Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
A PVC gives a Pod durable storage beyond the container
A container is ephemeral by design, so a PersistentVolumeClaim is the handle that pins real storage to it even when the Pod is recreated. The split is deliberate: a PersistentVolume declares capacity that exists, a PersistentVolumeClaim requests capacity that is needed, and a controller matches one to the other. With a StorageClass the claim can create its own volume through a provisioner, so nobody has to pre-build the storage.
...
Backpressure works when bounded admission changes the producer’s behavior
Backpressure connects a consumer’s limited capacity to the behavior of its producers. A full channel may make a producer wait, reject new work, or apply a deliberately chosen shedding policy. The important property is that the limit changes what upstream components do. A growing queue or a dashboard showing lag is evidence of imbalance, but neither is automatically a mechanism that controls admission.
...
The HPA grows and shrinks a Deployment by load
A HorizontalPodAutoscaler is a feedback controller, not a capacity planner. Its default synchronization interval is fifteen seconds. Depending on its configuration, it reads resource, custom or external metrics and updates a workload’s scale subresource. The basic calculation is desiredReplicas = ceil(currentReplicas * currentMetricValue / desiredMetricValue), followed by handling for missing data, readiness, tolerances, stabilization and bounds.
...
Postgres streaming replication keeps a warm standby
Physical streaming replication sends PostgreSQL WAL to a standby, which replays the records to maintain another copy of the cluster. It can send records without waiting for a whole segment to finish. This is distinct from logical replication of selected table changes. A running receiver and a reachable standby are useful health signals, but neither establishes that a particular committed row is already visible there.
...
Postgres connections are expensive, so pool and reuse
A warm pool reduces repeated PostgreSQL connection setup, but an idle connection can disappear while it sits in that pool. Server termination, network failure, or an intermediary’s idle policy can leave a client holding a socket that is no longer usable. Reuse must include failure detection and replacement; keeping an object in a pool is not evidence that its next query will succeed.
...
TLS 1.3 resumption reuses authentication state
Saving a round trip depends on the protocol and early-data mode. In TLS 1.3, an ordinary full handshake and a resumed handshake without early data normally both take one TLS round trip. Resumption can still reduce certificate transmission and authentication work. Enabling tickets does not make every HTTPS request start one RTT sooner.
...
Cache invalidation is a push, not a prayer
Changing an origin does not notify every cache that already holds its response. Invalidation is about controlling which stored copies remain eligible for reuse, not merely updating a file. A reliable release distinguishes expiration, validation, targeted removal, and choosing a new URL. These mechanisms have different scopes, and none remotely erases every copy a reader has downloaded.
...
Metric relabeling filters samples before ingestion
Prometheus has several relabeling stages, and their similar syntax can hide different effects. Target relabeling transforms discovered targets before collection. Metric relabeling transforms scraped samples just before ingestion. A drop action at the first stage can prevent an endpoint from being scraped; the same action at the second stage discards matching samples from an endpoint that was already contacted.
...
