Production runbooks for securing infrastructure: Zero-Trust Cloudflare Tunnels, Tailscale/WireGuard mesh VPNs, reverse proxies (Traefik/Caddy), automated DNS-01 Let’s Encrypt certificates, CrowdSec intrusion prevention, and declarative GitOps pipelines.
Security & Edge Networking Runbooks
- Automated TLS Certificates: Let’s Encrypt Wildcards, ACME DNS-01 & Reverse Proxies
- Automating Edge Security: Cloudflare Origin Certificates & WAF Protections
- Deploying a Secure WireGuard & Tailscale Exit Node on a VPS for Private Mobile Egress
- Enterprise Linux Auditing: Tracking Command Execution with Auditd
- Fleet-Wide Intrusion Prevention: Deploying CrowdSec with Docker, Caddy & Firewall Bouncers
- Hardening the Gateway: Firewalla Security Architecture, Custom DNS & Automated Post-Boot Scripts
- How to Lock Down and Harden a Fresh Linux VPS (Ubuntu / Debian)
- Lightweight Homelab Identity: Deploying Pocket-ID for OIDC Single Sign-On
- Modern Dynamic DNS: Cloudflare API Automation & Split-Horizon Resolution
- Modern Mesh VPN Architecture: Tailscale, Headscale, and WireGuard Site-to-Site Tunnels
- Modern Reverse Proxy Architecture: Caddy Server & Cloudflare Tunnels for Container Ingress
- Zero-Trust Edge Ingress: Deploying Cloudflare Tunnels (cloudflared) for Private Services
GitOps & Infrastructure Automation Runbooks
- Declarative Server Administration: Why We Avoid Web GUIs in Favor of GitOps, Tmux & Pure CLI
- Enterprise Secrets Management: Docker Native File Secrets and GitOps Security Hygiene
- Setting Up Git on Modern Linux (SSH Signing, Ed25519 & Best Practices)
- The Complete GitOps Deployment Lifecycle: Forgejo, Webhooks, Komodo & Docker Compose