Managing TLS in Kubernetes is different enough from regular server TLS that it’s worth covering separately. The concepts are the same — certificates, private keys, certificate authorities — but the mechanics of how you provision, store, and rotate certificates involve Kubernetes-specific objects. I’ve worked through this on a few clusters. Here’s the practical picture. The
Kubernetes TLS: Securing Ingress with Certificates Read Post »
Security headers are easy to overlook. They’re not flashy — users never see them — but they add meaningful protection against a range of attacks: clickjacking, XSS, MIME sniffing, cross-origin data leaks. Adding them takes maybe 15 minutes, and scanners like securityheaders.com will grade your site. Here’s what I actually set and why each one
HTTP Security Headers: What to Set in Nginx and Why Read Post »
Fail2ban is one of those tools I install on every server within the first 30 minutes. It’s not a silver bullet — a determined attacker with a botnet of millions of IPs won’t be slowed down much — but it handles opportunistic attacks effectively and keeps your auth logs from filling up with garbage. The
Fail2ban Setup: Protecting SSH and Web Services from Brute Force Read Post »
Networking is the thing that trips up most people learning Docker. Container A can’t reach container B, or a container can’t reach the internet, or you expose a port but nothing connects. Most of these problems come down to not understanding how Docker’s networking modes actually work. I spent a fair amount of time confused
Docker Networking Explained: Bridge, Host, and Overlay Networks Read Post »
DNS is something most sysadmins interact with constantly without necessarily understanding the full picture. Setting up an A record and MX record is easy enough, but when things break or you need to configure something more complex, knowing what each record type does and how it works becomes important. Here’s the DNS record types I
Understanding DNS Record Types: A Practical Guide for Sysadmins Read Post »
Certificate Transparency (CT) is one of those things you use every day without thinking about it. Every time your browser connects to an HTTPS site, Certificate Transparency is working in the background to help ensure the certificate you’re seeing is legitimate. Understanding it has practical implications if you manage SSL certificates. The Problem CT Solves
Certificate Transparency Logs: What They Are and Why You Should Care Read Post »
There’s a point in most sysadmin careers where you stop relying entirely on public CAs and start thinking about internal infrastructure. Internal APIs, staging environments, service-to-service TLS, developer machines — all of these benefit from having a proper internal CA rather than a pile of self-signed certificates scattered everywhere. I set up my first internal
Building Your Own Certificate Authority with OpenSSL Read Post »
Apache’s SSL configuration has improved a lot over the years. Getting it right involves enabling the right modules, configuring ciphers, setting up HSTS, and making sure the certificate chain is complete. Here’s the configuration I use. Required Modules Make sure these modules are enabled: Verify: Virtual Host Configuration A complete HTTPS virtual host: SSLProtocol -all
Apache SSL Configuration: Modern Settings for a Secure Setup Read Post »
mod_rewrite is one of Apache’s most powerful and most confusing modules. The syntax is dense, the flags are cryptic, and debugging is painful. But it’s also everywhere — almost every HTTPS redirect, URL rewrite, and routing rule in Apache uses it. I’ve spent a lot of time staring at mod_rewrite configs. Here’s what I actually
Apache mod_rewrite: Redirects, Rewrites, and HTTPS Enforcement Read Post »
I resisted Ansible for a while. My servers were small in number and I could remember what was on each one. Then I had to rebuild a server from scratch after a hardware failure, and I realized I had no idea exactly what I’d done to set it up. It took most of a day
Ansible for Server Configuration Management: Getting Started Read Post »