Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Composite indexes match multi-column queries
A composite B-tree index orders tuples by its first key, then by the next key within each first-key group. This structure can make a tenant-specific time range cheap to locate. The useful rule is about how much index space a predicate narrows, not a prohibition against mentioning later columns or writing WHERE conditions in a different textual order.
...
A default route matches broadly; it does not rescue every failed path
An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.
...
A subnet prefix shapes connected routes; the routing table chooses the path
An IPv4 prefix length says how many leading address bits identify a network. For 192.0.2.5/24, the network is 192.0.2.0/24 and the ordinary broadcast address is 192.0.2.255. Configuring that interface commonly installs a connected route, but the prefix is not the entire routing algorithm. The kernel consults routing policy and route tables to select a path for each destination.
...
BGP is the Internet routing table
BGP exchanges reachability between independently operated networks, but there is no single authoritative Internet forwarding table. Each router learns a policy-filtered view, chooses routes, and attempts to install usable next hops. Two routers can legitimately select different paths to the same prefix. Understanding BGP means separating announcements, selection policy, and packet forwarding rather than treating them as one universal answer.
...
SACK reports received ranges beyond a gap so recovery can target missing data
A TCP cumulative acknowledgment identifies the next byte expected in order. If a segment is missing but later bytes arrive, that acknowledgment cannot advance across the hole. Selective Acknowledgment, or SACK, adds information about received byte ranges beyond the cumulative boundary. It helps a sender distinguish missing data from data already queued at the receiver, improving the information available to its recovery algorithm.
...
The TCP handshake establishes sequence spaces, not synchronized clocks
The TCP three-way handshake establishes the two directions of a byte stream. Each endpoint supplies an initial sequence number and acknowledges the other endpoint’s number. Those are independent sequence spaces, not a shared wall clock. Applications do not need synchronized machine clocks to connect. Later sequence numbers identify bytes and support ordering, duplicate handling, acknowledgments, and retransmission within that connection.
...
Kubernetes labels define selection, not authorization
Labels are key-value metadata used to select Kubernetes objects. A Service selector, an operational query, and a workload controller can all rely on them, but each consumer has its own API and behavior. A label change can therefore alter group membership while leaving the underlying process healthy. Review labels as inputs to actual consumers rather than as purely descriptive stickers.
...
Bash globbing expands before the command runs
A wildcard in a Bash command usually becomes a list of pathnames before the target program starts. That makes *.txt convenient, but it also makes the command depend on the current directory and shell options. The program receives arguments, without information saying which ones came from a wildcard. Decide whether you intend to pass matching files or a pattern for the program to interpret.
...
