DevOps & SysAdmin

phpMyAdmin is one of the most targeted web applications on the internet — attack scanners look for it at dozens of common URL paths, and if they find it running over HTTP, they can harvest MySQL credentials from network traffic or from browser history in shared environments. This article covers deploying phpMyAdmin behind nginx with […]

Proxmox VE ships with a self-signed certificate. The browser warning it produces is not just an annoyance — users clicking through “Your connection is not private” warnings train themselves to ignore certificate errors, which is dangerous. More practically: in environments with multiple admins, the self-signed certificate means you cannot distinguish a legitimate Proxmox node from

QNAP NAS devices run QTS (or QuTS hero), which manages the web administration interface, file services, and applications like Qsync, myQNAPcloud, and others. Like Synology, QNAP ships with a self-signed certificate. This article covers replacing it with a Let’s Encrypt certificate through the built-in ACME client, uploading a custom certificate from an internal CA, and

RabbitMQ runs two network interfaces that benefit from TLS: the AMQP port (5672) that carries messages between producers, consumers, and the broker, and the management plugin’s HTTP API and web UI (port 15672). This article covers enabling TLS on both, configuring clients, setting up mutual TLS for producer/consumer authentication, and renewing certificates without message loss.

Redis added native TLS support in version 6.0, released in April 2020. Before that, TLS for Redis required a TLS proxy (stunnel, spiped, or nginx stream proxy). If you are still running Redis without TLS because “it is on a private network”, consider that Redis commands carry your application data — including session tokens, cache

Redmine is a Ruby on Rails project management application. It does not include a production-ready web server — it is designed to run behind Puma or Passenger as a backend, with nginx or Apache as the TLS-terminating reverse proxy. This article covers configuring nginx with TLS for Redmine, setting the correct base URL so email

Remote Desktop Gateway (RD Gateway) uses TLS for two purposes: the HTTPS tunnel that wraps RDP traffic, and the authentication handshake for RD Gateway policies. When the certificate expires, remote employees and administrators who connect through RD Gateway lose access immediately. This article covers replacing the RD Gateway certificate using the RD Gateway Manager, PowerShell,

Rocket.Chat is a self-hosted Slack alternative that handles real-time messages, file uploads, and video calls. Without TLS, all of that is visible on the network. Rocket.Chat is a Node.js application that does not handle TLS natively in most deployment configurations — TLS is the responsibility of a reverse proxy in front of it. This article

Prometheus is almost always deployed without TLS because the documentation used to treat it as an internal-only tool. By the time someone asks “is this metrics data sensitive?”, the server has been running for a year on port 9090 without encryption. This article covers enabling HTTPS on Prometheus itself — the scrape endpoint and the

SonarQube runs an Elasticsearch node internally and serves its web interface on port 9000. It does not handle TLS natively — it is designed to be deployed behind a reverse proxy. This article covers setting up nginx as a TLS reverse proxy in front of SonarQube, configuring the sonar.web.publicRootUrl property so that generated links are