DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
Chaitin SafeLine WAF: zero-config self-hosted WAF — and a free Pro license for writing about it
The WAF story continues: SafeLine by Chaitin — a self-hosted WAF with a management console and a semantic engine instead of regex rules. We install the free edition with one command, test it on SQLi payloads, compare it with Coraza, and unpack the Content Contributor Program that hands out Pro licenses for articles like this one.
WAF on a budget: protecting your app with Coraza + OWASP CRS, no enterprise price tag
A self-hosted WAF without enterprise licenses: Coraza — a Go engine compatible with ModSecurity SecLang — plus OWASP CRS v4, deployed in front of your app with a single docker-compose. Paranoia levels, false-positive tuning, resource footprint, and piping block events into Wazuh.
Falco in Kubernetes: syscall-level runtime protection, unified with Wazuh SIEM (part 6/6)
The finale of the Wazuh series: installing Falco in the cluster — the CNCF graduated project that intercepts syscalls from every container on a node. eBPF driver vs kernel module, the rule format, custom detects for shells and host-directory mounts, falcosidekick as the alert bus, and one dashboard for hosts, control plane, and runtime.
Wazuh and Kubernetes: collecting cluster audit logs and seeing who does what (part 5/6)
Part 5 of the Wazuh series: taking the SIEM beyond individual hosts and into Kubernetes — audit policy and its levels, shipping logs with Fluent Bit, a decoder for audit JSON, and rules for exec, secrets reads, and privileged pods mapped to MITRE ATT&CK for Containers.