DevOps & SysAdmin

Grafana ships with HTTP enabled by default. That is fine for a local lab, but the moment Grafana is reachable over any network you do not fully control, you need TLS. I learned that lesson when a penetration test caught session tokens traveling in the clear between an on-call engineer’s laptop and a Grafana instance […]

HAProxy is one of the most widely deployed load balancers and TLS terminators in production environments. It can terminate TLS (decrypt and proxy plain HTTP to backends), bridge TLS (re-encrypt to backends), or pass TLS through unchanged to backend servers. This article covers configuring SSL termination with modern cipher settings, managing multiple certificates for different

Apache Kafka’s default configuration runs without any encryption. Every message, every authentication credential, every consumer group offset travels in plaintext between producers, consumers, and brokers. When Kafka is deployed in a multi-tenant environment or carries data that crosses network boundaries, TLS is not optional. This article explains how to generate certificates, configure Kafka brokers for

Loki’s default configuration sends log data — including application errors, authentication events, and stack traces — over unencrypted HTTP. If Promtail, Grafana, or any other client is sending logs across a network boundary without TLS, those logs are readable in transit. This article shows how to enable HTTPS on Loki’s HTTP and gRPC endpoints, configure

Mattermost is a self-hosted team chat application that handles sensitive internal communications — incident response discussions, credentials shared in channels, private messages between team members. Running it without TLS means all of that travels in plaintext. This article covers enabling HTTPS on Mattermost using its built-in TLS support, or placing it behind nginx, setting the

MongoDB running without TLS sends documents, queries, and authentication tokens over the network in plaintext. This is the default for self-managed MongoDB, even on versions 5, 6, and 7. This article walks through enabling TLS on mongod, connecting the mongo shell and drivers with certificate verification, enabling mutual TLS for x.509 client authentication, and configuring

MySQL and MariaDB both generate self-signed TLS certificates automatically during installation, but they do not require clients to use them. The default setup allows plaintext connections to coexist with TLS connections — clients that do not ask for TLS get none. This article shows how to verify that TLS is working, replace the auto-generated certificates

Nextcloud running over HTTP is a serious risk for a file storage application — your login credentials, file contents, and share links all travel in plaintext. But enabling HTTPS on Nextcloud involves more than just installing a certificate on the web server. Nextcloud generates URLs internally and needs to know it is behind HTTPS, or

Nginx Proxy Manager (NPM) is a web-based GUI for nginx reverse proxy configuration. It manages SSL certificates through a visual interface, which makes it accessible to administrators who are not comfortable editing nginx configuration files directly. This article covers setting up Let’s Encrypt certificates in NPM, uploading custom certificates, configuring advanced TLS settings, and understanding

pgAdmin 4 in server mode runs an internal web server (Gunicorn or built-in). By default that web server listens on HTTP — any credentials you type into the pgAdmin login form, any database passwords, any SQL you execute all travel in plaintext if you access pgAdmin over a network. This article covers enabling HTTPS on