A business database server (proprietary DBMS engine, on Ubuntu 22.04) froze one afternoon during a backup that had been running for months without a single incident. Eight minutes of downtime, no data lost, but I eventually traced the freeze back to a memory saturation event the previous night, through a seemingly completely different mechanism.
The Docker socket grants de facto root access to whatever machine exposes it. This post describes the pattern I set up to let a reverse proxy discover the containers on a remote Docker host without ever exposing that socket on the network: a point-to-point SSH tunnel, paired with a proxy that filters the API itself.
An entire fleet of VMs versioned, with a pipeline that verifies signatures and redeploys itself every 30 minutes. And then two or three machines, outside that system, whose state only lives on themselves. This post is about a case I see regularly, and rarely documented honestly: the technical debt that piles up on the exceptions to the very system you built yourself.
A fleet of about ten VMs that deploy themselves via ansible-pull every 30 minutes. Every so often, one of them stops converging, stuck on a gpg: waiting for lock or SQL library used incorrectly error. The cause: a task importing a GPG key that nothing used anymore, somewhere in a shared role run by every VM.
Replacing an admin team's static SSH keys with ephemeral certificates, issued on demand through OIDC authentication (Entra ID + MFA), valid for 10 hours. This post describes the architecture set up on a fleet of about ten VMs, and above all the two or three surprises you won't find in the docs until you've actually put it in production.
Deploying a fleet of VMs with no central server pushing configuration, no secrets vault permanently exposed, and a simple question asked on every cycle: "was what I'm about to execute signed by someone authorized?" This post describes the pull-based GitOps architecture I built around that question, and why it mechanically shrinks the attack surface compared to a classic push model.
How I centralized the management of all my Docker stacks with Dockhand, a modern tool that combines an intuitive web interface, Git versioning, and secure secrets management.
How I set up an external monitoring system with Zabbix to be alerted even if my Proxmox cluster goes down completely, using a local proxy, a remote VPS server, and a PSK encrypted connection.
How I configured Obsidian with the Git plugin to write and synchronize my blog posts and technical documentation, with custom templates and a clean Git workflow.
After deploying GREtap tunnels to extend my VLANs across my OpenWRT WiFi mesh, I encountered a frustrating issue: my SSH sessions would randomly freeze and require a complete restart. The cause? A classic MTU and fragmentation problem. Here's how MSS clamping solved the issue.