Notes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.https://hogin.pro/https://hogin.pro/posts/renovate-automated-dependency-updates/https://hogin.pro/posts/renovate-automated-dependency-updates/Renovate instead of a flood of one-off PRs per dependency: packageRules grouping, schedules, automerge with a cooldown, and a self-hosted GitLab CI run. We cover the flow, the config, and where the automerge trust boundary sits.Tue, 11 Aug 2026 00:00:00 GMThttps://hogin.pro/posts/keda-event-driven-autoscaling/https://hogin.pro/posts/keda-event-driven-autoscaling/KEDA scales pods by queue depth, a metric, or a schedule — not just CPU/RAM — and can scale all the way down to zero. ScaledObject, scalers for Kafka/RabbitMQ/Prometheus/cron, and the polling interval, activation-vs-scaling threshold, and cooldown gotchas.Fri, 07 Aug 2026 10:00:00 GMThttps://hogin.pro/posts/opentofu-state-encryption-migration/https://hogin.pro/posts/opentofu-state-encryption-migration/OpenTofu encrypts state and plan client-side, before the backend ever sees them — a feature Terraform still doesn't have. We cover migration, key providers (PBKDF2, AWS/GCP KMS, OpenBao), and why backend encryption isn't the same thing.Tue, 04 Aug 2026 00:00:00 GMThttps://hogin.pro/posts/istio-ambient-sidecarless-mesh/https://hogin.pro/posts/istio-ambient-sidecarless-mesh/Istio's ambient mode reached GA and removes the main argument against service mesh — a sidecar in every pod. We cover the ztunnel + waypoint architecture, mTLS without restarts, and rolling out L7 only where it's needed.Fri, 31 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/karpenter-node-autoscaling-cost/https://hogin.pro/posts/karpenter-node-autoscaling-cost/Cluster Autoscaler scales pre-sized node groups, Karpenter picks the right instance for the actual pending pods and collapses the cluster when idle. NodePool/NodeClass, consolidation, spot fallback, and the traps that block it — with a working manifest.Tue, 28 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/external-secrets-operator-kubernetes/https://hogin.pro/posts/external-secrets-operator-kubernetes/External Secrets Operator syncs secrets from Vault and cloud Secret Managers straight into native Kubernetes Secrets. The SecretStore/ExternalSecret model, refreshInterval rotation, and a working Vault example.Fri, 24 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/trivy-vulnerability-scanning-ci/https://hogin.pro/posts/trivy-vulnerability-scanning-ci/One pipeline step blocks vulnerable images from shipping and hands you an SBOM on the way. What Trivy scans, how to gate on severity, how to quiet the noise with .trivyignore and VEX, and how it ties into keyless signing.Tue, 21 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/sentry-error-tracking-production/https://hogin.pro/posts/sentry-error-tracking-production/Logs say 'something broke'; Sentry says what, for whom, and in which release. Error grouping, breadcrumbs, releases and source maps, how to quiet the noise, and how to self-host it.Mon, 20 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/gateway-api-ingress-nginx-migration/https://hogin.pro/posts/gateway-api-ingress-nginx-migration/kubernetes/ingress-nginx hit End-of-Life on March 24, 2026 — the repo is frozen, no bugfixes, no security patches. A walkthrough of the Gateway API resource model, converting with ingress2gateway 1.0, and the migration traps, with a canary-routing example.Fri, 17 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/backstage-idp-small-team/https://hogin.pro/posts/backstage-idp-small-team/An Internal Developer Platform isn't only for enterprises: a minimal Backstage in docker-compose with one Software Template gives a service catalog and a 'new service in one click' win already at 3-5 engineers. What it takes and where the traps are.Tue, 14 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/ai-sre-agents-what-they-actually-do/https://hogin.pro/posts/ai-sre-agents-what-they-actually-do/AWS DevOps Agent and Azure SRE Agent both hit GA in March 2026. We break down the working model of AI SRE agents: what they actually do (triage, correlation, runbook execution), where they break, and how to build human-in-the-loop with approval gates so the agent stays a co-pilot instead of a new source of incidents.Fri, 10 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/cloudnative-pg-production-day2/https://hogin.pro/posts/cloudnative-pg-production-day2/Standing up CloudNativePG is easy — production begins on day-2. We cover automatic failover and split-brain protection, ScheduledBackup and PITR restore (Barman Cloud Plugin), the metrics that actually matter, minor and major upgrades without a long downtime, and why prod rests on a tested restore, not a configured backup.Mon, 06 Jul 2026 00:00:01 GMThttps://hogin.pro/posts/cloudnative-pg-postgres-kubernetes/https://hogin.pro/posts/cloudnative-pg-postgres-kubernetes/CloudNativePG turns "Postgres in k8s" from an anti-pattern into a normal way to keep the database next to the app: one Cluster CR gives you a primary and replicas, automatic failover, S3 backups via the Barman Cloud Plugin, and PgBouncer through Pooler. We walk through a 3-pod manifest, the storage traps, and how to test failover.Mon, 06 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/flagger-canary-auto-rollback/https://hogin.pro/posts/flagger-canary-auto-rollback/Flagger turns a plain Deployment into progressive delivery with automated metric-based rollback: the Canary CR, canary/blue-green/A-B strategies, error-rate and p95 analysis via MetricTemplate, and a working manifest with 10/30/50% steps.Fri, 03 Jul 2026 00:00:00 GMThttps://hogin.pro/posts/kyverno-vs-opa-gatekeeper/https://hogin.pro/posts/kyverno-vs-opa-gatekeeper/Kyverno 1.17 promoted CEL to v1, Gatekeeper v3.22 integrated ValidatingAdmissionPolicy from upstream. Both projects are now stable — the choice depends on where your Kubernetes ends. A practical matrix: YAML vs Rego, validation/mutation/generation, and the hybrid option with full code examples.Tue, 30 Jun 2026 00:00:00 GMThttps://hogin.pro/posts/flux-gitops-one-cluster/https://hogin.pro/posts/flux-gitops-one-cluster/GitOps on a single small cluster without an operator zoo: what Flux is, why a reconciler beats kubectl apply from CI, how to run flux bootstrap, and how to assemble one root Kustomization that syncs the whole cluster from git.Fri, 26 Jun 2026 12:00:00 GMThttps://hogin.pro/posts/opentelemetry-collector-minimal-setup/https://hogin.pro/posts/opentelemetry-collector-minimal-setup/Why you need the OpenTelemetry Collector, how its receivers/processors/exporters pipeline works, how an agent differs from a gateway, and how to build a minimal but production-grade setup with docker-compose and Tempo.Tue, 23 Jun 2026 12:00:00 GMThttps://hogin.pro/posts/ebpf-cilium-observability/https://hogin.pro/posts/ebpf-cilium-observability/What eBPF is in plain terms, why Cilium beats kube-proxy and sidecars, how Hubble shows flows and drop reasons, and what you need to stand it all up in a kind cluster in an evening.Fri, 19 Jun 2026 12:00:00 GMThttps://hogin.pro/posts/slsa-build-provenance-level-2/https://hogin.pro/posts/slsa-build-provenance-level-2/SLSA Level 2 in practice: how build provenance differs from an SBOM, why L2 is a realistic target, how the GitLab Runner itself generates a non-forgeable attestation, and how to verify it with glab/cosign and at admission.Tue, 16 Jun 2026 12:00:00 GMThttps://hogin.pro/posts/mcp-intervals-claude-pomerium/https://hogin.pro/posts/mcp-intervals-claude-pomerium/How we connected the Intervals.icu MCP server to Claude and locked it behind Pomerium auth. Plus: how to build a dedicated Claude project and turn it into a personal coach with instructions.Sun, 14 Jun 2026 06:00:00 GMThttps://hogin.pro/posts/sigstore-cosign-keyless-ci/https://hogin.pro/posts/sigstore-cosign-keyless-ci/Keyless container image signing with Sigstore: cosign, Fulcio and Rekor sign artifacts against your CI's OIDC identity with no long-lived keys. We walk the flow, the pitfalls, and a minimal GitLab CI pipeline with admission-time verification.Fri, 12 Jun 2026 12:00:00 GMThttps://hogin.pro/posts/matrix-element-self-hosted/https://hogin.pro/posts/matrix-element-self-hosted/Why a self-hosted Matrix server with the Element client is more private and freer than Telegram, WhatsApp or Signal — federation, data ownership, E2EE and bridges, plus a minimal Synapse + Element Docker deploy.Tue, 09 Jun 2026 12:00:00 GMThttps://hogin.pro/posts/astro-cloudflare-pages-github-ci/https://hogin.pro/posts/astro-cloudflare-pages-github-ci/Two ways to deploy Astro to Cloudflare Pages: connect the repo right in the dashboard (push to main = auto deploy, free per-branch previews, custom domain with TLS) or build in GitHub Actions and ship dist via Wrangler. Build settings, custom domain, a dev environment, and the full workflow included.Tue, 09 Jun 2026 10:00:00 GMThttps://hogin.pro/posts/http3-quic-explained/https://hogin.pro/posts/http3-quic-explained/How HTTP/3 and QUIC differ from HTTP/1.1 and HTTP/2, why the transport moved from TCP to UDP, and what you need to turn HTTP/3 on for your own server.Tue, 09 Jun 2026 10:00:00 GMThttps://hogin.pro/posts/container-security-checklist/https://hogin.pro/posts/container-security-checklist/A practical security checklist for Docker and Kubernetes containers: images, privileges, secrets, networking, and runtime — what to verify before shipping to production.Mon, 09 Mar 2026 13:55:33 GMThttps://hogin.pro/posts/restic-s3-backup-healthchecks/https://hogin.pro/posts/restic-s3-backup-healthchecks/A practical guide to backing up databases and files to S3 with Restic and Healthchecks monitoring: encryption, deduplication, scheduling, and restore verification.Sat, 24 Jan 2026 18:08:31 GMThttps://hogin.pro/posts/lightweight-proxy/https://hogin.pro/posts/lightweight-proxy/How to quickly spin up a lightweight proxy server in Docker for testing, CI/CD and temporary infrastructure: minimal configuration and launch in a couple of minutes.Sat, 24 Jan 2026 12:12:13 GMThttps://hogin.pro/posts/20-cybersecurity-tools-2025/https://hogin.pro/posts/20-cybersecurity-tools-2025/An overview of 20 cybersecurity tools for 2025 for pentesting and auditing: scanners, exploitation frameworks, traffic and network analysis — with usage examples.Mon, 13 Oct 2025 08:05:57 GMThttps://hogin.pro/posts/minimal-zsh-setup-macos/https://hogin.pro/posts/minimal-zsh-setup-macos/A minimal Zsh setup on macOS without heavy frameworks: autocompletion, syntax highlighting, a handy prompt, and aliases — fast and free of bloat.Wed, 08 Oct 2025 13:07:29 GMThttps://hogin.pro/posts/mdt-deployment-part-3-task-sequence/https://hogin.pro/posts/mdt-deployment-part-3-task-sequence/Deploy Windows with MDT, part 3: create a new Task Sequence — a step-by-step walkthrough of configuring the task sequence for automated OS installation.Thu, 02 Oct 2025 11:16:01 GMThttps://hogin.pro/posts/kali-linux-on-hetzner/https://hogin.pro/posts/kali-linux-on-hetzner/How to install Kali Linux on a Hetzner server with no prebuilt image: booting via the rescue system, partitioning disks and deploying for cloud pentesting.Sun, 21 Sep 2025 16:59:45 GMThttps://hogin.pro/posts/pgbackrest-postgresql-guide/https://hogin.pro/posts/pgbackrest-postgresql-guide/A guide to setting up pgBackRest for PostgreSQL: full and incremental backups, S3 storage, point-in-time recovery (PITR), and backup verification.Fri, 19 Sep 2025 11:33:00 GMThttps://hogin.pro/posts/netbird-zero-trust-vpn/https://hogin.pro/posts/netbird-zero-trust-vpn/NetBird is a modern self-hosted Zero Trust VPN built on WireGuard: peer-to-peer connections, automatic NAT traversal, and simple access control with no single point of failure.Fri, 12 Sep 2025 11:27:59 GMThttps://hogin.pro/posts/iso-iec-19249-security-standard/https://hogin.pro/posts/iso-iec-19249-security-standard/An overview of the ISO/IEC 19249 standard: security architecture and system design principles — how to bring scattered protection practices into a single model.Wed, 10 Sep 2025 08:09:08 GMThttps://hogin.pro/posts/ctf-preparation-guide/https://hogin.pro/posts/ctf-preparation-guide/A complete guide to preparing for CTF (Capture The Flag): challenge categories, tools, practice resources, and a step-by-step strategy for competing successfully.Mon, 08 Sep 2025 11:47:23 GMThttps://hogin.pro/posts/ledger-hardware-wallet/https://hogin.pro/posts/ledger-hardware-wallet/Why hardware crypto wallets like Ledger are a must-have for investors: how they protect private keys, what their advantages are and how to get started.Sat, 01 Mar 2025 12:51:24 GMThttps://hogin.pro/posts/yubikey-5/https://hogin.pro/posts/yubikey-5/YubiKey 5 — a multi-protocol hardware key for two-factor authentication: FIDO2, U2F, OTP, PGP, and SSH — how to set it up and why you need it.Fri, 21 Feb 2025 19:50:36 GMThttps://hogin.pro/posts/docker-volume-backup-offen/https://hogin.pro/posts/docker-volume-backup-offen/How to set up automated daily backups of Docker volumes to S3 with offen/docker-volume-backup: configuration, scheduling, encryption and restore.Sat, 15 Feb 2025 17:09:15 GMThttps://hogin.pro/posts/mdt-deployment-part-4-bootstrap-ini/https://hogin.pro/posts/mdt-deployment-part-4-bootstrap-ini/Deploy Windows with MDT, part 4: configure Bootstrap.ini and CustomSettings.ini to automate installation parameters and customize the deployment process.Tue, 11 Feb 2025 09:00:09 GMThttps://hogin.pro/posts/ssl-cloudflare-letsencrypt-nginx/https://hogin.pro/posts/ssl-cloudflare-letsencrypt-nginx/How to obtain a free Let's Encrypt SSL certificate, set it up with Cloudflare, and wire it into Nginx: a step-by-step guide with HTTPS and automatic renewal.Mon, 03 Feb 2025 10:09:58 GMThttps://hogin.pro/posts/mdt-deployment-part-2-mdt-setup/https://hogin.pro/posts/mdt-deployment-part-2-mdt-setup/Deploy Windows with MDT, part 2: install and configure Microsoft Deployment Toolkit, create a deployment share, and prepare your install.wim images.Thu, 30 Jan 2025 13:31:48 GMThttps://hogin.pro/posts/mdt-deployment-part-1-wds/https://hogin.pro/posts/mdt-deployment-part-1-wds/Deploy Windows with MDT, part 1: install and configure WDS (Windows Deployment Services) for PXE network boot and fully automated OS installation.Sat, 11 Jan 2025 09:00:37 GMThttps://hogin.pro/posts/docker-getting-started/https://hogin.pro/posts/docker-getting-started/An introduction to Docker for beginners: what containers, images, and volumes are, how they differ from virtual machines, and how to run your first application.Fri, 10 Jan 2025 09:32:45 GMThttps://hogin.pro/posts/proxmox-cloud-init-24-04-tutorial/https://hogin.pro/posts/proxmox-cloud-init-24-04-tutorial/How to create an Ubuntu 24.04 virtual machine template in Proxmox with Cloud-Init: automating VM setup, SSH keys, and fast cloning — step by step.Thu, 09 Jan 2025 15:04:08 GMThttps://hogin.pro/posts/order-in-it-baobabs/https://hogin.pro/posts/order-in-it-baobabs/Why it matters to fix small problems in your IT infrastructure before they grow out of control: on technical debt, order, and the discipline of operations.Tue, 07 Jan 2025 05:13:56 GMThttps://hogin.pro/posts/ssh-getting-started/https://hogin.pro/posts/ssh-getting-started/An introduction to SSH for beginners: how the secure remote access protocol works, generating keys, connecting to a server, and basic commands.Mon, 06 Jan 2025 10:15:03 GMThttps://hogin.pro/posts/cloudflare-zero-trust/https://hogin.pro/posts/cloudflare-zero-trust/Set up secure access to self-hosted services with Cloudflare Zero Trust and Tunnel: no open ports, with authentication and access policies built in.Sun, 05 Jan 2025 16:46:08 GMThttps://hogin.pro/posts/secure-ssh-configuration/https://hogin.pro/posts/secure-ssh-configuration/How to securely configure an SSH server: keys instead of passwords, disabling root login, changing the port, fail2ban, and other practices to defend against brute-force and attacks.Sun, 05 Jan 2025 10:30:03 GMThttps://hogin.pro/posts/ssl-certificates-explained/https://hogin.pro/posts/ssl-certificates-explained/A simple explanation of SSL/TLS certificates: what X.509 is, how encryption works, the chain of trust, and why a website needs HTTPS — without unnecessary theory.Fri, 03 Jan 2025 18:59:07 GMT