Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Pod anti-affinity spreads peers away from each other
Pod anti-affinity expresses where a Pod should avoid selected peers. A hostname topology can reduce shared-node exposure; a zone topology can address a broader failure domain. The rule does not create extra capacity or prove application availability. It shapes placement, while replication, readiness, storage, and failure recovery remain separate responsibilities.
...
Object and block storage expose different update contracts
Block storage exposes addressable blocks through a device interface. Object storage exposes named objects through an API. Neither label alone specifies durability, consistency, sharing, or price. Start with the application’s required operations, then check the particular service’s contract. A filesystem, database, or compatibility layer can add behavior, but it cannot make every underlying interface interchangeable.
...
A shell function reads its arguments like a script
A shell function groups commands under a name and receives its own positional arguments. In an ordinary call, its body runs in the current shell rather than automatically starting a separate process. That makes functions useful for reusable operations, but it also means assignments, directory changes, and other shell state can affect the caller. A function needs an explicit contract for inputs, output, status, and any intentional side effects.
...
Upstream keepalive caches idle connections, not active capacity
An nginx upstream keepalive cache preserves eligible idle backend connections for later requests. In the tested configuration, keepalive 2 permits two idle connections in that upstream cache for each worker. It does not restrict the worker to two active backend connections. Reuse reduces repeated connection setup; it does not itself impose an application concurrency budget or guarantee lower latency for every request.
...
A Redis hash keeps related fields under one key
A Redis hash maps field names to byte values under one key. It fits an entity whose attributes are read or changed independently, such as a profile with a name and score. HGET and HSET each operate in one command; using a hash does not inherently add a second network hop compared with a string.
...
SRV discovery gives clients targets and ports that they must interpret
An SRV record describes a service target using priority, weight, port, and a target hostname. Its owner normally combines a service label, transport label, and domain, such as _echo._tcp.lab.test. A client that understands that service can query SRV, obtain target addresses through A or AAAA, and connect to the advertised port. Ordinary hostname lookup does not automatically perform this application-specific discovery sequence.
...
ANALYZE updates the estimates the planner relies on
ANALYZE updates the statistical model PostgreSQL uses to estimate query results. It does not rewrite the query, rebuild its indexes, remove dead tuples, or promise a faster plan. Its useful question is specific: does the planner understand the current distribution well enough to compare access paths? A bulk status change can invalidate that understanding even when the table still contains exactly the same number of live rows.
...
Check timesyncd’s service state and clock evidence separately
systemd-timesyncd is a minimal SNTP client for synchronizing the local system clock against configured time sources. It can help keep certificate checks and wall-clock timestamps meaningful, but it does not provide an unconditional accuracy guarantee. Whether the daemon can run, whether it receives acceptable samples, and whether the system reports synchronization are separate facts to establish.
...
