Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Choose the clock and catch-up rule for a systemd timer
A schedule must specify what time means. “At nine each morning in New York” refers to a civil-time calendar. “A quarter hour after this job finishes” refers to an elapsed interval and an event. systemd timers support both, but the two clocks and reference points have different behavior around time-zone changes, suspension, and periods when the timer is inactive.
...
DNS needs a working TCP path when a UDP answer is truncated
DNS supports both UDP and TCP. A server sets the TC flag when a response is truncated for the available message space. A client receiving that flag must handle the incomplete result, commonly by retrying over TCP. This is about the DNS response limit in use, not proof that the physical network cannot carry any larger UDP datagram.
...
NAT shares an address by keeping distinct connection mappings
Network Address Translation changes addressing information as packets cross a boundary. The familiar many-clients-to-one-address arrangement uses network address and port translation: the router keeps mappings that distinguish simultaneous flows. A remote TCP server may see one source IP while seeing different source ports. That shared address identifies a translation boundary, not necessarily one computer, account, or person.
...
Loopback returns to the caller’s network namespace
Loopback addresses let a process communicate through its local IP stack without sending the exchange over a physical network link. IPv4 reserves 127.0.0.0/8 for loopback; 127.0.0.1 is the familiar member. IPv6 uses ::1. On Linux, the relevant local networking context is a network namespace. Two processes on the same physical machine can therefore have different answers to what counts as their own loopback service.
...
SSO delegates authentication; the app still verifies
Single sign-on lets an application rely on an identity provider’s authentication result. The user does not need to hand that provider password to each application. The application still owns its authorization decisions, local sessions, and integration configuration; confidential clients may also hold client credentials. Delegating authentication does not remove the application’s security boundary or guarantee that every future login can skip user interaction.
...
IPv6 resolves neighbors with ICMPv6 before the TCP connection can work
An IPv6 host on an Ethernet link needs a link-layer destination before it can send a frame to a neighbor. Neighbor Discovery performs that address-resolution work using ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages. It also covers functions beyond IPv4 ARP, including router discovery and neighbor reachability detection. Calling it merely “ARP with longer addresses” hides dependencies that matter when configuring an IPv6 network.
...
ARP maps an IPv4 next hop to a link-layer address
IPv4 forwarding chooses a next hop, but Ethernet still needs a destination MAC address. Address Resolution Protocol (ARP) asks the local link which interface owns an IPv4 address, then caches the answer as a neighbor entry. The mapping is learned rather than permanent, so it can age out, be refreshed after a move, or be forged by another host on the same broadcast domain.
...
Path MTU discovery can fail while handshakes and small requests still work
The path MTU is the smallest link MTU along a particular route. A sender cannot determine it solely from its own interface’s MTU because an intermediate link may carry smaller packets. Classic IPv4 Path MTU Discovery sends packets with Don’t Fragment set and uses ICMP fragmentation-needed feedback to reduce the estimated packet size. A working route and a working size estimate are separate requirements.
...
