Author: Wes
-
Automated Security Patching & Maintenance Windows with unattended-upgrades and needrestart
A complete production runbook for configuring zero-touch automated security patching on Ubuntu 24.04 and Debian 12, featuring scheduled 04:00 AM reboot windows, needrestart daemon recycling, and webhook alerts.
-
Setting Up Git on Modern Linux (SSH Signing, Ed25519 & Best Practices)
A standard, clean Git configuration ensures cryptographic commit integrity, consistent line endings across platforms, and streamlined branching workflows. 1. Global Identity & Default Branch Modern Git uses main as the…
-
Automating Edge Security: Cloudflare Origin Certificates & WAF Protections
When hosting web applications behind an edge proxy like Cloudflare, many site owners mistakenly leave their connection in ‘Flexible SSL’ mode—meaning the traffic between the browser and Cloudflare is encrypted,…
-
The Complete GitOps Deployment Lifecycle: Forgejo, Webhooks, Komodo & Docker Compose
Managing production servers and self-hosted homelabs by manually SSHing into hosts, running ad-hoc docker run commands, and tweaking live configuration files leads directly to configuration drift, undocumented states, and catastrophic…
-
Enterprise Secrets Management: Docker Native File Secrets and GitOps Security Hygiene
Hardcoding database passwords, API tokens, and private keys into Git repositories or plain environment variables in docker-compose.yaml is a critical security vulnerability. This guide explains how to implement Docker Native…
-
Enterprise Linux Auditing: Tracking Command Execution with Auditd
A common administrative goal is auditing every command executed by users across a shared server. Historical hacks involved appending logger commands to /etc/bash.bashrc or wrapping PROMPT_COMMAND. These shell-level approaches are…
-
Linux Power & Thermal Governance: AMD P-State, Intel Energy Preferences, and Container Resource Limits
Home servers and homelab virtualization nodes run 24/7. Poor CPU frequency scaling and unconstrained container loops lead to high electricity bills, fan noise, and thermal throttling. This operational guide covers…
-
Modern Homelab Observability: Netdata Telemetry & Uptime Kuma Health Checks
In early sysadmin workflows, monitoring meant installing Monit to poll PID files or ping ports, firing off basic email alerts when a process died. While functional, it lacked real-time metrics,…
-
Replacing a Failed Drive in a ZFS RAIDZ Pool
When a drive in an OpenZFS mirror or RAIDZ pool experiences read/write checksum errors or SMART failure, replacing it requires a disciplined sequence: taking the faulted disk offline, physical swap,…
-
Zero-Trust Edge Ingress: Deploying Cloudflare Tunnels (cloudflared) for Private Services
Opening ports 80 and 443 on your home or office router exposes your public IP address to port scans, DDoS attacks, and zero-day exploit probing. Modern zero-trust architecture replaces open…