I work directly on live Linux server incidents — from compromised systems and malware infections to high CPU usage, service crashes, and production outages. My focus is fast diagnosis, controlled recovery, and long-term hardening.
DevOps
Three load balancers, three different jobs, and in real production they usually stack rather than compete. HAProxy for high-throughput L4/L7 distribution, Nginx for application-aware routing and TLS termination, Cloudflare for global Anycast edge and failover. Here are production-shaped configs for each, the tradeoffs that decide which
Linux
Ubuntu 26.04 keeps Netplan as the default network layer, YAML files under /etc/netplan/, rendered to either systemd-networkd or NetworkManager. Nothing dramatic changed from earlier releases, but a few sharp edges still catch people, and one of them will disconnect you from a remote box mid-SSH if
Kubernetes
Manual compliance audits don't survive contact with Kubernetes. Pods live and die in seconds, a snapshot is stale the moment you take it, and a single kubectl patch applied during a 3 a.m. incident silently drifts a cluster off its CIS baseline until the next scheduled audit
DevOps
If you've ever maintained a private repository alongside a public mirror — internal infra code you want to open-source part of, or a confidential project with a public-facing subset — you know the sync problem gets ugly fast. Manual cherry-picking, scrubbing internal paths by hand, forgetting which
DevSecOps
Most people maintaining an open source project weren't hired to be security engineers, and GitHub's security settings page is dense enough that it's easy to close the tab and move on. But leaving those settings untouched quietly stacks the deck against you: no automation,
Linux
Ripping the init system out of a running Linux install is the kind of thing most of us know is possible but never actually do, because PID 1 is the one process you really don't want to get wrong. Daniel Cordova did it anyway — pulling systemd and dropping
Linux
The most maddening thing about regular expressions isn't the syntax — it's that the syntax changes depending on what you run it through. A feature that works in one tool is missing in another, or present but spelled differently. You write a pattern that works perfectly in
Self-Hosting
Most blog engines want a database, a runtime, a package manager, and a list of dependencies longer than the content you're trying to publish. Carlos Fenollosa went the other direction and built bashblog: a complete static blog generator that lives in a single Bash script of roughly a
Linux
A process with a steady workload shouldn't keep growing its resident memory. When it does, the first question isn't "how much RAM is free." It's "where did allocations stop being released." And on Linux that's rarely obvious from
Self-Hosting
The appeal of a tunnel is that it flips the usual exposure model. Instead of poking a hole in your firewall and accepting inbound traffic, the tunnel client opens an outbound connection to a relay, and public requests come back down that pipe. No open ports on the origin, no
System Design
A benchmark number drops, and within a day half your feed is repeating it: engine X demolished engine Y, here's the chart, end of discussion. The number feels objective. It's a measurement, after all. The trouble is that a database benchmark almost never measures the one
DevOps
Here's a question worth sitting with: what happens if you just point a git server at an object storage bucket? Xe Iaso actually built it — a project called objgit, a git server with no local disk, no /usr/bin/git, and no database. The writeup is one of