Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Prometheus pulls metrics and records scrape outcomes
Prometheus collects metrics by requesting an HTTP endpoint on each configured target. The target exposes observations; the collector chooses when to scrape, parses the response, and stores samples. This arrangement makes collection failures observable from the collector’s perspective. It does not guarantee that the endpoint is reachable, that every expected target was discovered, or that the application’s user journeys work.
...
Enable gzip explicitly, then verify negotiation and decoded bytes
gzip is a response content coding: nginx can send a compressed representation that an accepting client decodes. Enabling it requires gzip on; gzip_types extends the eligible MIME types but does not activate compression by itself. The result depends on the response, request capabilities, and effective configuration. A smaller body is useful only if it still decodes to the intended content.
...
A request limit protects the budget named by its key
A request-rate limit applies to the identity expressed by its key, not automatically to a person, account, or endpoint. limit_req_zone stores shared state for those key values, and limit_req applies the zone while handling a request. Two locations using the same zone and key can consume the same budget. Choosing a variable therefore defines a real fairness and enforcement boundary.
...
A reverse proxy needs an explicit header trust boundary
A reverse proxy accepts a client connection and makes a separate request to an upstream application. The application’s socket peer is therefore the proxy, while information about an earlier client can arrive through request headers. Those headers are useful only when the deployment defines who may set them and how they are validated. Proxying a request does not automatically make every forwarded identity or scheme claim trustworthy.
...
nginx matches normalized paths and can select a location again
nginx location matching uses a normalized URI path rather than the untouched request-target text. Percent-encoded characters are decoded, relative path components are resolved, and adjacent slashes can be merged according to configuration. Later processing can change the current URI again and trigger another location search. Understanding both transformations is necessary when a request appears to enter a different handler than its original spelling suggests.
...
Namespaces scope objects; policies establish other boundaries
A namespace scopes many Kubernetes objects within one cluster. Two teams can each create a ConfigMap named settings because those objects have different namespace-qualified identities. This organizational boundary is useful, but it does not automatically provide network isolation, a dedicated kernel, reserved node capacity, or complete tenant separation. Identify which additional policies enforce the boundaries your workload actually requires.
...
Image tags can move while existing containers keep their image
An image tag is a readable name associated with an image reference. Unless a registry policy prevents reassignment, the same tag can later identify another artifact. Tags such as v1.4 and latest differ in naming convention, not in an inherent guarantee of immutability. Reproducing a deployment requires recording the artifact actually selected, together with the platform and runtime configuration that determined its behavior.
...
Kubernetes Services give pods a stable home
A Service separates a stable discovery interface from replaceable backends.
One address in front of many An ordinary ClusterIP Service keeps a virtual address during that object’s lifetime, and cluster DNS provides a discovery name. Callers can depend on that name while interchangeable Pods are replaced. This separates a stable client-facing contract from the lifecycle of individual backends, without requiring a config push for every replacement.
...
