Archives
All the articles I've archived.
The same architecture, self-hosted: rebuilding the part-1 AWS serverless diagram on your own VM for $0/mo (part 2/2)
We rebuild the part-1 serverless diagram on our own VM: Kong instead of API Gateway, Node.js instead of Lambda, PostgreSQL, MinIO, Keycloak, RabbitMQ, and Prometheus — the whole stack in one docker-compose.yml. What translates one-to-one, what has to be rewritten, and where the real difference between $0/mo and nearly-free serverless lies.
A minimal app architecture on AWS: a serverless stack — what every service does and how to read the diagram (part 1/2)
We take a reference serverless app diagram on AWS apart layer by layer: Route 53, CloudFront, S3, API Gateway, Lambda, DynamoDB, SQS, Cognito, CloudWatch — what each service does and why it hurts without it. A minimal SAM template rebuilds a copy of the diagram in one evening.
Chaitin SafeLine WAF: zero-config self-hosted WAF — and a free Pro license for writing about it
The WAF story continues: SafeLine by Chaitin — a self-hosted WAF with a management console and a semantic engine instead of regex rules. We install the free edition with one command, test it on SQLi payloads, compare it with Coraza, and unpack the Content Contributor Program that hands out Pro licenses for articles like this one.
WAF on a budget: protecting your app with Coraza + OWASP CRS, no enterprise price tag
A self-hosted WAF without enterprise licenses: Coraza — a Go engine compatible with ModSecurity SecLang — plus OWASP CRS v4, deployed in front of your app with a single docker-compose. Paranoia levels, false-positive tuning, resource footprint, and piping block events into Wazuh.
Falco in Kubernetes: syscall-level runtime protection, unified with Wazuh SIEM (part 6/6)
The finale of the Wazuh series: installing Falco in the cluster — the CNCF graduated project that intercepts syscalls from every container on a node. eBPF driver vs kernel module, the rule format, custom detects for shells and host-directory mounts, falcosidekick as the alert bus, and one dashboard for hosts, control plane, and runtime.
Wazuh and Kubernetes: collecting cluster audit logs and seeing who does what (part 5/6)
Part 5 of the Wazuh series: taking the SIEM beyond individual hosts and into Kubernetes — audit policy and its levels, shipping logs with Fluent Bit, a decoder for audit JSON, and rules for exec, secrets reads, and privileged pods mapped to MITRE ATT&CK for Containers.
Wazuh Active Response: automatically banning, isolating, and responding to incidents (part 4/6)
Part 4 of the Wazuh series: turning a fired detection into an automatic reaction — the anatomy of Active Response, the built-in firewall-drop, a custom nftables blocking script with a timeout and an admin-subnet safety exception, and how not to ban yourself.
Wazuh: writing custom rules and decoders so your SIEM doesn't drown in noise (part 3/6)
Part 3 of the Wazuh series: the anatomy of rules and decoders, a custom SSH brute-force detection with a threshold you own, a decoder for your application's JSON logs, overriding default rules instead of editing them, and testing everything with wazuh-logtest without restarting the manager.
Wazuh: enrolling agents, turning on FIM and rootcheck for Linux and Windows (part 2/6)
Part 2 of the Wazuh series: enrolling agents on Ubuntu and Windows — automatically via authd or manually with keys — enabling syscheck FIM with realtime and whodata, plus rootcheck, a CIS SCA policy and agent groups. The real question: how to get signal instead of a stream of alerts about benign changes.
Wazuh from scratch: standing up an open-source SIEM/XDR in one evening (part 1/6)
Kicking off a series on Wazuh, the free open-source SIEM/XDR. Part one is installation only: manager, indexer and dashboard via Docker Compose, TLS certificates, first login, and an honest look at how single-node differs from production.
Cilium Tetragon: eBPF runtime security that blocks, not just logs
Falco and most eBPF security tools can only alert after the fact. Tetragon, Cilium's runtime security engine, can do more — kill a process synchronously in the kernel before the syscall even returns. We break down the TracingPolicy anatomy, enforcement risks, and the safe rollout pattern: audit first, Sigkill later.
containerd 1.x is done: what breaks moving to containerd 2.0 before Kubernetes 1.36
Kubernetes 1.35 is the last release that still supports containerd 1.x. We break down what actually changes in config.toml v3, the CRI plugin, and CDI for GPUs, and how to roll containerd 2.0 out node by node with zero downtime.
PreDelete hooks in Argo CD 3.3: why deleting resources in GitOps was quietly dangerous
Argo CD 3.3 adds PreDelete hooks — a gate before an actual prune that simply didn't exist before. We cover what changed, the hook-delete-policy semantics, and how to protect stateful resources.
In-Place Pod Resize reaches GA in Kubernetes 1.35: resizing CPU/memory without restarting pods
Kubernetes 1.35 marks In-Place Pod Resize stable: requests and limits on a running pod can change without killing containers. We cover the resize subresource, container resize policies, what still forces a restart, VPA's InPlaceOrRecreate mode, and the fallout for the scheduler and cluster autoscaler.
Helm, grown up: OCI registries, dependencies, and charts without the pain
How to build a Helm chart you're not ashamed to hand off to GitOps: values.schema.json instead of copy-paste, library charts and condition instead of duplication, OCI registry publishing instead of index.yaml, and where Helm loses to Kustomize.
KRO: composite Kubernetes APIs without writing your own operator
Kube Resource Orchestrator bundles a Deployment, Service, ConfigMap, and an external Crossplane resource into a single composite CRD without a line of Go. We break down ResourceGraphDefinition, compare it to Crossplane Compositions and a condition-heavy Helm chart, and look at where KRO loses.
Scorecards for platform teams: measuring whether the service catalog actually works
A service catalog is a showcase; scorecards are the lever. How to compute quantitative security/reliability/documentation metrics on top of Trivy, Renovate, and Sentry you already run, via Backstage TechInsights, without buying a commercial IDP.
Teleport instead of a VPN: audited access to servers, Kubernetes, and databases
Teleport solves a different problem than NetBird or Cloudflare Tunnel: they give you network access, Teleport gives you audited access to a specific resource. We cover short-lived certificates instead of SSH keys and kubeconfig, session recording with tsh play, and resource-level RBAC — then wire up access to a test Kubernetes cluster with tsh kube login.
Database schema as code: Atlas on top of CloudNativePG instead of hand-rolled migrations
GitOps closed the diff-review gap for manifests and infrastructure, but most teams still change their database schema by hand. A look at Atlas's declarative approach: diff instead of a migration chain, a CI gate, and the AtlasSchema CRD on top of CloudNativePG.
Guardrails for AI SRE agents: automating remediation without losing control
AWS DevOps Agent and Azure SRE Agent have been GA since March 2026, and neither pushes production changes without human confirmation. Here's how to design an approval gate on top of your own incident pipeline: three levels of autonomy, a narrow executor instead of direct cluster access for the agent, and what to log for audit.
Sidecar-free service mesh: Cilium Service Mesh next to Istio Ambient
Cilium Service Mesh handles mTLS and L7 routing on the eBPF datapath with no separate proxy components at all — unlike Istio Ambient, which drops the sidecar but keeps ztunnel and waypoint. We compare the architectures, the honest limitations, and turn on mTLS in a cluster that already runs Hubble.
Flux 2.8: CEL-based health checks and what they change for release gating
Flux 2.8 adds healthCheckExprs — CEL expressions for health checks in Kustomization and HelmRelease. We cover the syntax, migrating an existing resource, and how it differs from canary checks in Argo Rollouts/Flagger.
OBI: zero-code application tracing via eBPF, the Grafana Beyla successor
OpenTelemetry eBPF Instrumentation (OBI) traces HTTP/gRPC/SQL straight from the kernel — no in-container agent, no line of application code touched. We look at how OBI differs from Hubble, Tetragon and Pyroscope, how it plugs into an OTel Collector you already run, and where zero-code instrumentation hits its ceiling.
OpenCost: cost-allocating a Kubernetes cluster down to the namespace
OpenCost is a CNCF project that allocates Kubernetes cost by namespace, deployment, and label — no commercial subscription required. We cover the allocation model, how it differs from Kubecost after IBM's acquisition, and how to install it next to a Prometheus you already run.
SPIFFE/SPIRE: cryptographic workload identity instead of static secrets
SPIFFE standardizes workload identity through short-lived SVID certificates, and SPIRE — its reference implementation — issues and rotates them via two-tier attestation (node + workload) with no pre-shared secret anywhere. We break down how it differs from external-secrets-operator, how federation works across clusters, and deploy SPIRE to fetch a real X.509-SVID for a test pod.
SpinKube: running WebAssembly workloads on Kubernetes without a custom runtime
SpinKube schedules WebAssembly modules as regular pods — the same kubectl apply, the same HPA, but startup in single-digit milliseconds with no container warm-up. We break down the containerd-shim-spin architecture, install the SpinKube operator, deploy a SpinApp next to a regular Deployment and measure the difference — while being honest about which workloads WASM still isn't a fit for.
ValidatingAdmissionPolicy: moving admission control into the API server with CEL
Kyverno 1.17 deprecates classic ClusterPolicy in favor of CEL-native ValidatingPolicy, with removal planned for v1.20. ValidatingAdmissionPolicy has been stable since Kubernetes 1.30 and runs CEL directly inside kube-apiserver — no webhook, no network hop, no separate pod. We break down the CEL expression model, migrate a real policy, and measure the latency before/after.
Renovate: dependency updates that don't drive you mad
Renovate instead of a flood of one-off PRs per dependency: packageRules grouping, schedules, automerge with a cooldown, and a self-hosted GitLab CI run. We cover the flow, the config, and where the automerge trust boundary sits.
KEDA: event-driven autoscaling, all the way to zero
KEDA scales pods by queue depth, a metric, or a schedule — not just CPU/RAM — and can scale all the way down to zero. ScaledObject, scalers for Kafka/RabbitMQ/Prometheus/cron, and the polling interval, activation-vs-scaling threshold, and cooldown gotchas.
OpenTofu: state encryption and leaving Terraform without drama
OpenTofu encrypts state and plan client-side, before the backend ever sees them — a feature Terraform still doesn't have. We cover migration, key providers (PBKDF2, AWS/GCP KMS, OpenBao), and why backend encryption isn't the same thing.
Istio ambient: a service mesh without sidecars
Istio's ambient mode reached GA and removes the main argument against service mesh — a sidecar in every pod. We cover the ztunnel + waypoint architecture, mTLS without restarts, and rolling out L7 only where it's needed.
Karpenter: just-in-time nodes and half the cluster bill
Cluster Autoscaler scales pre-sized node groups, Karpenter picks the right instance for the actual pending pods and collapses the cluster when idle. NodePool/NodeClass, consolidation, spot fallback, and the traps that block it — with a working manifest.
External Secrets Operator: Vault secrets in Kubernetes without copy-paste
External Secrets Operator syncs secrets from Vault and cloud Secret Managers straight into native Kubernetes Secrets. The SecretStore/ExternalSecret model, refreshInterval rotation, and a working Vault example.
Trivy in CI: catch vulns and generate an SBOM before prod
One pipeline step blocks vulnerable images from shipping and hands you an SBOM on the way. What Trivy scans, how to gate on severity, how to quiet the noise with .trivyignore and VEX, and how it ties into keyless signing.
Sentry: catch prod errors before your users do
Logs say 'something broke'; Sentry says what, for whom, and in which release. Error grouping, breadcrumbs, releases and source maps, how to quiet the noise, and how to self-host it.
Gateway API over Ingress: migrating before ingress-nginx dies
kubernetes/ingress-nginx hit End-of-Life on March 24, 2026 — the repo is frozen, no bugfixes, no security patches. A walkthrough of the Gateway API resource model, converting with ingress2gateway 1.0, and the migration traps, with a canary-routing example.
Backstage in a weekend: an IDP and golden paths for a small team
An Internal Developer Platform isn't only for enterprises: a minimal Backstage in docker-compose with one Software Template gives a service catalog and a 'new service in one click' win already at 3-5 engineers. What it takes and where the traps are.
AI SRE agents in 2026: what they actually do and where they break
AWS DevOps Agent and Azure SRE Agent both hit GA in March 2026. We break down the working model of AI SRE agents: what they actually do (triage, correlation, runbook execution), where they break, and how to build human-in-the-loop with approval gates so the agent stays a co-pilot instead of a new source of incidents.
CloudNativePG in production: HA, backups, and major upgrades without downtime
Standing up CloudNativePG is easy — production begins on day-2. We cover automatic failover and split-brain protection, ScheduledBackup and PITR restore (Barman Cloud Plugin), the metrics that actually matter, minor and major upgrades without a long downtime, and why prod rests on a tested restore, not a configured backup.
CloudNativePG: production-ready Postgres on Kubernetes without voodoo
CloudNativePG turns "Postgres in k8s" from an anti-pattern into a normal way to keep the database next to the app: one Cluster CR gives you a primary and replicas, automatic failover, S3 backups via the Barman Cloud Plugin, and PgBouncer through Pooler. We walk through a 3-pod manifest, the storage traps, and how to test failover.
Progressive delivery: canary with automated rollback on Flagger
Flagger turns a plain Deployment into progressive delivery with automated metric-based rollback: the Canary CR, canary/blue-green/A-B strategies, error-rate and p95 analysis via MetricTemplate, and a working manifest with 10/30/50% steps.
Kyverno vs OPA Gatekeeper: when to pick which
Kyverno 1.17 promoted CEL to v1, Gatekeeper v3.22 integrated ValidatingAdmissionPolicy from upstream. Both projects are now stable — the choice depends on where your Kubernetes ends. A practical matrix: YAML vs Rego, validation/mutation/generation, and the hybrid option with full code examples.
Flux in one evening: GitOps for a single small cluster
GitOps on a single small cluster without an operator zoo: what Flux is, why a reconciler beats kubectl apply from CI, how to run flux bootstrap, and how to assemble one root Kustomization that syncs the whole cluster from git.
OpenTelemetry Collector: a minimal setup you can ship to prod
Why you need the OpenTelemetry Collector, how its receivers/processors/exporters pipeline works, how an agent differs from a gateway, and how to build a minimal but production-grade setup with docker-compose and Tempo.
eBPF without the pain: Cilium and network observability in Kubernetes
What eBPF is in plain terms, why Cilium beats kube-proxy and sidecars, how Hubble shows flows and drop reasons, and what you need to stand it all up in a kind cluster in an evening.
SLSA Level 2: what build provenance is and why it isn't SBOM
SLSA Level 2 in practice: how build provenance differs from an SBOM, why L2 is a realistic target, how the GitLab Runner itself generates a non-forgeable attestation, and how to verify it with glab/cosign and at admission.
The Intervals.icu MCP server in Claude, behind Pomerium
How we connected the Intervals.icu MCP server to Claude and locked it behind Pomerium auth. Plus: how to build a dedicated Claude project and turn it into a personal coach with instructions.
Keyless image signing: Sigstore and cosign in CI
Keyless container image signing with Sigstore: cosign, Fulcio and Rekor sign artifacts against your CI's OIDC identity with no long-lived keys. We walk the flow, the pitfalls, and a minimal GitLab CI pipeline with admission-time verification.
Self-hosted Matrix + Element: a messenger that's actually yours
Why a self-hosted Matrix server with the Element client is more private and freer than Telegram, WhatsApp or Signal — federation, data ownership, E2EE and bridges, plus a minimal Synapse + Element Docker deploy.
Deploy Astro to Cloudflare Pages: Git Integration and GitHub CI/CD
Two ways to deploy Astro to Cloudflare Pages: connect the repo right in the dashboard (push to main = auto deploy, free per-branch previews, custom domain with TLS) or build in GitHub Actions and ship dist via Wrangler. Build settings, custom domain, a dev environment, and the full workflow included.
HTTP/3 and QUIC Explained Simply
How HTTP/3 and QUIC differ from HTTP/1.1 and HTTP/2, why the transport moved from TCP to UDP, and what you need to turn HTTP/3 on for your own server.
Backing Up Databases and Files to S3 with Restic + Healthchecks
Updated:A practical guide to backing up databases and files to S3 with Restic and Healthchecks monitoring: encryption, deduplication, scheduling, and restore verification.
A Lightweight Proxy
Updated:How to quickly spin up a lightweight proxy server in Docker for testing, CI/CD and temporary infrastructure: minimal configuration and launch in a couple of minutes.
20 Cybersecurity Tools for 2025
An overview of 20 cybersecurity tools for 2025 for pentesting and auditing: scanners, exploitation frameworks, traffic and network analysis — with usage examples.
A Minimal Zsh Setup on macOS
Updated:A minimal Zsh setup on macOS without heavy frameworks: autocompletion, syntax highlighting, a handy prompt, and aliases — fast and free of bloat.
Installing Kali Linux on a Hetzner Server
How to install Kali Linux on a Hetzner server with no prebuilt image: booting via the rescue system, partitioning disks and deploying for cloud pentesting.
A Guide to Setting Up pgBackRest for PostgreSQL
A guide to setting up pgBackRest for PostgreSQL: full and incremental backups, S3 storage, point-in-time recovery (PITR), and backup verification.
NetBird: A Modern Zero Trust VPN
NetBird is a modern self-hosted Zero Trust VPN built on WireGuard: peer-to-peer connections, automatic NAT traversal, and simple access control with no single point of failure.
Standardization in Security: ISO/IEC 19249
An overview of the ISO/IEC 19249 standard: security architecture and system design principles — how to bring scattered protection practices into a single model.
A Complete Guide to Preparing for and Playing CTF (Capture The Flag)
A complete guide to preparing for CTF (Capture The Flag): challenge categories, tools, practice resources, and a step-by-step strategy for competing successfully.
Container Security: A Practical Checklist for Implementation
Updated:A practical security checklist for Docker and Kubernetes containers: images, privileges, secrets, networking, and runtime — what to verify before shipping to production.
YubiKey 5
YubiKey 5 — a multi-protocol hardware key for two-factor authentication: FIDO2, U2F, OTP, PGP, and SSH — how to set it up and why you need it.
Backing Up Docker Containers with Offen
How to set up automated daily backups of Docker volumes to S3 with offen/docker-volume-backup: configuration, scheduling, encryption and restore.
MDT Deployment & Administration. Part 4: Bootstrap.ini and CustomSettings.ini
Deploy Windows with MDT, part 4: configure Bootstrap.ini and CustomSettings.ini to automate installation parameters and customize the deployment process.
Obtaining an SSL Certificate with Cloudflare and Let's Encrypt, and Configuring Nginx
How to obtain a free Let's Encrypt SSL certificate, set it up with Cloudflare, and wire it into Nginx: a step-by-step guide with HTTPS and automatic renewal.
MDT Deployment & Administration. Part 3: Creating a New Task Sequence
Updated:Deploy Windows with MDT, part 3: create a new Task Sequence — a step-by-step walkthrough of configuring the task sequence for automated OS installation.
MDT Deployment & Administration. Part 2: Installing and Configuring MDT
Updated:Deploy Windows with MDT, part 2: install and configure Microsoft Deployment Toolkit, create a deployment share, and prepare your install.wim images.
MDT Deployment & Administration. Part 1: Installing and Configuring WDS
Deploy Windows with MDT, part 1: install and configure WDS (Windows Deployment Services) for PXE network boot and fully automated OS installation.
Getting Started with Docker
An introduction to Docker for beginners: what containers, images, and volumes are, how they differ from virtual machines, and how to run your first application.
Proxmox Cloud-Init 24.04 Tutorial
How to create an Ubuntu 24.04 virtual machine template in Proxmox with Cloud-Init: automating VM setup, SSH keys, and fast cloning — step by step.
Order in IT: On the Importance of Pulling Up Baobabs
Why it matters to fix small problems in your IT infrastructure before they grow out of control: on technical debt, order, and the discipline of operations.
Getting Started with SSH
An introduction to SSH for beginners: how the secure remote access protocol works, generating keys, connecting to a server, and basic commands.
Cloudflare Zero Trust
Set up secure access to self-hosted services with Cloudflare Zero Trust and Tunnel: no open ports, with authentication and access policies built in.
Proper, Secure SSH Configuration
How to securely configure an SSH server: keys instead of passwords, disabling root login, changing the port, fail2ban, and other practices to defend against brute-force and attacks.
SSL Certificates Made Simple
Updated:A simple explanation of SSL/TLS certificates: what X.509 is, how encryption works, the chain of trust, and why a website needs HTTPS — without unnecessary theory.