Systems Administration

This section documents the infrastructure behind this website and related technical projects (summarized in the IT section).

Architecture

This website is self-hosted on a Raspberry Pi running Raspberry Pi OS Lite. Nginx serves a static HTML/CSS/JavaScript site from a local web root. DNS points the public domain to my home network, and router port forwarding directs HTTP/HTTPS traffic to the Raspberry Pi. 

User Browser
     |
     v
nolanmusch.com DNS
     |
     v
Home Router / Port Forwarding
     |
     v
Raspberry Pi
     |
     v
Nginx Web Server
     |
     v
Static HTML / CSS / JavaScript
  • Server: Raspberry Pi running Raspberry Pi OS Lite
  • Web server: Nginx
  • Site type: Static HTML, CSS, and JavaScript
  • Version control: Private Git repository
  • Deployment: Git pull and rsync-based deployment script
  • HTTPS: Let’s Encrypt certificate managed with Certbot
  • Firewall: UFW with only required services exposed

Projects

Linux NAS Infrastructure & Service Platform

Built and administered a Raspberry Pi Linux NAS environment focused on storage, secure remote access, service reliability, and troubleshooting.

  • Configured Linux storage, mounted drives, permissions, and service directories.
  • Implemented WireGuard VPN for encrypted off-site access.
  • Deployed Python/FastAPI and PostgreSQL services with health checks and recovery workflows.
  • Practiced storage administration, service monitoring, and documentation.

Active Directory Homelab

Built a virtualized Windows Server lab to practice common help desk, desktop support, and junior systems administration tasks.

  • Configured Active Directory users, groups, OUs, permissions, DNS, DHCP, and Group Policy.
  • Joined Windows client virtual machines to the domain.
  • Tested login, DNS, DHCP, and GPO troubleshooting scenarios.
  • Documented repeatable support procedures for common domain issues.

Issue-Tracking System

Designed and deployed a Linux-hosted issue-tracking service to support structured incident and task management workflows.

  • Developed REST API endpoints for issue creation, assignment, filtering, and status tracking.
  • Implemented testing and validation to reduce regression risk.
  • Tested request handling, persistence, and failure recovery scenarios.
  • Documented architecture and workflows for maintainability.

Runbooks

These short operational notes describe repeatable procedures for managing this website and supporting infrastructure.

Deploying Website Updates
  1. Edit website files on local computer.
  2. Check locally python -m http.server 8000
  3. Commit changes to the private Git repository.
  4. Push changes to the remote repository.
  5. SSH into the Raspberry Pi.
  6. Pull the latest repository changes.
  7. Run the deployment script to copy files into the Nginx web root.
  8. Refresh the browser and check that the site renders correctly.
Checking Nginx Status and Logs
  1. Check service status with systemctl status nginx.
  2. Validate configuration with sudo nginx -t.
  3. Reload Nginx after configuration changes.
  4. Review access logs for incoming requests.
  5. Check error logs when pages, routes, or media files fail to load.
Checking HTTPS Certificate Renewal
  1. Review certificate status with Certbot.
  2. Confirm the renewal timer is enabled.
  3. Run a dry-run renewal test after configuration changes. sudo certbot renew --dry-run
  4. Confirm that both the root domain and www domain resolve correctly.
Mounting the Music Drive
  1. Identify the external drive with lsblk -f.
  2. Confirm the filesystem and UUID.
  3. Mount the drive to the configured mount point.
  4. Verify expected music files are present.
  5. Only expose selected public tracks through the Nginx music route.
Basic Recovery Checklist
  1. Confirm the Raspberry Pi is powered and reachable on the network.
  2. Check Nginx service status.
  3. Check DNS resolution and router forwarding.
  4. Review Nginx logs for errors.
  5. Redeploy from Git if site files are missing or incorrect.
  6. Restore from backup if required.

Security

The site is intentionally simple and static. No nonsense. This reduces the attack surface compared with a dynamic CMS, public database, or login-based application.

  • Only HTTP and HTTPS are intended to be publicly exposed.
  • SSH is used for administration but should not be publicly forwarded.
  • HTTPS is enabled with Let’s Encrypt and Certbot.
  • The Git repository is kept outside the public web root.
  • No public admin panel, database login, or CMS backend is exposed.
  • The music drive is not exposed directly; only selected public tracks are served.
  • Firewall rules are kept limited to required services.

Sensitive details such as private IP addresses, usernames, router configuration specifics, and internal paths are intentionally omitted from public documentation.

Maintenance

Maintaining this site involves routine updates, certificate checks, deployment testing, log review, and backups. The goal is to make the site understandable, functional, and scalable over time.

  • Apply operating system updates regularly.
  • Review Nginx status and logs when changes are deployed.
  • Test Certbot renewal after HTTPS or DNS changes.
  • Keep the website repository organized and version controlled.
  • Maintain a simple deployment script for repeatable updates.
  • Document problems and fixes as they occur.
  • Plan backups for website files, configuration files, and important media.
GitHub YouTube in