https://andrew.khanoff.com/blogNotes on infrastructure, networking and self-hosting.enhttps://andrew.khanoff.com/blog/dc-power-systems-tracker/https://andrew.khanoff.com/blog/dc-power-systems-tracker/Wed, 10 Jun 2026 00:00:00 GMTA telecom site's quiet promise is that the lights stay on when the grid doesn't. This is the system that keeps watch over a fleet of Eltek DC power plants — discovering them from Zabbix, classifying them against editable per-vendor SNMP profiles, polling every fifteen minutes for metrics and component inventory, and letting operators steer controller parameters over SNMP behind hard guardrails: validate, confirm, set, read back, audit, revert.https://andrew.khanoff.com/blog/nginx-effective-access-policy/https://andrew.khanoff.com/blog/nginx-effective-access-policy/Wed, 10 Jun 2026 00:00:00 GMTnginx-acl-guard parses an nginx config with crossplane, computes the effective access policy for every server/location, and guards edits behind a pipeline that diffs effective access and refuses any unconfirmed widening — git backup, nginx -t on staging, atomic swap, rollback.https://andrew.khanoff.com/blog/a-self-translating-blog/https://andrew.khanoff.com/blog/a-self-translating-blog/Sat, 06 Jun 2026 00:00:00 GMTHow this blog works under the hood — posts live in SQLite and render Markdown at request time, an admin editor replaces build-time files, and a local Gemma model drafts the Russian and Ukrainian versions for me to review before they go live.https://andrew.khanoff.com/blog/asking-questions-of-a-ticketing-system/https://andrew.khanoff.com/blog/asking-questions-of-a-ticketing-system/Sat, 06 Jun 2026 00:00:00 GMTmaximo-ticket-tools — a read-only toolkit over an IBM Maximo trouble-ticket system: index it into a local Onyx RAG for natural-language questions, but answer 'how many' with deterministic queries, never the LLM. Plus a PoP-map dashboard and a Telegram watcher.https://andrew.khanoff.com/blog/renting-a-house-with-a-local-llm/https://andrew.khanoff.com/blog/renting-a-house-with-a-local-llm/Sat, 06 Jun 2026 00:00:00 GMThome.khanoff.com — a watcher that pulls fresh house-rental listings from two Ukrainian sources, scores each one against fuzzy human criteria with a local LLM, and pings me on Telegram. The model never sits on the ingest path.https://andrew.khanoff.com/blog/osbb-resident-portal/https://andrew.khanoff.com/blog/osbb-resident-portal/Sat, 06 Jun 2026 00:00:00 GMTosbb-wh.pp.ua — a private web cabinet for the members of an apartment association: announcements, documents, a car registry with licence-plate OCR, polls, tickets to the board and internal mail. No framework, no MySQL — PHP 8.3 and a SQLite file.https://andrew.khanoff.com/blog/migrating-from-wordpress/https://andrew.khanoff.com/blog/migrating-from-wordpress/Sat, 06 Jun 2026 00:00:00 GMTWhy I replaced a 475 MB WordPress install on andrew.khanoff.com with a single Astro container and a SQLite file — and how I did the cutover with zero downtime and a one-command rollback.https://andrew.khanoff.com/blog/github-gemma-pipeline/https://andrew.khanoff.com/blog/github-gemma-pipeline/Sat, 06 Jun 2026 00:00:00 GMTHow the Projects section on this site is filled automatically: a cron job reads my private repos, asks a local Gemma model to draft a blurb, and merges the result into SQLite — without ever overwriting my edits or leaking a private repo.https://andrew.khanoff.com/blog/family-knowledge-hub/https://andrew.khanoff.com/blog/family-knowledge-hub/Sat, 06 Jun 2026 00:00:00 GMTstart.khanoff.com — a warm, self-hosted hub for the whole family: documents, how-tos, recipes, links and videos behind one forgiving search box. FastAPI + HTMX + Meilisearch + Immich, magic-link login, PWA.https://andrew.khanoff.com/blog/building-a-self-hosted-cv/https://andrew.khanoff.com/blog/building-a-self-hosted-cv/Sat, 06 Jun 2026 00:00:00 GMTHow andrew.khanoff.com is built — server-rendered Astro, a SQLite single source of truth, passkey-only admin, and a daily GitHub→local-LLM pipeline that drafts the project cards.https://andrew.khanoff.com/blog/auto-blocking-attackers-with-bgp/https://andrew.khanoff.com/blog/auto-blocking-attackers-with-bgp/Sat, 06 Jun 2026 00:00:00 GMTSuri Defender: detection feeds (CrowdSec + fail2ban) drive an ExaBGP route-injector that announces offending IPs as RTBH routes over iBGP, so attack traffic is dropped at the network borders — not on the server. A 2.7 GB stack rewritten into a few hundred MB.