Every job in the homelab ends the same way: a fix, a note in my vault, and a lesson that only lives in my head. Unplugged is where those lessons go to live somewhere else.
It is an Open edX learning platform, the same open-source software behind edX and a long list of university course sites, running on my own Talos Kubernetes cluster built from four laptops. This week it stopped being infrastructure and started being a school.
What is under the hood
- Open edX, deployed with Tutor into its own Kubernetes namespace: the learning site, Studio for authoring, background workers, search and caching, ten deployments in all.
- An external MySQL database on a NAS, kept outside the cluster on purpose. Over six hundred tables, migrated in about forty minutes.
- One front door. A reverse proxy terminates HTTPS with a single certificate covering the learning site, Studio and the course catalog.
Getting it standing took the usual tour of the gremlin zoo. A setting change quietly flipped the web service from a load balancer to an internal-only address and turned the whole site into a 502 until a small Tutor plugin pinned it in place. The Studio login refused to work because its sign-in link still remembered the days before HTTPS was switched on. Neither is glamorous. Both are now lesson material.
Course one, written from a real incident
Earlier this week a pair of critical PHP bugs called PHP2Shell landed, and this site was running a vulnerable build. I wrote up how it got patched. Then I asked a better question: why should that only be a blog post?
So it became SEC101: Security Field Notes — Patching Under Pressure. Five units and a quiz, built from the real session: what the vulnerability is, measuring the version that actually runs, patching a container through the tool that owns it, rotating secrets that might have leaked, and the admin account that looked like a three-month-old intruder and turned out to be me.
Claude drafted the course from the session itself, in Open edX’s own course format, ready to import. Every internal address, hostname and username was scrubbed before packaging, and nothing reaches students without my review first. The quiz asks the questions I wish someone had asked me at 10 a.m. on patch day.
Honest status
The first import hit a wall worth knowing about if you run Open edX on Kubernetes: Studio’s upload lands in one pod and the import runs in another, and they share no disk. The command line inside the right pod gets it in today. Shared object storage is next, and it will fix more than imports, because course images should not depend on a pod never restarting.
The first of many
The plan is a pipeline. Real work happens. The session becomes a lesson draft. The draft is scrubbed, imported unpublished, reviewed, and opened. Kubernetes on old laptops, split DNS, reverse proxies, self-hosted password managers, a clean HDMI camera from a drawer of Raspberry Pis: every project on this site is a course waiting to be written.
Twenty-plus years of fixing things for other people taught me that the fix is half the job. The other half is making sure the next person does not need you. Unplugged is that half.