Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Circuit breakers stop storming a down service
A circuit breaker decides whether a new call should reach a dependency that appears unhealthy. It can reject promptly instead of spending resources on another likely failure. It does not repair that dependency, cancel calls already running, or prove that rejected work would have failed. Its value depends on the failure signals and recovery policy it actually implements.
...
Target relabeling selects and labels targets before scraping
Service discovery produces candidate targets and metadata. Target relabeling transforms those candidates before Prometheus scrapes them. It can keep or drop targets, change how they are addressed, and create labels carried into collected series. This is a different stage from rewriting individual scraped samples. Understanding the stage prevents a configuration intended to remove one metric from accidentally removing an entire target.
...
Collation decides how strings compare and sort
Text order is part of a query’s contract. A list sorted using byte order can differ from one sorted using linguistic rules, and a case-insensitive comparison can change which names a uniqueness rule considers duplicates. PostgreSQL supports database defaults as well as column and expression collations, so behavior should be made explicit where it affects business identity or pagination.
...
A bind address selects local destinations; reachability needs the whole path
A server’s bind address selects which local destination addresses its socket can accept. Binding an IPv4 listener to 127.0.0.1 differs from binding it to 0.0.0.0, the wildcard address. Neither setting alone describes the complete access policy. Routing, network namespaces, packet filtering, port publication, proxies, and application authentication determine how a request reaches the listener and what it may do afterward.
...
proxy_pass maps the URI as well as selecting an upstream
nginx proxy_pass chooses an upstream destination and also affects the request URI sent there. The important distinction is whether the directive includes a URI component, not simply whether its text ends with a slash. In an ordinary prefix location, a literal target URI replaces the matching normalized prefix. An authority-only target can pass the original request URI when the request has not been rewritten.
...
Redis transactions isolate execution without rollback
A Redis transaction is a connection-scoped command queue followed by an isolated execution window. MULTI starts the queue; EXEC runs accepted commands in order. The useful guarantee is that another client’s commands cannot run between those operations. It is not a promise to undo successful writes when a later command fails.
...
A DaemonSet puts one Pod on every eligible node
Where a Deployment cares about total count, a DaemonSet cares about coverage: a new node immediately gains the same service. Node-level concerns — shipping logs, exposing hardware metrics, running the network fabric, enforcing policy — must exist everywhere or they exist nowhere useful. A per-node script or a sidecar in every pod approximates this and rots immediately: new nodes miss it, version skew creeps in, and nobody can answer “which nodes run the agent” without an audit.
...
Docs as code make claims reviewable
A guide can be stored beside the application and still describe a command that never worked. Docs as code provides a way to discover and review that mistake: plain source files, version history, ownership, a preview, and checks attached to the change. It does not make prose correct automatically. The valuable link is between a documented claim and evidence from the implementation that the reader will actually use.
...
