Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Structured nginx logs need escaping and a value-type contract
A log_format that resembles JSON is not necessarily a reliable structured event format. nginx substitutes variable values into the text, and those values can contain quotes, backslashes, control characters, or no data at all. Correct string escaping and correct value types are separate requirements. Testing emitted records with a real parser catches failures that a visually convincing configuration or successful nginx -t cannot establish.
...
Liveness and readiness tell Kubernetes how the Pod feels
A slow start is not a dead process: readiness shields traffic while liveness only cares about keeping the process alive. Teams wire a single HTTP endpoint into both probes, and then every slow dependency becomes a restart loop — the app needs time, liveness refuses to grant it. Two probes exist because “not ready” and “dead” demand opposite responses: one asks for time, the other for a restart.
...
Redis stream groups track delivery positions
A Redis stream does not automatically track a separate cursor for every connection. Ordinary XREAD uses a position supplied by the application. A consumer group instead owns a server-side last-delivered position plus pending delivery records. Confusing those two forms of progress can make a restart skip unfinished work or replay effects already completed.
...
Read replicas serve demand copies
A read replica can serve queries while another database handles writes. That can move reporting, search, or other eligible reads away from the writer, but routing a connection is only part of the design. The application must specify which committed changes a result needs to include. This article uses a PostgreSQL physical hot standby, whose normal recovery mode permits reads but does not accept ordinary writes.
...
A CNAME changes DNS resolution while the requested hostname stays the same
A CNAME record associates an alias name with another DNS name. When resolving an address through that alias, a resolver follows the target until it obtains the requested data or encounters a failure. This lets a public hostname remain stable while its DNS dependency changes. It does not redirect a browser to another URL or replace the application’s requested hostname.
...
EXPLAIN shows how Postgres will do the work
EXPLAIN prints the planner’s proposed execution plan; EXPLAIN ANALYZE executes the statement and adds measured rows and times. A slow query needs both a hypothesis and a measurement. Save the query parameters, PostgreSQL version, and original plan before changing an index or rewriting a join. Those details make the next plan comparable and prevent an improvement on one input from hiding a regression on another.
...
git bisect automates a regression search
Automated bisection repeatedly checks a revision and turns the result into a history decision. It can replace many manual checkouts with roughly logarithmic probes on a simple range, but the speedup depends on a trustworthy test. A wrapper that misclassifies missing tools or broken infrastructure can confidently identify the wrong commit. Designing the verdict contract is therefore part of debugging, not merely setup around the search.
...
Multiple DNS addresses do not guarantee balanced or healthy traffic
Several A or AAAA records at one name provide an address set. A DNS server may rotate the order it returns, but the receiving resolver and application decide how to use that set. Ordinary address records contain no request-load measurement or application-health result. Their presence alone does not promise equal traffic, automatic failover, or even a particular first address across implementations.
...
