Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
HTTP methods describe the intent
A URL identifies a target resource; the request method describes the operation the client asks the origin to apply. Together they form a contract read by the server, caches, proxies, crawlers, and retrying clients. A method is not a decoration on a path. It is a promise about the intended effect, and infrastructure can only make safe decisions when that promise is honest.
...
HTTP/1.1 permits persistent connections by default
HTTP persistence allows multiple exchanges to share a connection, so repeated requests may avoid TCP setup and TLS negotiation. It is a protocol capability, not a promise that a particular socket stays open. Whether another request actually reuses it also depends on complete message framing, client pool policy, server behavior, and the connection’s current condition.
...
Cache-Control private versus shared
Storage scope is not an identity system. Cache-Control: private tells a conforming shared cache not to store a response; it does not teach a browser which application account owns the bytes. This distinction matters when a person logs out, another account logs in, and the same browser requests the same URL again.
...
Negative DNS answers preserve absence until their cache lifetime expires
DNS can return useful information by saying that data is absent. NXDOMAIN reports a name error; NODATA describes a successful response without the requested record type. In a direct query without aliases, these distinguish a nonexistent name from an existing name that lacks the requested data. Caching those results avoids repeating the same unsuccessful upstream lookup for every client request.
...
DNSSEC validates a chain of signed data, not merely the presence of signatures
DNSSEC adds origin authentication and integrity checking for DNS data. RRSIG records sign RRsets, DNSKEY records publish verification keys, and a parent’s DS record identifies a child DNSKEY through a digest. The parent signs its DS RRset; it does not simply sign the child’s public key directly. Validation follows these relationships from a configured trust anchor to the requested data.
...
Resume a download only after checking its range and representation
A range request asks for part of the selected representation so a client can resume a transfer or read a specific byte window. A satisfied single range normally returns 206 with Content-Range. A server may ignore the range and return the complete representation with 200. A range that cannot be satisfied can instead produce 416; these responses require different client actions.
...
SQLite is an embedded database engine
SQLite is a database engine linked into the application rather than a separate database server. Its main database file stores schema, tables, and indexes in a portable format. That makes it useful for local application state, embedded devices, and services whose write workload fits its concurrency model. The file is still governed by transactions and locking; ordinary file-copy intuition is not enough to operate it safely.
...
A stale replication slot holds WAL back
A PostgreSQL replication slot records retention requirements for a consumer. Once the slot has reserved a WAL position, losing the consumer’s connection does not automatically release that position. The primary may keep generating log while the slot’s requirement remains unchanged. The operational risk is retained storage and an increasingly expensive catch-up or rebuild decision. Slot usability depends on retained WAL availability and the configured invalidation rules.
...
