Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Infrastructure as code is a changelog, not magic
Declarative infrastructure describes a desired result and lets a tool calculate changes. An imperative script can also inspect existing resources and behave idempotently; duplication is not inherent to scripting. Terraform’s advantage is a shared model of configuration, resource identities, dependencies, and proposed actions that reviewers can inspect together.
...
TIME-WAIT protects a connection incarnation, not exclusive ownership of a port
TIME-WAIT is a TCP state retained after certain orderly connection closures. It gives the closing exchange time to complete if the final acknowledgment must be repeated and helps prevent delayed segments from an earlier connection incarnation being confused with a later one. The relevant identity includes both endpoint addresses and ports. A TIME-WAIT entry is not simply a universal lock on one local port number.
...
TCP congestion control belongs to each sender, and peers can use different algorithms
TCP congestion control limits how a sender injects data into a network that has finite shared capacity. Its congestion window constrains outstanding data, while pacing, when used, controls how transmissions are distributed over time. The receiver’s advertised window imposes a separate flow-control limit. These mechanisms interact, but they describe different constraints and should not be collapsed into one ambiguous sending-speed setting.
...
UDP preserves datagrams; recovery and timing belong to the application
UDP carries discrete datagrams between transport endpoints. Its eight-byte header contains source port, destination port, length, and checksum fields. The protocol does not add TCP’s reliable ordered byte stream or its congestion-control behavior. This gives applications room to choose their own delivery policy, but it does not promise lower latency for every workload. A missing datagram can be more costly than a handshake when the application needs its contents.
...
cgroup v2 enforces different budgets with different failure modes
cgroup v2 organizes resource control in a unified hierarchy. A workload’s processes can share aggregate budgets, with limits inherited through the hierarchy rather than applied only to one particular PID. CPU bandwidth, memory usage, and task count are separate controllers with different enforcement behavior. Reading the actual cgroup files and failure counters is more useful than treating every configured limit as the same kind of hard stop.
...
A bounded retry gives a transaction another chance
A retry can recover a transaction rejected because of concurrent work. It cannot guarantee success, and it does not automatically make external effects idempotent. The retry unit should include every database read and application decision that determined the writes. Reusing an amount calculated from the first attempt’s snapshot can defeat the purpose of starting a fresh transaction.
...
Checking HTTPS beyond the lock icon
HTTPS protects a connection and authenticates its peer according to the client’s trust policy. It does not certify the site’s intentions, correctness, or availability. A security indicator is therefore neither just an encryption label nor a complete health report. A useful check separately evaluates the TLS connection, the HTTP response, and the service’s expected behavior.
...
SNI selects a TLS certificate for the requested hostname
Server Name Indication gives a TLS server a hostname while it is choosing handshake parameters and a certificate. In the certificate-based, no-early-data path discussed here, this happens before ordinary HTTP bytes, not before any bytes cross the network. SNI is a selection hint; the client must still verify the selected identity.
...
