a great* shooter surrounded by a good, fast-paced, well coached* team that lets them just do their job. Shoot and be a connective tissue. They let him crash the glass with his size so that the bigs can focus on creating rebound opportunities and make up for the team’s perimeter defensive limitations. This is shown by his <a href="https://www.nba.com/stats/player/1642851/rebounds-dash?Season=2025-26&#x26;SeasonType=Regular%20Season" rel="nofollow noopener noreferrer" target="_blank">24% contested rebound percentage</a>, putting him with the likes of guards Shaedon Sharpe and Quentin Grimes. Players whose roles are to get buckets and not particularly trusted with securing boards in most circumstances, but are capable from time-to-time.</p>
<p>Speaking of which, the reports of Knueppel’s defense are greatly exaggerated. He’s a solidly below average defender and it’s okay to say that. He’s not catastrophic which is always great for your shooter<sup><a href="#user-content-fn-5" id="user-content-fnref-5" data-footnote-ref="" aria-describedby="footnote-label">5</a></sup>, but he’s not “good”. He can’t slide his feet and he’s pretty damn slow in a straight line. He uses his game recognition to attempt to be in the right place and his position size to avoid being backed all the way to the paint. The defense becomes a more effortful 2019 James Harden. Better, but problematic nonetheless. Teams have gone far with lesser spacing players, don't get me wrong. The new comparisons are Klay Thompson, who at his peak was an All-Defense player trusted to guard positions 1-4 throughout any game. We haven't even fully proven that Knueppel is the <em>shooter</em> that Thompson is/was, nonetheless capable of being the defender Thompson has been.</p>
<p>To conclude my rant, Kon Knueppel is having a fantastic season and nothing can take away from that. I'm just hesistant on him as "up-next".</p>
<p>PAQ (Potentially Asked Questions)</p>
<p>Am I a Hater?</p>
<ul>
<li>I don’t know, maybe? I’m genuinely not sure.</li>
</ul>
<p>Should He Be ROY?</p>
<ul>
<li>It could go either way with Flagg or Knueppel. Don’t think there’s a wrong choice this season.</li>
</ul>
<section data-footnotes="" class="footnotes"><p class="hidden" id="footnote-label">Footnotes</p>
<ol>
<li id="user-content-fn-1">
<p>Ew. <a href="#user-content-fnref-1" data-footnote-backref="" aria-label="Back to reference 1" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-2">
<p>What a <a href="https://youtu.be/WzOGDBhClAY?si=l-oVNrUdb910le3l" rel="nofollow noopener noreferrer" target="_blank">grade A hooper.</a> <a href="#user-content-fnref-2" data-footnote-backref="" aria-label="Back to reference 2" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-3">
<p>I mean this in the nicest way possible. Everytime I hear about him, it's because he lit up some team for 40pts. <a href="#user-content-fnref-3" data-footnote-backref="" aria-label="Back to reference 3" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-4">
<p>You can't hate this guy. <a href="#user-content-fnref-4" data-footnote-backref="" aria-label="Back to reference 4" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-5">
<p>Teams have gone far with much worse players as their primary spacer. <a href="#user-content-fnref-5" data-footnote-backref="" aria-label="Back to reference 5" class="data-footnote-backref">↩</a></p>
</li>
</ol>
</section>]]></content>
        <category term="nba"/>
        <category term="hornets"/>
    </entry>
    <entry>
        <title type="html"><![CDATA[Selfhosting T3Code (And not binding to Tailscale)]]></title>
        <id>selfhosting-t3code</id>
        <link href="https://thought-lite.vercel.app/note/selfhosting-t3code"/>
        <updated>2026-03-10T22:37:56.000Z</updated>
        <summary type="html"><![CDATA[spinning up another LXC...]]></summary>
        <content type="html"><![CDATA[<section class="heading" data-heading-rank="2" aria-labelledby="what-is-t3code"><h2 id="what-is-t3code"><a href="#what-is-t3code">What is T3Code?</a></h2>
<p>For those unfamiliar <sup><a href="#user-content-fn-1" id="user-content-fnref-1" data-footnote-ref="" aria-describedby="footnote-label">1</a></sup>, the aforementioned <a href="https://github.com/pingdotgg/t3code" rel="nofollow noopener noreferrer" target="_blank">T3Code</a> is a custom, perfomant web UI for OpenAI's <a href="https://github.com/openai/codex" rel="nofollow noopener noreferrer" target="_blank">Codex</a>.
The project was created by <a href="https://ping.gg/" rel="nofollow noopener noreferrer" target="_blank">Ping.gg</a>, the company run by <a href="https://youtube.com/@t3dotgg" rel="nofollow noopener noreferrer" target="_blank">t3dotgg</a>. It's in an early alpha state <sup><a href="#user-content-fn-2" id="user-content-fnref-2" data-footnote-ref="" aria-describedby="footnote-label">2</a></sup></p>
</section><section class="heading" data-heading-rank="2" aria-labelledby="whats-the-point-of-posting-this"><h2 id="whats-the-point-of-posting-this"><a href="#whats-the-point-of-posting-this">What's the point of posting this?</a></h2>
<p>I spent too much time on the setup I have now, so we're making it work for what I've done. I blew up my barebones Debian setup for the ever-loved <a href="https://www.proxmox.com/en/" rel="nofollow noopener noreferrer" target="_blank">Proxmox</a>, balancing LXCs and VMs. It will remain, and I will be stubborn!
After OpenAI doubled its rate limits<sup><a href="#user-content-fn-3" id="user-content-fnref-3" data-footnote-ref="" aria-describedby="footnote-label">3</a></sup> using the Codex desktop app, I started moving my workflow to the desktop version. Naturally, a few issues came up:</p>
<ul>
<li>Performance issues</li>
<li>Memory hogging</li>
<li>Aimed more for vibe-coders<sup><a href="#user-content-fn-4" id="user-content-fnref-4" data-footnote-ref="" aria-describedby="footnote-label">4</a></sup> or running multiple agents across multiple projects
<ul>
<li>Code diffs prior to write are annoying to view</li>
</ul>
</li>
</ul>
<p>In an attempt to give these GUI apps a try, it was only right to try the most newest, most hyped one. It's fun to try out the "bleeding edge" every now and then. Also Tailscale was mentioned...</p>
</section><section class="heading" data-heading-rank="2" aria-labelledby="okay-how"><h2 id="okay-how"><a href="#okay-how">Okay, How?</a></h2>
<p>The repo has a <a href="https://github.com/pingdotgg/t3code/blob/main/REMOTE.md" rel="nofollow noopener noreferrer" target="_blank">REMOTE.md</a> that provides a guide on remote access to the application. This works to expose the application over the LAN and host it on a Tailnet. However, there were a couple more steps to make this work in my Proxmox setup and have a proper subdomain rather than accessing the Tailscale IP or it's MagicDNS.</p>
<section class="heading" data-heading-rank="3" aria-labelledby="creating-a-home"><h3 id="creating-a-home"><a href="#creating-a-home">Creating a Home</a></h3>
<p>Typically, I run most of my services as containerized applications in a Debian VM. Since T3Code will be running directly on the host and possibly be short-lived, a new LXC seemed to be the best way to go. I spun up a new Debian 13 LXC<sup><a href="#user-content-fn-5" id="user-content-fnref-5" data-footnote-ref="" aria-describedby="footnote-label">5</a></sup> with 8GiB memory allocated, 10G of storage, 512MiB of swap, and a single CPU core. I definitely allocated more memory than necessary, so feel free to tune this down.
From there, I needed <a href="https://bun.com/" rel="nofollow noopener noreferrer" target="_blank">Bun</a> and Node to build the project. I chose to use <a href="https://github.com/Schniz/fnm" rel="nofollow noopener noreferrer" target="_blank">fnm</a> to manage the node installation on the LXC. Once Git was set up, it was time to move on.</p>
</section><section class="heading" data-heading-rank="3" aria-labelledby="a-couple-steps-more"><h3 id="a-couple-steps-more"><a href="#a-couple-steps-more">A Couple Steps More</a></h3>
<p>Clone it from GitHub. it's linked above.
Make sure that the Codex CLI is also installed, linked above.</p>
</section><section class="heading" data-heading-rank="3" aria-labelledby="running-the-application"><h3 id="running-the-application"><a href="#running-the-application">Running the Application</a></h3>
<p>For this step and the next, the T3Code docs cover it well. The only thing I found necessary to add was <code>VITE_WS_URL=wss://your.domain.com</code> as an environment variable if using a reverse proxy.
It can be useful to have a process manager like <a href="https://pm2.keymetrics.io/" rel="nofollow noopener noreferrer" target="_blank">pm2</a> to run T3Code in the background like <code>pm2 start "bun run --cwd apps/server start -- --host 0.0.0.0 --port 3773 --no-browser" --name t3code</code></p>
</section><section class="heading" data-heading-rank="3" aria-labelledby="reverse-proxy-and-dns"><h3 id="reverse-proxy-and-dns"><a href="#reverse-proxy-and-dns">Reverse Proxy and DNS</a></h3>
<p>I have a good enough domain that I use for my internal services, and T3Code was to become an accessible subdomain in Caddy. It's pretty straight forward to do this:</p>
<div class="code-container"><pre class="astro-code astro-code-themes github-light dark-plus" style="background-color:var(--block-color);--shiki-dark-bg:#1E1E1E;color:#24292e;--shiki-dark:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>t3code.your.domain {</span></span>
<span class="line"><span>        tls {</span></span>
<span class="line"><span>                dns cloudflare {$CLOUDFLARE_API_TOKEN}</span></span>
<span class="line"><span>        }</span></span>
<span class="line"><span>        reverse_proxy YOUR_T3_IP:PORT</span></span>
<span class="line"><span>}</span></span></code></pre><button type="button" data="t3code.your.domain {
        tls {
                dns cloudflare {$CLOUDFLARE_API_TOKEN}
        }
        reverse_proxy YOUR_T3_IP:PORT
}" class="code-copy-button" aria-hidden="" onclick="navigator.clipboard.writeText(this.attributes.data.value);this.classList.add(&#x22;code-copied&#x22;);window.setTimeout(() => this.classList.remove(&#x22;code-copied&#x22;), 1500)"><svg version="1.1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="copy-icon"><path d="M0 6.75C0 5.784.784 5 1.75 5h1.5a.75.75 0 0 1 0 1.5h-1.5a.25.25 0 0 0-.25.25v7.5c0 .138.112.25.25.25h7.5a.25.25 0 0 0 .25-.25v-1.5a.75.75 0 0 1 1.5 0v1.5A1.75 1.75 0 0 1 9.25 16h-7.5A1.75 1.75 0 0 1 0 14.25Z"></path><path d="M5 1.75C5 .784 5.784 0 6.75 0h7.5C15.216 0 16 .784 16 1.75v7.5A1.75 1.75 0 0 1 14.25 11h-7.5A1.75 1.75 0 0 1 5 9.25Zm1.75-.25a.25.25 0 0 0-.25.25v7.5c0 .138.112.25.25.25h7.5a.25.25 0 0 0 .25-.25v-7.5a.25.25 0 0 0-.25-.25Z"></path></svg><svg version="1.1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="done-icon"><path d="M13.78 4.22a.75.75 0 0 1 0 1.06l-7.25 7.25a.75.75 0 0 1-1.06 0L2.22 9.28a.751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018L6 10.94l6.72-6.72a.75.75 0 0 1 1.06 0Z"></path></svg></button></div>
<p>Create a DNS rewrite in Adguard or any other preferred DNS server, and there we go!</p>
</section></section><section class="heading" data-heading-rank="2" aria-labelledby="closing"><h2 id="closing"><a href="#closing">Closing</a></h2>
<p>Slight hiccups to getting this running in a non-traditional way, but smooth overall. I will say that so far it lives up to being a better alternative to the Codex desktop application. We'll see if my stance changes on GUIs in the next couple of weeks-months.</p>
<section data-footnotes="" class="footnotes"><p class="hidden" id="footnote-label">Footnotes</p>
<ol>
<li id="user-content-fn-1">
<p>Or chronically online <a href="#user-content-fnref-1" data-footnote-backref="" aria-label="Back to reference 1" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-2">
<p>Both described by the creator and by the fact that multiple commits have been written since I started writing this <a href="#user-content-fnref-2" data-footnote-backref="" aria-label="Back to reference 2" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-3">
<p>Not that I ever came close to the rate limits. Not much of an "agents" person <a href="#user-content-fnref-3" data-footnote-backref="" aria-label="Back to reference 3" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-4">
<p>No shade at the concept of vibe-coding or the like, but it's not quite what I'm going for at the moment <a href="#user-content-fnref-4" data-footnote-backref="" aria-label="Back to reference 4" class="data-footnote-backref">↩</a></p>
</li>
<li id="user-content-fn-5">
<p>For those unaware of creating one or don't have a template, there's always <a href="https://community-scripts.github.io/ProxmoxVE/scripts?id=debian&#x26;category=Operating+Systems" rel="nofollow noopener noreferrer" target="_blank">Proxmox Helper Scripts</a> <a href="#user-content-fnref-5" data-footnote-backref="" aria-label="Back to reference 5" class="data-footnote-backref">↩</a></p>
</li>
</ol>
</section></section>]]></content>
        <category term="Homelabbing"/>
        <category term="selfhost"/>
        <category term="code"/>
        <category term="ai"/>
        <category term="t3"/>
    </entry>
    <entry>
        <title type="html"><![CDATA[Tracking the Tank Commander Draft]]></title>
        <id>en/game_theory_tank_draft/game_theory_tank_draft</id>
        <link href="https://thought-lite.vercel.app/jotting/en/game_theory_tank_draft/game_theory_tank_draft"/>
        <updated>2026-03-01T00:00:00.000Z</updated>
        <summary type="html"><![CDATA[The tank commanders will carry March/April basketball]]></summary>
        <content type="html"><![CDATA[<p>I'm a big fan of the <a href="https://www.youtube.com/c/gametheorypodcastwsamvecenie" rel="nofollow noopener noreferrer" target="_blank">Game Theory podcast</a> hosted by Sam Vecenie and Bryce Simon. They do a great job explaining basketball for all levels of fans of the game. They recently did a "Tank Commanders Sicko Draft" (<a href="https://www.youtube.com/live/iYK5v8upsek?si=zrI5NBsEjid4O9-n" rel="nofollow noopener noreferrer" target="_blank">episode link</a>).</p>
<p>I <strong>love</strong> March/April basketball. The Corey Brewer 50-ball, Terrence Ross, that one time <a href="https://youtu.be/CwF9F6tdIF4?si=SytwLvBi_rlrNoID" rel="nofollow noopener noreferrer" target="_blank">Taurean Prince went toe-to-toe with Giannis</a><sup><a href="#user-content-fn-1" id="user-content-fnref-1" data-footnote-ref="" aria-describedby="footnote-label">1</a></sup></p>
<p>With all the chaos of the season, and not to speak of the world itself, it would be nice to track the points for these players incase the topic gets lost.</p>
<section class="heading" data-heading-rank="2" aria-labelledby="the-rules"><h2 id="the-rules"><a href="#the-rules">The RULES</a></h2>
<ul>
<li>Each 30 point performance equals 1pt in this challenge.</li>
<li>The match ends after the NBA regular season ends.</li>
</ul>
<p>That's it, pretty much.</p>
</section><section class="heading" data-heading-rank="2" aria-labelledby="teams"><h2 id="teams"><a href="#teams">Teams</a></h2>
<section class="heading" data-heading-rank="3" aria-labelledby="sam"><h3 id="sam"><a href="#sam">Sam</a></h3>
<ul>
<li>Rob Dillingham</li>
<li>Will Riley</li>
<li>Walter Clayton Jr.</li>
<li>Nique Clifford</li>
<li>Quenton Jackson</li>
</ul>
</section><section class="heading" data-heading-rank="3" aria-labelledby="bryce"><h3 id="bryce"><a href="#bryce">Bryce</a></h3>
<ul>
<li>Jaden Ivey</li>
<li>GG Jackson</li>
<li>Jay Huff</li>
<li>Justin Champagnie</li>
<li>Maxime Raynaud</li>
</ul>
</section></section><section class="heading" data-heading-rank="2" aria-labelledby="current-scores"><h2 id="current-scores"><a href="#current-scores">Current Scores</a></h2>
<section class="heading" data-heading-rank="3" aria-labelledby="team-scores-table-last-updated-03-21-2026"><h3 id="team-scores-table-last-updated-03-21-2026"><a href="#team-scores-table-last-updated-03-21-2026">Team Scores Table (LAST UPDATED 03-21-2026)</a></h3>
<div class="table-wrapper">



















































































<table><thead><tr><th>Team</th><th>Player</th><th>Score</th><th>Total</th></tr></thead><tbody><tr><td>Sam</td><td>Rob Dillingham</td><td>0</td><td></td></tr><tr><td>Sam</td><td>Will Riley</td><td>0</td><td></td></tr><tr><td>Sam</td><td>Walter Clayton Jr.</td><td>0</td><td></td></tr><tr><td>Sam</td><td>Nique Clifford</td><td>0</td><td></td></tr><tr><td>Sam</td><td>Quenton Jackson</td><td>0</td><td></td></tr><tr><td><strong>Sam's Total</strong></td><td></td><td></td><td><strong>0</strong></td></tr><tr><td>Bryce</td><td>Jaden Ivey</td><td>0</td><td></td></tr><tr><td>Bryce</td><td>GG Jackson</td><td>0</td><td></td></tr><tr><td>Bryce</td><td>Jay Huff</td><td>0</td><td></td></tr><tr><td>Bryce</td><td>Justin Champennie</td><td>0</td><td></td></tr><tr><td>Bryce</td><td>Maxime Raynaud</td><td>2</td><td></td></tr><tr><td><strong>Bryce's Total</strong></td><td></td><td></td><td><strong>2</strong></td></tr></tbody></table>
</div>
</section></section><section class="heading" data-heading-rank="2" aria-labelledby="notes"><h2 id="notes"><a href="#notes">Notes</a></h2>
<p>GG Jackson has to be a cheat code on this. He's been so close already (24pts and 28pts) and has proven to be an <a href="https://www.basketball-reference.com/players/j/jacksgg01/gamelog/2024" rel="nofollow noopener noreferrer" target="_blank">end-of-season offensive machine</a>. Also, considering how bad the Grizzlies are, Jackson might single-handedly carry Bryce's team.</p>
<section class="heading" data-heading-rank="3" aria-labelledby="032126"><h3 id="032126"><a href="#032126">03/21/26</a></h3>
<ul>
<li>I did not expect Raynaud to be the first on the board, even less so to do it twice. Props to him!</li>
<li>Dillingham likely won't make it on the board, but I have to say that he was impressive against the Cavs. The shiftiness was ever-apparent and it seems like his confidence is there which is critical to his game. His shot is consistently short though which seems as though it may be from releasing a <strong>little</strong> too late. Rooting for him though.</li>
</ul>
<section data-footnotes="" class="footnotes"><p class="hidden" id="footnote-label">Footnotes</p>
<ol>
<li id="user-content-fn-1">
<p>I miss Down2Buck... where am I going to get my obscure 23pt game from the 11th man on a lottery team? <a href="#user-content-fnref-1" data-footnote-backref="" aria-label="Back to reference 1" class="data-footnote-backref">↩</a></p>
</li>
</ol>
</section></section></section>]]></content>
        <category term="Basketball"/>
        <category term="Game Theory"/>
        <category term="NBA"/>
    </entry>
    <entry>
        <title type="html"><![CDATA[Split-Horizon DNS w/ Adguard, Caddy, and Tailscale]]></title>
        <id>en/adguard_dns_rewrite/adguard_dns_rewrite</id>
        <link href="https://thought-lite.vercel.app/note/en/adguard_dns_rewrite/adguard_dns_rewrite"/>
        <updated>2025-11-23T00:00:00.000Z</updated>
        <summary type="html"><![CDATA[How to configure split-horizon DNS in your homelab to maintain HTTPS and avoid having an always-on VPN connection]]></summary>
        <content type="html"><![CDATA[<section class="heading" data-heading-rank="2" aria-labelledby="what-is-split-horizon-dns"><h2 id="what-is-split-horizon-dns"><a href="#what-is-split-horizon-dns">What is Split-Horizon DNS?</a></h2>
<p>Split-Horizon DNS (or split-brain, split DNS, etc), is a form of providing DNS information based on the source of the DNS request.</p>
</section><section class="heading" data-heading-rank="2" aria-labelledby="why-implement-this"><h2 id="why-implement-this"><a href="#why-implement-this">Why Implement This?</a></h2>
<p>The typical case is to avoid exposing internal IP addresses to external users. Entities often have internal services that do not need to be accessible via the public internet, and exposing them opens up a much larger attack vector.<br>
For homelabbers, this case certainly applies. An additional case that I found important to myself is avoiding an always-on VPN connection. When initially building out the infrastructure of the services, using my reverse proxy's subdomain configuration required always having my Wireguard VPN (Tailscale) on. I'm ultra-conservative when it comes to the battery life of my devices, so this became a priority to address.</p>
</section><section class="heading" data-heading-rank="2" aria-labelledby="the-how"><h2 id="the-how"><a href="#the-how">The How</a></h2>
<section class="heading" data-heading-rank="3" aria-labelledby="prerequisites"><h3 id="prerequisites"><a href="#prerequisites">Prerequisites</a></h3>
<p>Before digging into this, a couple of notes. By this point, I had already provisioned Debian Linux Containers (LXCs) using <a href="https://proxmox.com/en/" rel="nofollow noopener noreferrer" target="_blank">Proxmox</a> for both <a href="https://caddyserver.com/" rel="nofollow noopener noreferrer" target="_blank">Caddy</a> and <a href="https://adguard.com/en/adguard-home/overview.html" rel="nofollow noopener noreferrer" target="_blank">Adguard Home</a>. The Caddy LXC had <a href="https://tailscale.com/kb/1031/install-linux" rel="nofollow noopener noreferrer" target="_blank">Tailscale</a> installed as well.</p>
</section><section class="heading" data-heading-rank="3" aria-labelledby="creating-a-subdomain-reverse-proxy-in-caddy"><h3 id="creating-a-subdomain-reverse-proxy-in-caddy"><a href="#creating-a-subdomain-reverse-proxy-in-caddy">Creating a Subdomain Reverse Proxy in Caddy</a></h3>
<p>Before we start working on our DNS server, we need to configure a reverse proxy for a local service of our choice. I'm going to use <a href="https://github.com/glanceapp/glance" rel="nofollow noopener noreferrer" target="_blank">Glance</a> as an example. We'll setup a subdomain glance.yourlab.com. To demonstrate this, I'm going to treat this domain as if it was purchased from Cloudflare. The Caddyfile would look like this:</p>
<div class="code-container"><pre class="astro-code astro-code-themes github-light dark-plus" style="background-color:var(--block-color);--shiki-dark-bg:#1E1E1E;color:#24292e;--shiki-dark:#D4D4D4; overflow-x: auto;" tabindex="0" data-language="plaintext"><code><span class="line"><span>glance.yourlab.com{</span></span>
<span class="line"><span>	tls {</span></span>
<span class="line"><span>		dns cloudflare {$CLOUDFLARE_API_TOKEN}</span></span>
<span class="line"><span>	}</span></span>
<span class="line"><span>	reverse_proxy YOUR_GLANCE_IP_ADDR:YOUR_GLANCE_PORT</span></span>
<span class="line"><span>}</span></span></code></pre><button type="button" data="glance.yourlab.com{
	tls {
		dns cloudflare {$CLOUDFLARE_API_TOKEN}
	}
	reverse_proxy YOUR_GLANCE_IP_ADDR:YOUR_GLANCE_PORT
}" class="code-copy-button" aria-hidden="" onclick="navigator.clipboard.writeText(this.attributes.data.value);this.classList.add(&#x22;code-copied&#x22;);window.setTimeout(() => this.classList.remove(&#x22;code-copied&#x22;), 1500)"><svg version="1.1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="copy-icon"><path d="M0 6.75C0 5.784.784 5 1.75 5h1.5a.75.75 0 0 1 0 1.5h-1.5a.25.25 0 0 0-.25.25v7.5c0 .138.112.25.25.25h7.5a.25.25 0 0 0 .25-.25v-1.5a.75.75 0 0 1 1.5 0v1.5A1.75 1.75 0 0 1 9.25 16h-7.5A1.75 1.75 0 0 1 0 14.25Z"></path><path d="M5 1.75C5 .784 5.784 0 6.75 0h7.5C15.216 0 16 .784 16 1.75v7.5A1.75 1.75 0 0 1 14.25 11h-7.5A1.75 1.75 0 0 1 5 9.25Zm1.75-.25a.25.25 0 0 0-.25.25v7.5c0 .138.112.25.25.25h7.5a.25.25 0 0 0 .25-.25v-7.5a.25.25 0 0 0-.25-.25Z"></path></svg><svg version="1.1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" class="done-icon"><path d="M13.78 4.22a.75.75 0 0 1 0 1.06l-7.25 7.25a.75.75 0 0 1-1.06 0L2.22 9.28a.751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018L6 10.94l6.72-6.72a.75.75 0 0 1 1.06 0Z"></path></svg></button></div>
<p>Where <code>CLOUDFLARE_API_TOKEN</code> is an environment variable set as part of <a href="https://github.com/caddy-dns/cloudflare" rel="nofollow noopener noreferrer" target="_blank">caddy-dns/cloudflare</a>. Make sure to write this in your Caddyfile and then reload the Caddy service for changes to apply.</p>
</section><section class="heading" data-heading-rank="3" aria-labelledby="configuring-adguard"><h3 id="configuring-adguard"><a href="#configuring-adguard">Configuring Adguard</a></h3>
<p>With our reverse proxy and Adguard up-and-running as a DNS server, let's configure some DNS rewrites. The DNS rewrite forwards queries for specified domains to the Caddy LXC IP, bypassing public resolvers.
To do this in Adguard Home, we can navigate to the DNS Rewrites page via Filters->DNS rewrites. From there, we can begin to create our rewrite with the <code>Add DNS rewrite</code> button. Let's configure it as such, replacing the information to match your domain/subdomain and reverse proxy IP address.</p>
</section><section class="heading" data-heading-rank="3" aria-labelledby="using-the-dns-server"><h3 id="using-the-dns-server"><a href="#using-the-dns-server">Using the DNS Server</a></h3>
<p>Finally, we need to point our client devices to the DNS server. There are a couple ways we can do this:</p>
<ul>
<li>The first way is to set the DNS server at the router-level, so that devices send DNS queries to the DNS address assigned by the router.</li>
<li>The second is to set the DNS server at the device-level so that the devices OS ignores the router DNS and instead reaches out to the designated DNS server IP.</li>
</ul>
<p>For now, we're going to set it at the client device level.
<br><strong>Note:</strong></p>
<blockquote>
<p>On an iPhone, go to <strong>Wi‑Fi → SSID info → Configure DNS</strong>.</p>
<blockquote>
<p>Set the DNS to “Manual” and enter your Adguard Home IP.</p>
</blockquote>
</blockquote>
<p>This should point all requests from this device to our Adguard Home DNS Server.</p></section></section>]]></content>
        <category term="Homelabbing"/>
        <category term="DNS"/>
        <category term="Networking"/>
        <category term="Tailscale"/>
    </entry>
</feed>