Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
ssh-agent remembers your decrypted keys while you work
An SSH agent provides signing operations for public-key authentication. For ordinary software keys, loading an encrypted private key unlocks material that the agent can then use without asking for the file passphrase on every connection. Clients receive public identities and signatures, not an exported private key through the normal agent protocol. Hardware-backed identities are different: the authenticator can retain the private key and require touch or verification.
...
Failover is a practiced switch
A standby helps only if the promotion path works and the old writer cannot corrupt the new history. Failover is a decision, a procedure, and a rehearsal. A healthy-looking replica is not proof that clients can reach it or that it contains every acknowledged write. Define the required recovery time and acceptable data loss before deciding when to switch.
...
Taints repel pods that do not tolerate them
A taint repels Pods that do not tolerate its effect. A toleration removes that obstacle; it does not force placement onto specialized hardware. Dedicated-node designs usually combine a taint with a label and required node affinity, then check capacity and admission policy separately.
...
A window frame decides which rows one aggregate sees
A window partition determines which rows belong together; a window frame determines which of those rows feed a frame-sensitive calculation for the current row. Confusing these boundaries can turn a running total into a repeated subtotal or make last_value return the current value when the report expected the final value in the partition.
...
Capacity planning is a number, not a guess
Capacity planning turns a demand forecast into a provisioned operating envelope. The useful question is not how many requests a machine can accept before crashing, but what workload the service can sustain while meeting its latency and correctness requirements. That answer depends on request cost, dependencies, and failure assumptions. A spreadsheet becomes useful when each of those assumptions has a source and an owner.
...
File descriptors name a process’s open references
A file descriptor is a small integer used within one process to refer to an open resource. The process’s descriptor table maps that number to an open file description maintained by the kernel. For a regular file, the description includes the current offset and file status flags. Another process can use the same integer for a completely different resource, so the number alone is not a global file identity.
...
EnvironmentFile supplies values when systemd executes a process
An environment file separates deployment values from the unit definition that describes process supervision. systemd reads the configured file before executing a service command and supplies those values in that process’s environment. Editing the file does not rewrite the environment of an already running process. A reload helper is another process, however, and can receive newer file values than the service’s existing main process.
...
Promote a verified artifact through environments
A staging test establishes facts about the artifact and environment that actually ran. Building again before production creates another output whose identity must be checked or whose behavior must be revalidated. Promotion carries an already verified artifact to the next environment and records that decision. It removes one source of uncertainty, but it does not make staging and production equivalent or eliminate the need to verify the resulting deployment.
...
