Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Server-Timing exposes named measurements to the browser
The Server-Timing response header lets a server attach named measurements to a response. Browser developer tools and performance APIs can then associate those measurements with the resource request. It is useful when the network waterfall shows a long wait but cannot explain whether backend work involved a database call, rendering, or another measured operation. The header supplies server-selected observations, not an independent browser measurement of those operations.
...
The Age header tells how long a cached copy has been around
Age is an estimate of elapsed seconds since an origin generated or successfully validated a response. It includes time in caches and in transit. It is not the object’s creation timestamp, a count of requests, or simply the time spent on the last proxy’s disk. Reading it correctly requires the response’s freshness policy and the request context.
...
A reverse proxy enforces an entry policy only on traffic that traverses it
A reverse proxy accepts client requests and makes a separate upstream exchange with an application. It can centralize routing, transport, headers, and admission policy when those behaviors are configured. It does not automatically hide every backend interface, authenticate every caller, or terminate TLS. The useful boundary is the actual traffic path and policy applied there, not simply the proxy’s position in a diagram.
...
Traceroute reports probe replies, not a complete map of forwarding health
Traceroute sends probes with increasing TTL values to discover where packets expire and which systems report that expiration. An IPv4 router forwarding a packet decrements its TTL; when it expires, an ICMP Time Exceeded response normally identifies a responding hop. A traditional UDP trace finishes when the destination reports an unused port. The output is a series of observations about probes and replies, not a guaranteed inventory of every forwarding device.
...
Dual-stack address ordering and successful connection choice are separate
Discovering A and AAAA records provides possible destinations. It does not select a successful connection by itself. Address ordering, source-address selection, routing, and the application’s connection algorithm all contribute. RFC 6724 describes default source and destination selection rules, while applications can impose their own choices. A program requesting only IPv4 has already narrowed the result before any dual-stack connection strategy can act.
...
Zero-downtime migrations change schema while old code runs
A migration that rewrites a busy table in one committing statement is long and blocking. A sequence of small, backward-compatible changes moves the same schema forward with no maintenance window, because each step is separately deployable and separately reversible.
What is being managed is a lock, and the question is how long it is held — which depends on how much data the statement touches.
...
Blue-green deployment keeps two environments ready
Blue-green deployment prepares a new application version in a separate environment while the previous version serves traffic. After readiness checks, routing directs new work toward the new environment. Keeping the old environment available can shorten rollback, because recovery need not wait for another build. The pattern does not make every dependency duplicated, every switch instantaneous, or every data change reversible.
...
Keep reusable access tokens out of request URLs
A reusable access token grants whoever possesses it some defined access. Putting it in a URL exposes that capability to systems that routinely copy URLs: access logs, monitoring records, browser navigation history, bookmarks, and shared links. The exact exposure depends on the request and policy, but a secret-looking query parameter is not automatically protected by its name. Treat transport placement as part of the credential’s disclosure boundary.
...
