Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
systemd dependencies separate activation, ordering, and readiness
A dependency graph needs to express more than “start the database first.” One relationship decides whether another unit is pulled into the transaction; another orders the jobs; the service type defines when startup has finished. Application readiness is a further promise that the program must actually fulfill. Confusing these layers produces a boot sequence that looks ordered while the dependent service still starts too early.
...
nginx validators are only as sound as their representation identity
A validator lets a recipient ask whether its stored representation still matches the selected one. A successful conditional GET can return 304 without retransmitting the body. Freshness is a separate decision: it determines when a stored response can be reused without that request. An ETag does not itself specify a cache lifetime, and a 304 is not a replacement body.
...
Locks wait politely when a transaction grabs them
A lock wait can be healthy coordination or an expensive queue. PostgreSQL’s lock_timeout lets an operation stop waiting, but it does not diagnose why the holder is slow or decide whether retrying is appropriate. Choose the timeout from the operation’s latency budget, and inspect the blocking transaction before increasing the limit or multiplying attempts.
...
Partial indexes and writes
A partial index filters rows, not columns. An index on id WHERE status = 'open' stores identifiers for open rows; status decides membership without becoming the search key. That distinction matters when estimating maintenance: a column need not appear in the stored key to affect an update’s cost.
...
Strace explains selected system-call boundaries
Strace observes system calls and signals at the boundary between a selected Linux process and the kernel. It can reveal attempted paths, arguments, return values, and errors without rebuilding the program. That evidence is useful when application logs omit an operation, but it does not expose every user-space decision or automatically identify which failed call caused the application’s final outcome.
...
Partition pruning skips whole partitions a query cannot need
Partition pruning excludes entire partitions that cannot contain matching rows. It is different from using an index to find rows within a remaining partition, and it is not a page-level cache trick. PostgreSQL can perform this exclusion while planning a query or later when parameter values become available during execution.
...
HTTP3 rides UDP while HTTP2 stays safe over TCP
HTTP/3 runs QUIC over UDP:443, and the reason to care is what a lost packet costs. On a TCP connection every stream shares one byte stream, so a dropped segment blocks delivery of everything behind it until the retransmission arrives. QUIC gives each stream its own loss recovery, so the same drop blocks only the streams whose data was in that packet.
...
cgroups enforce container budgets within a hierarchy
Kubernetes resource fields become useful constraints only when the node’s execution stack applies them. On Linux, kubelet and the container runtime use cgroups to organize processes and configure resource controllers. The result is a hierarchy, not merely one number attached to a Pod. Check the relevant container group and its inherited constraints before deciding what budget a process can actually consume.
...
