Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
One systemd user manager serves an account’s sessions
A systemd user manager runs services on behalf of one account. Multiple login sessions for that account normally share the same manager, rather than each shell receiving a private service universe. User unit files can live under ~/.config/systemd/user, and systemctl --user addresses the user’s manager. This provides lifecycle management with the account’s authority, not automatic isolation from every shared system resource.
...
Migrations are versioned schema changes
The schema of a database is not a one-time design; it evolves with the software that uses it. Instead of editing the schema ad hoc, migrations apply a named, ordered set of changes that any environment can replay.
Schema as code Treat the schema as source code: each migration is one small, named, ordered step that moves the database from one state to the next, and the sequence itself lives in the repository. A fresh environment replays the steps from an empty database to the current version, which is exactly how tests, CI, and new servers all converge on the same shape without ad-hoc ALTER TABLE edits on a live box. The schema stops being an undocumented fact of a single instance and becomes a reviewable artifact with history, blame, and a pull request.
...
MSS clamping can repair one TCP path without repairing its MTU feedback
TCP’s Maximum Segment Size option advertises the receiving endpoint’s maximum TCP data size under the option’s defined accounting rules. Each direction has its own advertisement; the two values need not match. A router can reduce those advertisements while forwarding SYN messages so later data segments fit a constrained path. That changes TCP behavior for the affected connections, not the underlying link MTU itself.
...
CORS preflight depends on the request shape
CORS preflight asks whether a browser may send a particular cross-origin request shape. It is an OPTIONS request containing the proposed method and relevant request-header names. The browser checks the server’s response before sending the actual request. This mechanism is distinct from checking whether application JavaScript may read an actual response that has already arrived. Both stages can fail, but their effects on server-side execution differ.
...
Caddy automates HTTPS issuance and renewal
Caddy can obtain and renew managed certificates without an operator manually implementing ACME. That removes repetitive work, not the prerequisites for issuance or the need to notice failures. A valid certificate today proves neither that the next renewal can complete nor that every TLS hop uses the same certificate. Identify the names, validation route, storage, and termination boundary first.
...
Idempotency keys are client promises
An idempotency key names an intended action, not a transmission attempt. When a service supports it, the client sends the same key when retrying that action after an uncertain result. Generating a new key for every retry tells the server something different: this is another action, which may legitimately produce another business effect.
...
Redis pipelining reduces per-command waits
Pipelining lets a client send several Redis commands without waiting for each reply before sending the next. It reduces request-response waiting and can amortize socket I/O overhead. Redis still executes the commands and produces their replies; batching is neither a promise of parallel execution nor a transaction boundary.
...
Accept plus Vary let one URL answer in several formats
One resource can have an HTML view for people and a JSON representation for programs. Sharing a URL is useful only when the origin and its intermediaries preserve that distinction. The endpoint must select an available format, serialize it honestly, describe its cache variation, and validate the selected representation rather than some other version of the same resource.
...
