SSL/TLS

Rate limiting is one of those things that’s easy to get wrong in both directions — too loose and it does nothing, too tight and you start blocking real users. I’ve tuned rate limiting configs on production sites a few times and I’ve made both mistakes. Here’s what I’ve learned about how Nginx rate limiting […]

Sometimes you need to protect a URL quickly — a staging environment, an admin panel, a Prometheus metrics endpoint, internal documentation. Setting up a full authentication system is overkill. Nginx’s built-in basic authentication handles these cases well. Basic auth has a reputation for being insecure, but that reputation is mostly from HTTP days. Over HTTPS,

A default MySQL or MariaDB installation is conservative — configured to work on minimal hardware. Most production servers have significantly more RAM and CPU than the defaults assume, which means the database is leaving performance on the table. These are the settings I tune when setting up a database server. Not all of them apply

Running a Node.js app directly on port 80 or 443 is possible but not how I’d do it in production. Nginx in front of Node.js gives you SSL termination, static file serving, caching, compression, rate limiting, and request buffering — things Node.js can do but doesn’t do as efficiently as a dedicated web server. Here’s

SSH is more than a remote shell. The tunneling capabilities — local forwarding, remote forwarding, and dynamic SOCKS proxying — are genuinely useful for accessing services that aren’t directly reachable, and I reach for them regularly. Local Port Forwarding Local forwarding creates a tunnel: you connect to a local port, and SSH forwards the connection

LVM changed how I think about disk management. Before LVM, adding storage meant figuring out partitions, worrying about running out of space, and sometimes having to move data around to resize things. With LVM, extending a filesystem is usually a matter of three commands. Shrinking, snapshotting, moving storage between devices — all doable without downtime.

rsync is one of those tools I reach for constantly. Backups, deployments, syncing configs across servers, copying large directory trees — it handles all of it well. The basic invocation is simple, but there are a few flags and patterns that make a huge difference once you know them. The Basic Idea rsync transfers files

Log files have a way of growing quietly until they fill up your disk at the worst possible moment. I’ve seen it happen more than once — a busy web server accumulating logs, nobody checking, and then one night the disk hits 100% and everything stops. Logrotate prevents this. It’s already installed on most Linux

Knowing how to find and manage processes is fundamental sysadmin work. It’s not glamorous, but it comes up constantly — debugging a runaway process eating CPU, finding what’s holding a port open, or tracing which process opened a particular file. ps: The Process Snapshot ps shows a snapshot of current processes. The options are confusing

Cron is one of those tools that’s been around so long and is so widely used that most people learn just enough to make it work, then stop. But there are enough gotchas and useful features that it’s worth understanding properly. The Cron Daemon and Config Files crond (or cron on some systems) is the