(Disclaimer - as with previous posts, this post was originally based on output generated by an LLM which I used to investigate and resolve the problem, though every word of it has been reviewed by my actual human brain, and meaningful edits were made)

I noticed something odd in my AdGuard Home dashboard: one host — culex¹, a Kubernetes control-plane node — appeared to be responsible for nearly 80% of all DNS queries on my network. My first thought was that something had gone wrong: a runaway process, a crashlooping pod making repeated lookups, or even something more sinister.

The reality was more mundane, though a neat opportunity to understand my tools a little better.

I’ve been using Tailscale as the VPN for my homelab for a while now, but I’d never actually tried to access my internal services from a remote location until recently. Turns out, just being on the tailnet doesn’t mean everything magically works - there were a few layers of configuration (and one very long detour) between “connected to Tailscale” and “watching Jellyfin from a hotel room.”¹

Remember when I set up Keycloak for SSO? Well, I’ve switched to Authentik, and it was surprisingly painless.