Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
LSM trees trade foreground writes for later merging
An LSM tree moves work from scattered updates toward buffered writes and later merging. That is a design trade, not a promise that every disk operation becomes sequential or that random writes always beat a B-tree. The useful question is whether foreground writes, background compaction, reads, and retained versions fit the same resource budget.
...
Anycast lets routing select a replica
Anycast gives an address several homes. Multiple sites announce the same prefix, and each network selects a usable path according to routing policy. This article focuses on Internet BGP; local anycast can use an interior routing protocol. A client usually lands at a topologically close replica without first contacting a global load balancer. When one site withdraws its announcement, the control plane can converge on another home.
...
Nagle and delayed ACK can stall the second part of a small request
Nagle’s algorithm reduces small TCP segments by holding additional short data while earlier data remains unacknowledged, unless enough data accumulates for a full segment. Delayed acknowledgment is a separate receiver behavior that can postpone an ACK briefly. The interaction matters when an application sends a request in multiple small writes and the peer needs the later bytes before producing a response.
...
SYN cookies answer when the queue overflows
A listening socket keeps two queues, not one. Half-open connections live in the SYN queue until the final ACK arrives; established ones then wait in the accept queue until the application calls accept(). Both have a limit, and which one overflows decides what the client experiences.
...
Read procfs as documented views of a changing process
Linux procfs exposes process and kernel information through filesystem interfaces. Many entries generate their contents when read instead of storing ordinary disk-file bytes. Each entry has a documented meaning, permission model, and format. Reading several entries does not freeze the process or create a transactionally consistent snapshot, so useful observations must be tied to the right process instance and interpretation.
...
VXLAN needs matching tunnel parameters as well as a working underlay
VXLAN carries an Ethernet frame inside a UDP packet so an overlay network can cross an IP underlay. Tunnel endpoints encapsulate and decapsulate frames, while a 24-bit VXLAN Network Identifier, or VNI, identifies the virtual segment. The outer IP addresses route between endpoints; the inner Ethernet and IP addresses serve the overlay. These are separate layers with separate reachability and configuration requirements.
...
The forward-secrecy boundary of TLS ECDHE
Forward secrecy limits the damage from later compromise of a long-term authentication key. For a correctly authenticated ephemeral Diffie-Hellman exchange, that key alone does not reveal earlier session secrets. The claim assumes those ephemeral secrets were not also captured. It does not make a compromised endpoint, key log, or recorded plaintext safe.
...
The systemd journal needs an explicit retention contract
The systemd journal stores messages with structured metadata in journal files. That makes service output searchable without first inventing a parser for every application’s text format. Keeping those messages for a useful period is a separate requirement. Storage location, size policy, rotation, and forwarding determine which evidence remains available when an incident is investigated later.
...
