SysAdmin Weekly

When you are the only person standing between a working business and total collapse, the job stops being about doing everything and starts being about deciding what not to do this week.

Andy and Eric Siron tackle a listener-requested topic: you just became the solo SysAdmin, whether by hire, downsizing, or promotion, and now you own the firewall, the servers, the backups, and the printer nobody wants to replace. This one is heavy on the career and survival skills that keep a team of one sane: triage before projects, documentation as an insurance policy, buying time back through automation and managed services, and speaking business value instead of acronyms to leadership. Plus a News React on Windows Server hot patching and 1Password for Claude, and a Nerd Hour on Debian 13.6 Secure Boot certs and SAML auth for Nagios.

Chapters:
00:00:00 - You're the Only SysAdmin. Now What?
00:01:02 - Welcome and Show Plugs
00:05:13 - News React: Windows Server Hot Patching via Azure Arc
00:11:00 - News React: 1Password for Claude and AI Guardrails
00:13:50 - Nerd Hour: Debian 13.6 and Secure Boot Certificate Updates
00:16:33 - Nerd Hour: SAML Auth for Nagios via ADFS
00:23:20 - Main Topic: The Case of the Solo SysAdmin
00:28:23 - Triage Before Projects
00:30:57 - Note-Taking Systems: ARC, Bullet Journal, Rocketbook
00:46:40 - Documentation Is Survival and the Hit-By-A-Bus List
00:50:25 - Greenshot and Fast Screenshot Documentation
00:54:14 - Buying Time Back: Automation
00:58:16 - Buying Time Back: Managed Services
01:03:44 - Communicating Business Value to Leadership
01:09:09 - Managing and Documenting Risk
01:10:17 - Wrap-Up

Resources / Show Notes:

- MacRumors - 1Password for Claude lets AI log in without seeing your passwords: https://www.macrumors.com/2026/07/16/1password-claude-integration/

- Microsoft Learn - Enable Hotpatch for Azure Arc-enabled servers (now free for Windows Server 2025): https://learn.microsoft.com/en-us/windows-server/get-started/enable-hotpatch-azure-arc-enabled-servers

- Debian - 13.6 release notes and Secure Boot CA guidance: https://www.debian.org/News/2026/20260711

- Greenshot, free open-source screenshot tool: https://getgreenshot.org/

- Rocketbook, reusable notebook: https://getrocketbook.com/

- Bullet Journal method: https://bulletjournal.com/

- SysAdmin Weekly, all show links: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- SysAdmin Weekly GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

- Andy on Tech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

Somewhere between a $305 Raspberry Pi board and a used NVMe listing on eBay, the homelab hobby quietly stopped making financial sense.

Andy and co-host Eric Siron dig into why memory, NAND, and storage prices went vertical in 2026, who is actually eating the supply, and what practitioners should do about it. They cover the AI buildout swallowing the manufacturing capacity, why prices probably never return to pre-shortage levels, and the return of a skill the industry let atrophy: right-sizing hardware to the workload instead of throwing spec at it.

## Chapters:

00:00:00 - The Hardware Market Is Fire and Brimstone
00:01:18 - Welcome and Intros
00:04:33 - News React: The First Fully AI-Run Ransomware (JadePuffer)
00:08:16 - News React: AI Job-Blame and the Unix Lawsuit That Won't Die
00:13:32 - Nerd Hour: Thunderbird Finally Speaks Exchange Online
00:18:47 - Nerd Hour: Hugo, AI, and the 80% Problem
00:23:13 - Show Plugs
00:24:09 - Why Homelab Hardware Broke Me: The eBay Moment
00:41:44 - Why This Is Happening: AI Is Eating the Supply Chain
00:46:43 - Local Models and the Willingness-to-Pay Problem
00:52:41 - The New Normal: Prices Aren't Coming Back
00:59:05 - Right-Size the Hardware to the Problem
01:06:02 - Could China Break the Bottleneck?
01:09:29 - One More Casualty, and Wrap-Up

## Resources / Show Notes

- BleepingComputer, JadePuffer AI-run ransomware: https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/

- Thunderbird Blog, native Microsoft Exchange (EWS) support in 145: https://blog.thunderbird.net/2025/11/thunderbird-adds-native-microsoft-exchange-email-support/

- Raspberry Pi Foundation, memory-driven price rises: https://www.raspberrypi.com/news/more-memory-driven-price-rises/

- GamersNexus, SSDs WTF (NAND makers sold out for 2026): https://gamersnexus.net/features/ssds-wtf

- Gartner, surging memory costs (125% DRAM / 234% NAND surge): https://www.gartner.com/en/newsroom/press-releases/2026-02-26-gartner-says-surging-memory-costs-will-reduce-global-pc-and-smartphone-shipments-in-2026

- TechPowerUp, Samsung and SK Hynix $870B capacity plan and fab timelines: https://www.techpowerup.com/350478/samsung-and-sk-hynix-to-expand-semiconductor-capacity-with-usd-870-billion-plan

- BBC, Samsung's memory-driven profit surge: https://www.bbc.com/news/articles/c1kyy8yrpxdo

- IDC, why the memory market stays tight and makers aren't rushing capacity: https://www.idc.com/resource-center/blog/why-the-memory-market-is-still-tight-what-comes-next/

- Tom's Hardware, SK Group chairman says the shortage runs until 2030: https://www.tomshardware.com/pc-components/dram/sk-group-chairman-says-memory-chip-shortage-will-last-until-2030

- SemiAnalysis, China's CXMT challenging DRAM incumbents: https://newsletter.semianalysis.com/p/chinas-cxmt-is-set-to-challenge-dram

- Tom's Hardware, China's YMTC and homegrown NAND tooling: https://www.tomshardware.com/pc-components/ssds/chinas-ymtc-moves-to-break-free-of-u-s-sanctions-by-building-production-line-with-homegrown-tools-aims-to-capture-15-percent-of-nand-market-by-late-2026

- TrendForce, China's GPU makers scaling as enterprise accelerators: https://www.trendforce.com/news/2025/10/07/news-chinas-gpu-trio-rise-as-nvidia-retreats-decoding-moore-threads-metax-and-cambricon/

- CSIS, China and global cyber supply chain risk: https://www.csis.org/blogs/strategic-technologies-blog/chinas-weaponization-global-cyber-supply-chains

- AndyOnTech, Andy's hub for all his output: https://www.andyontech.com

- Project Runspace, the organization behind the show: https://www.projectrunspace.org

- SysAdmin Weekly GitHub Discussions, share your hardware battle stories: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

The hardest part of running a home lab in 2026 is not building it up; it is being honest about what earns its place.

Andy is joined by returning guest and member of the SysAdmin Weekly community, Clay Tamam, a working SysAdmin over in the Netherlands, for a real tour of what is actually sitting in their labs: the hardware, the hypervisors, the services they use every day, and the reasoning behind each choice. Andy explains why he tore a four-node Kubernetes cluster down to five VMs on a single Debian box, Clay walks through building a rack from scratch on a practical budget, and both of them dig into what current memory and hardware prices are doing to the hobby. It closes with the Graveyard: the gear and services that got powered off, and why pruning is an important part of the discipline.

## Chapters

00:00:00 - Welcome and a Returning Guest: Clay from the Netherlands
00:07:20 - News React: A US Firm's Bid for the Dutch DigiD Infrastructure
00:15:21 - News React: An AI-Assisted Hack Hits US Festival Ticketing
00:18:11 - Nerd Hour: Scoping AI Agents and Building a Lab From Scratch
00:24:29 - Main Topic: What Is Actually in Our Home Labs
00:25:15 - The Hardware: Andy's Pared-Down Single-Box Lab
00:31:25 - The Hardware: Clay's From-Scratch Rack Build
00:45:52 - The Foundation: KVM vs. Proxmox
00:56:33 - The Services That Earn Their Keep
01:02:37 - Self-Hosting, the Plex Price Hike, and Leaving Discord
01:13:57 - Learning Goals and the Graveyard
01:24:19 - Local Inference and the Urge to Panic-Buy
01:25:49 - Wrap-Up

## Resources / Show Notes

- Wired - Researcher used Claude to break Front Gate Tickets: https://www.wired.com/story/claude-helped-a-hacker-find-a-way-to-issue-tickets-to-almost-every-us-music-festival/

- NL Times - Netherlands blocks the US takeover of DigiD operator Solvinity: https://nltimes.nl/2026/05/26/netherlands-blocks-us-takeover-digid-operator-solvinity-security-concerns

- Security Now with Steve Gibson: https://www.grc.com/securitynow.htm

- Proxmox Virtual Environment and Backup Server: https://www.proxmox.com

- Forgejo, the self-hosted Git forge (Gitea fork): https://forgejo.org

- Tailscale, the overlay mesh VPN: https://tailscale.com

- Foundry Virtual Tabletop: https://foundryvtt.com

- Plex - New Lifetime Plex Pass pricing: https://www.plex.tv/blog/new-lifetime-plex-pass-pricing/

- Jellyfin, the free software media system: https://jellyfin.org

- Vaultwarden, a self-hosted Bitwarden-compatible server: https://github.com/dani-garcia/vaultwarden

- Framework Desktop: https://frame.work/desktop

- Connect with Clay on LinkedIn: https://www.linkedin.com/in/clay-tamam-00b6441b3/

- AndyOnTech: https://www.andyontech.com

A postmortem that ends with a name instead of a root cause wasted everyone's time in the room.

Andy and Eric Siron pull from a combined several-decades of incident reviews to break down what a postmortem actually is, what kind of outage earns one, and who really needs to be at the table. The throughline: keep it blameless without making it unaccountable, separate root cause from contributing factors, and remember that the follow-through is the entire point. Whether your postmortem is sixty people in a war room or just you writing a summary for one nervous boss, the discipline scales.

## CHAPTERS
00:00:00 - Why Postmortems Matter
00:01:31 - Welcome and Show Plugs
00:04:29 - News React: AI Job Hype Walkbacks, Teams Pain, Oracle Layoffs, AMD Trust
00:17:42 - News React: Ubiquiti UniFi OS Max-Severity RCE CVEs
00:19:41 - Nerd Hour: Claude Code, Hugo, and Pandoc
00:23:36 - The Incident Postmortem Process
00:26:40 - What Actually Earns a Postmortem
00:29:22 - Who Needs To Be In the Room
00:38:49 - Blameless, Not Unaccountable
00:46:50 - What Information To Gather
00:50:33 - Running the Review
00:55:15 - Follow Through Is the Whole Point

## RESOURCES / SHOW NOTES

- SysAdmin Weekly home and show links: https://www.sysadminweekly.com

- SysAdmin Weekly companion newsletter: https://newsletter.sysadminweekly.com

- AndyOnTech: https://www.andyontech.com

- Project Runspace: https://www.projectrunspace.org

- BleepingComputer - Ubiquiti patches three max-severity UniFi OS RCE flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910): https://www.bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/

- Postmortem markdown template (free, CC BY 4.0, version-tracked in the show repo): https://github.com/ProjectRunspace/sysadmin-weekly/blob/main/resources/postmortem_markdown_process_template.md

- Pandoc, universal document converter (Markdown to docx): https://pandoc.org

- Hugo, the Markdown-driven static site generator: https://gohugo.io

Ask Claude or ChatGPT to write a phishing email and it politely refuses; pull the right open-weight model onto your own laptop and that refusal layer simply does not exist in many cases.

Andy brings his InfoSecurity Europe session to the show, and Eric Siron joins to walk through how threat actors run local LLMs on their own hardware to generate targeted spear phishing at scale, in any language, with no internet connection and no guardrails.

The guys break down what the attack workflow actually looks like, why these capabilities never disappear once a model is downloaded, and where the real defensive line sits. Spoiler: "spot the typo" awareness training is dead, and verification culture plus strong email authentication is what carries the load now.

## Chapters:

00:00:00 - Cold Open: Local LLMs and Phishing at Scale
00:01:37 - Welcome Back and InfoSecurity Europe
00:03:55 - News React: Washington Pumps the Brakes on Fable
00:06:46 - News React: NY Ghost Gun Printing Law and Google AI Liability
00:12:07 - Nerd Hour: Camera Gear and Mac Studio Dreams
00:13:27 - Nerd Hour: Building the InfoSec Demo
00:15:55 - Show Plugs and Community Links
00:17:00 - Main Topic: What Local LLMs Actually Are
00:21:23 - The Guardrail Gap: Cloud Refuses, Local Complies
00:26:55 - The Demo: 15 Tailored Spear Phishing Lures in 90 Seconds
00:30:04 - Why These Capabilities Never Go Away
00:32:59 - AI on the Defensive Side
00:39:01 - Voice Cloning, Deepfakes, and SPF for Phones
00:46:20 - The Low-Tech Deepfake Defense
00:47:26 - Why Spot-the-Typo Training Is Dead
00:50:09 - Verification Culture and Email Authentication
00:54:32 - Common Questions: Legality, Detection, and Adoption
01:00:18 - Wrap Up: Stay Safe Out There

## Resources / Show Notes:

- Ollama, the easiest way to run open models locally: https://ollama.com

- Hugging Face, open repository of machine learning models: https://huggingface.co

- OpenCode, terminal coding agent that runs against local models: https://opencode.ai

- Evilginx, reverse-proxy phishing framework referenced in the demo: https://github.com/kgretzky/evilginx2

- SysAdmin Weekly Episode 024 - On-Prem AI with Ollama (Spotify): https://open.spotify.com/episode/1Huz7fy7axxOqjXei1HLI0

- SysAdmin Weekly - all show links in one place: https://www.sysadminweekly.com

- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com

- SysAdmin Weekly GitHub Discussions: https://github.com/ProjectRunspace/sysadmin-weekly/discussions

- Project Runspace: https://www.projectrunspace.org

- AndyOnTech: https://www.andyontech.com