News from Core Lab: October Rollup, Infrastructure Upgrades & What's Ahead (Nov '26)🗞️

Hello everyone, welcome to the November dispatch! October was one of the most intense, productive months in Core Lab since I started documenting self-hosted infrastructure. The weather wasn't even that bad?!

Between migrating my live server operating system and 70 Docker containers over to internal NVMe storage, hardening my perimeter firewall automation, launching the brand new Core Lab Hardware Store, and publishing a deep bench of production guides, there is a mountain of fresh engineering to share. Here is a complete rollup of the newest guides, architectural lessons, and infrastructure upgrades hitting the site since my September update.

You can also read the previous edition here: News from Core Lab: Summer is Over (Sept '26).

New Production Guides Published Since September

🌐 My 2026 Homelab Networking Stack: OPNsense, UniFi & 10GbE

• A full architectural breakdown of the physical Core Lab networking rack. I walk through my bare-metal OPNsense edge firewall with 2.5GbE WAN, silent UniFi USW-24 Layer 2 distribution switching, ceiling-mounted UniFi U6 Pro Wi-Fi 6 coverage, and the fanless Binardat 8-Port 10G SFP+ optical backbone linking my compute and storage nodes at 0dB.

My 2026 Homelab Networking Stack: OPNsense, UniFi & 10GbE

A real-world walkthrough of my 2026 homelab networking architecture: bare-metal OPNsense with 2.5GbE WAN, dual UniFi Gen2 switches, 10Gbps SFP+ storage backhaul, and Dockerized controller management.

Core LabCore Lab Joe

🔌 UGREEN USB 3.0 to 2.5GbE Adapter as an OPNsense WAN NIC

• Can a sub-$25 USB network adapter handle a saturated 1.5Gbps symmetrical fibre WAN connection 24/7 without melting or dropping packets? After logging 18 months of continuous production telemetry on the Realtek RTL8156B controller, I share my FreeBSD kernel tuning steps (if_ure driver configuration), thermal benchmarks, and why it has proven surprisingly bulletproof & boring! (Which is great)

UGREEN USB 3.0 to 2.5GbE Adapter as an OPNsense WAN NIC (Realtek RTL8156B, 1.5Gbps)

My 18-month field report: using a sub-$25 UGREEN USB 3.0 to 2.5GbE adapter (Realtek RTL8156B) as a plug-and-play OPNsense WAN NIC on a 1.5Gbps symmetrical fibre plan.

Core LabCore Lab Joe

💾 Automating OPNsense Backups: Hardened SFTP to NAS, Git Audits & REST API

• Having an edge firewall die without a current backup XML file is a nightmare. This guide covers a zero-touch, automated backup pipeline: scheduled encrypted configuration exports over key-only SFTP to OpenMediaVault, automated Git revision histories for visual diff tracking, and zero-dependency Python API scripts.

Automating OPNsense Backups: Hardened SFTP to NAS, Git Audits & REST API

How I automated my OPNsense firewall backups using hardened, key-only SFTP to OpenMediaVault, Git version control, and zero-dependency API scripts with full payload encryption.

Core LabCore Lab Joe

🚨 Cybersecurity Threat Intel: PHP RCEs & Tailscale Disclosures

• A practical breakdown of recent upstream vulnerability disclosures for self-hosters. I analyze the critical PHP CGI remote code execution vulnerability (CVE-2024-4577) and recent Tailscale SSH socket quirks, detailing why reverse proxy Web Application Firewalls (CrowdSec AppSec) and strict non-routable VLAN segmentation keep you protected even when upstream application software fails.

Cybersecurity Threat Intel: What the Critical PHP RCEs and Tailscale Disclosures Mean for Homelabbers

The past 72 hours delivered a brutal one-two punch: critical PHP RCEs ('php2shell') followed by a 12-hour-old Tailscale SSH socket vulnerability disclosure. Here is my technical breakdown and how I hardened my homelab.

Core LabCore Lab Joe

📉 The Post-Mortem: How an Aggressive Cache Strategy Sabotaged My Ghost Signups

• In the spirit of complete technical transparency, this post-mortem dissects an elusive bug that silently dropped my newsletter signups by 85%. A single-character pluralization typo combined with Cloudflare's counter-intuitive Page Rule evaluation order caused edge caching on dynamic magic-link authentication endpoints. I detail the exact curl testing methodology and NGINX/Cloudflare cache-bypass rules that fixed it.
• This same issue could be effecting your publicly exposed services as well.

The Post-Mortem: How an Aggressive Cache Strategy Sabotaged My Ghost CMS Signups

How a single-character pluralization typo and Cloudflare's counter-intuitive rule order silently broke Ghost CMS magic-link logins, tanking my newsletter signups by 85%.

Core LabCore Lab Joe

🐳 25 Best Docker Containers for Homelabs (2026 Architecture Blueprint)

• Moving far beyond generic top-10 lists, this comprehensive guide lays out the actual production container blueprint running in Core Lab. I cover 25 essential services organized across 12 discrete compose stacks on Debian and OpenMediaVault, detailing our Docker Compose include architecture, non-root UID/GID security mapping, and commercial SaaS replacements.

25 Best Docker Containers for Homelabs (2026 Architecture Blueprint)

Tired of endless 'what should I self-host' lists? Here is the complete production blueprint: 25 essential Docker containers across 12 modular stacks on OMV8, complete with VLAN isolation policies and SaaS cost replacements.

Core LabCore Lab Joe

⚡ The Hybrid Pipeline: Real-Debrid with a Usenet Backstop

• Tired of missing rare media releases or dealing with expired cloud hashes? This tutorial shows how to construct an automated hybrid download pipeline that prioritizes instant cloud debrid streams while keeping a metered Usenet block account as an automated backstop for older, obscure content.

The Hybrid Pipeline: Real-Debrid with a Usenet Backstop

Build the ultimate automated media pipeline by bridging Real-Debrid and Usenet. Learn how to use Sonarr delay profiles and a Block Account to create a 100% reliable backstop.

Core LabCore Lab Joe

Site Features & Infrastructure Upgrades

🛒 The Core Lab Hardware Store is Live

I recently launched a dedicated hardware catalog on Core Lab: the Core Lab Hardware Store (/shop/). Instead of burying product recommendations inside thirty different articles, the new store brings together all my verified homelab hardware across curated category shelves: high-density chassis, 10G optical switches, firewall micro-nodes, QuickSync transcoders, and enterprise storage. Every card features localized smart links, verified technical specs, and strictly zero static price traps.

Core Lab Hardware Store & Verified Gear Catalog

Explore my curated hardware recommendations: battle-tested chassis, multi-gigabit switches, low-power micro-nodes, and solid-state storage running live in production.

Core LabCore Lab Joe

🚀 Main Host NVMe OS & Live Container Migration

Late in October, I completed a major hardware and operating system migration on my primary production host (codex). The root operating system (previously running on an external USB-SATA SSD) suffered from UAS command-queuing stalls under heavy Linux I/O. I migrated the entire OpenMediaVault root OS and my 70-container Docker stack to an internal Samsung 970 EVO Plus M.2 NVMe SSD using block-level dd cloning and warm background rsync transfers.

The results have been phenomenal: container databases (Immich Postgres, Ghost MySQL, Paperless) saw immediate latency drops, and the per-stack downtime was held to under 60 seconds during final cutover. I am currently finalizing a complete, battle-tested step-by-step runbook detailing how to clone a live Debian/OMV OS drive and migrate Docker data-root with zero data loss.

Coming Soon:

The Dearly Departed: Homelab Edition 😥

What to do with your homelab if/when you pass?

Who should do what? When? How does your loved one even begin? This has been requested by more than 1 person so it's about 90% done! It'll be ready soon, published later this week.

The 2026 Black Friday Homelab Playbook

With November officially here, holiday sales promotions are starting to flood retail storefronts. Most Black Friday hardware guides are lazy copy-paste jobs designed to push whatever slow SMR hard drives or DRAM-less QLC solid-state drives retailers want to liquidate. I am putting the finishing touches on the 2026 Black Friday Homelab Hardware Playbook.

This guide will give you explicit target 'Buy Below' price thresholds in both Canadian Dollars (CAD) and US Dollars (USD), a built-in 'Homelab Trap Detector' to steer you away from catastrophic hardware bottlenecks, and direct links to the battle-tested equipment I run in my own lab (from Fractal Define 7 XL cases to 10G Binardat optical backhauls and GMKtec micro-nodes). Keep an eye on your inbox next week when it goes live!

Core Lab Reader Survey: What Should I Tackle Next?

As Core Lab continues to expand, I want to make sure the technical guides, post-mortems, and hardware reviews align directly with the projects you are tackling in your own homelabs. If you have two minutes, please hop over to the Core Lab Reader Survey and let me know what topics, tools, or pain points you would like to see covered next.

Thank you all for your continued support, reading, and comments. Stay secure, and happy self-hosting!