Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
DHCP lends the address until it expires
Dynamic DHCPv4 allocation lends an address for a lease period. Renewal can extend that period; expiry permits reuse. DHCP also supports other allocation policies, so a finite dynamic lease is the scope of this article, not the only configuration DHCP can deliver.
...
Client certificates authenticate control of a private key
Mutual TLS authenticates a client’s control of a certificate’s private key as well as the server’s identity. It does not inherently identify a physical device. A copied software key can be used elsewhere; hardware binding and device attestation require additional mechanisms. An enrollment policy can associate a key with a device, but TLS alone does not establish that association.
...
SSRF makes the server open the door
Server-side request forgery makes a server issue a request selected or influenced by an attacker. A thumbnail service, importer, webhook tester, or document renderer may reach destinations that the requesting user cannot reach directly. The server contributes its network position and whatever credentials that particular fetch path actually attaches. A URL fetch does not automatically inherit every account credential available to the process.
...
CSRF asks the browser where the request came from
Browsers can attach session cookies to attacker-triggered requests. CSRF defenses distinguish authorized request contexts; they do not prove that a person saw or intended an action.
Cookies travel without asking Browsers attach cookies to a request according to domain, path, Secure, SameSite, and other browser rules, not on whether the page causing the request was the user’s earlier intent. That means a page on an attacker’s origin can make the victim’s browser send a state-changing request — a transfer, a password change — that carries the authenticated session cookie, and the server sees a request that looks like it came from the legitimate user. This is why a request’s mere presence of credentials is not evidence of the user’s intent; the browser is following the cookie rules, not the user’s choice.
...
CI artifacts need an explicit handoff contract
A CI job can finish successfully while the next job receives the wrong files. An artifact is a stored output handed to another step, job, person, or release process. Its name alone rarely identifies everything the consumer needs to know. Treat the handoff as a contract covering the producing run, source revision, payload, integrity evidence, access policy, and availability window. Those details turn “download the build” into a checkable operation.
...
GitHub Actions workflows gate the build
A workflow can produce evidence for a merge decision, but YAML alone does not make that evidence mandatory. A dependable build gate connects the intended event, the exact revision being tested, meaningful test results, and a repository rule requiring the correct check. Review those connections together. A green badge on some earlier run is not proof that the proposed merge has satisfied today’s requirements.
...
Prometheus rules track alert state before notification delivery
An alerting rule evaluates a PromQL expression and tracks the returned label sets over time. Prometheus decides whether each resulting alert is pending or firing. Alertmanager receives alert information and handles notification routing, grouping, silencing, and inhibition. A reliable investigation follows those stages separately: a firing alert is evidence of rule state, not proof that a person received a message.
...
Recording rules should preserve the components of a ratio
Repeated service-level queries are good candidates for recording rules when their cost and reuse justify precomputation. The design question is what to store. Saving only an instance’s error percentage can discard the traffic volume needed for later aggregation. Saving error rates and request rates preserves the numerator and denominator, allowing consumers to calculate a correctly weighted service fraction.
...
