A ten-minute baseline for linux server hardening on a small VPS: key-only SSH, a deny-by-default firewall, fail2ban and updates, plus the Docker and ufw trap.
A restic backup setup for a small VPS: encrypted snapshots off-server, Postgres dumps piped straight in, sane retention, a systemd timer, and a restore test.
How I deploy to a single VPS without dropping requests: Docker Compose health checks, a second replica, and Caddy dynamic upstreams. Script and test loop…
Docker's new agent sandboxes put each agent in its own microVM. Here is why I'm removing docker.sock mounts from agent containers, and the hardening I'd…
depends_on only waits for a container to start. Here is how Docker Compose healthcheck, service_healthy and up --wait fix cold-start failures, plus the restart gap.
I used to open a port every time I needed to show a client a staging dashboard. Here's the Cloudflare Tunnel setup that replaced that…
I installed Coolify and Dokploy on identical Hetzner boxes and moved a client's staging server to one. Here's where they actually differ, not just on…
The Postgres tuning parameters I adjust on every VPS I run, plus what PostgreSQL 19 Beta 4 changes for autovacuum, REPACK, and checkpoint tuning.
ubuntu-latest moves to Ubuntu 26.04 from 19 October. I diffed the two runner images: PHP 8.5, MySQL 8.4, Postgres 18, twelve tools gone, and a…
Postgres encryption at rest is two different questions. What LUKS already covers, what pg_vault_tde adds, what stays plaintext, and the 1.7.1 TOAST upgrade trap.