Automation, scripting, infrastructure management for DevOps, SysAdmin and other Tech stuff
mod_rewrite is one of Apache’s most powerful and most confusing modules. The syntax is dense, the flags are cryptic, and debugging is painful. But it’s also everywhere — almost every HTTPS redirect, URL rewrite, and routing rule in Apache uses it. I’ve spent a lot of time staring at mod_rewrite configs. Here’s what I actually
Apache mod_rewrite: Redirects, Rewrites, and HTTPS Enforcement Read Post »
I resisted Ansible for a while. My servers were small in number and I could remember what was on each one. Then I had to rebuild a server from scratch after a hardware failure, and I realized I had no idea exactly what I’d done to set it up. It took most of a day
Ansible for Server Configuration Management: Getting Started Read Post »
I’ve been using Certbot for years and it works fine. But a while back I started running into situations where Certbot felt too heavy — too many dependencies, too much Python version drama, and the way it modifies your Nginx config automatically sometimes caused more problems than it solved. That’s when I started looking at
acme.sh: A Lightweight Alternative to Certbot for Let’s Encrypt Read Post »
When I first started running services in Docker, TLS felt like an afterthought. Everything was on localhost or an internal network, so I figured it didn’t matter much. Then I started exposing services, connecting containers to external databases, and dealing with client certificate authentication — and suddenly TLS was everywhere. Here’s what I’ve actually learned
TLS in Docker: Securing Containers Without Losing Your Mind Read Post »
I’ve set up SSH key authentication on probably hundreds of servers at this point. It’s one of those tasks that should be simple and usually is — until it isn’t. This is a practical walkthrough of how I do it, with the security considerations that actually matter and the troubleshooting steps that have saved me
SSH Key Authentication on Linux: Setup, Security, and Things That Go Wrong Read Post »
I spent a while ignoring OCSP stapling because it felt like an advanced optimization that wasn’t worth the effort. Then I actually measured the TLS handshake times on a server without it and realized visitors were waiting for an extra round-trip to a CA’s OCSP server on every new connection. That changes the calculus. What
OCSP Stapling in Nginx: What It Is, Why It Matters, and How to Configure It Read Post »
I’ve been using OpenSSL for years and I still look things up. Not because the tool is bad — it’s incredibly powerful — but because the syntax is inconsistent and there are so many subcommands that it’s hard to keep everything in your head at once. This is my personal list of commands I reach
OpenSSL Commands I Actually Use — A Practical Cheatsheet Read Post »
I’ve configured Nginx as a reverse proxy dozens of times, and while the basic setup is always similar, the details — SSL termination, certificate management, header forwarding, timeout settings — are where things get interesting. This is how I approach it, with the reasoning behind each decision. What “SSL Termination at the Proxy” Means The
How I Set Up Nginx as a Reverse Proxy with SSL Termination Read Post »
I lost access to a private key once. Not because someone stole it — I upgraded a server, thought I’d moved everything, and realized a week later that the key for one of the domains was gone. The certificate was still valid, the site was working with the cached config, but when it came time
Automating SSL Certificate Backups: A Practical Approach Read Post »
Databases are special. Regular file backups don’t work well for PostgreSQL — backing up the data directory while the server is running is likely to give you a corrupt snapshot. You need PostgreSQL-aware tools. Here’s what I actually use for backing up PostgreSQL databases, from simple single-database dumps to continuous archiving. pg_dump — The Standard
PostgreSQL Backup and Restore on Linux Read Post »