DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
WAF on a budget: protecting your app with Coraza + OWASP CRS, no enterprise price tag
A self-hosted WAF without enterprise licenses: Coraza — a Go engine compatible with ModSecurity SecLang — plus OWASP CRS v4, deployed in front of your app with a single docker-compose. Paranoia levels, false-positive tuning, resource footprint, and piping block events into Wazuh.
Falco in Kubernetes: syscall-level runtime protection, unified with Wazuh SIEM (part 6/6)
The finale of the Wazuh series: installing Falco in the cluster — the CNCF graduated project that intercepts syscalls from every container on a node. eBPF driver vs kernel module, the rule format, custom detects for shells and host-directory mounts, falcosidekick as the alert bus, and one dashboard for hosts, control plane, and runtime.
Wazuh and Kubernetes: collecting cluster audit logs and seeing who does what (part 5/6)
Part 5 of the Wazuh series: taking the SIEM beyond individual hosts and into Kubernetes — audit policy and its levels, shipping logs with Fluent Bit, a decoder for audit JSON, and rules for exec, secrets reads, and privileged pods mapped to MITRE ATT&CK for Containers.
Wazuh Active Response: automatically banning, isolating, and responding to incidents (part 4/6)
Part 4 of the Wazuh series: turning a fired detection into an automatic reaction — the anatomy of Active Response, the built-in firewall-drop, a custom nftables blocking script with a timeout and an admin-subnet safety exception, and how not to ban yourself.