Today marks a milestone for my little homelab.

After weeks of tinkering, migrating, debugging, and occasionally questioning my own sanity, Illyachan is finally online. This isn’t meant to be a corporate blog or a place full of polished tutorials. Think of it as a development journal, a place to record what I build, what breaks, and what I learn along the way.

Today’s adventure was… eventful.

Moving Applications to the VPS

The original goal was simple: move my applications from my old server to a VPS.

Simple goals have a funny way of becoming twelve-hour debugging sessions.

By the end of the day, I had successfully migrated:

• XM7 CAFIN
• XM7 Authentication Service
• MariaDB databases
• nginx configurations
• SSL certificates
• Multiple websites

Along the way I rediscovered an old lesson:

Infrastructure isn’t hard because of the big things. It’s hard because of the hundred tiny things.

A missing symlink.
An OpenSSL configuration file.
A forgotten nginx rule.
A certificate that existed but wasn’t installed.

Each issue took only minutes to fix once identified, but finding the actual cause is where the real work happens.

Goodbye, Apache

One pleasant surprise was how much cleaner nginx feels.

The old Apache .htaccess rules translated into a handful of location blocks, making the routing logic much easier to understand.

For example, my authentication service only sends API requests through Laravel while serving the frontend directly:

location ~ ^/(api|user/avatar|organization/avatar|app/icon) {
    try_files $uri $uri/ /index.php?$query_string;
}

location / {
    try_files $uri $uri/ /index.html;
}

It’s simple, explicit, and much easier to reason about.

The OpenSSL Mystery

One login bug turned out to be completely self-inflicted.

JWT signing suddenly stopped working with mysterious OpenSSL errors.

After tracing the code, the culprit was this environment variable:

XM_AUTH_OPENSSL_CONFIG="/home/coatltec/ssl/openssl.cnf"

Of course…

There is no /home/coatltec on the VPS.

Copying the configuration file and updating the path immediately fixed token generation.

A good reminder that configuration tends to hide some of the most interesting deployment bugs.

WireGuard Everywhere

One of the best decisions I’ve made recently was introducing WireGuard.

The VPS, my home server (Kokonoe), my phone, and eventually other machines all communicate through a private network.

That means public services can live on the VPS while compute-heavy workloads stay safely inside my home.

My long-term plan looks something like this:

Internet
      │
      ▼
     VPS
      │
WireGuard
      │
 ┌────┴───────────┐
 │                │
Kokonoe       AI Nodes
                 │
               Alice
              Micchan

The VPS becomes the public gateway, while inference, storage, and internal services remain private.

It’s surprisingly elegant once everything starts working together.

WordPress, Why FTP?

After the Laravel migrations were complete, I installed WordPress for this very site.

Immediately it greeted me with:

Please enter your FTP credentials.

On my own VPS.

After a brief laugh, the fix turned out to be the classic:

define('FS_METHOD', 'direct');

Problem solved.

Sometimes software carries around compatibility features from twenty years ago, and today I got to experience one of them.

Looking Ahead

The infrastructure is finally reaching the point where I can stop thinking about servers and start thinking about software.

That’s exciting.

The next major project is ExMachina 8, a complete redesign of my authentication and multi-tenant architecture. XM7 has served me well, but it’s accumulated enough lessons that it’s time to build something cleaner from the ground up.

Hopefully the posts that follow won’t all be about nginx, certificates, and configuration files.

…though knowing myself, they probably will.

---

Until next time.