Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Vacuum keeps a growing database from bloating
In multi-version storage, deleting a row records the change without immediately freeing the space. Reclaiming that space is maintenance work, and when it is skipped the cost shows up slowly.
Deleted does not mean gone An UPDATE or DELETE leaves old PostgreSQL row versions until they are no longer needed by any relevant snapshot. A long transaction can delay that point while other sessions keep changing rows. The transaction alone does not manufacture new bloat in an otherwise idle table. Reclaiming obsolete versions and making their space reusable is distinct from merely committing the delete.
...
Scheduled jobs need to be safe to rerun
A scheduler starts attempts, while the business usually cares about completing a logical task. One daily credit may be attempted several times after an error, a restart, or an operator retry. Giving every attempt a new identifier makes those duplicates indistinguishable from new work. Use a key that identifies the intended task, such as its name and nominal scheduled time, and define what a repeated key means before changing business state.
...
WAL makes commit durable before page flushing
Write-ahead logging lets a database make a transaction durable without immediately flushing every table and index page that transaction changed. In PostgreSQL, the log records needed to recover a page must be durable before that page is written to storage. Normal synchronous commit also waits for the commit record to be flushed. Buffered table changes and durable log records therefore advance through different paths.
...
Deadlocks happen when two writers wait on each other
A deadlock requires a cycle of incompatible waits. If one transaction holds a row while another waits, the holder can still finish and release it. If both hold a resource the other needs, neither can complete that path. PostgreSQL detects the cycle and aborts one transaction, allowing the other to continue. The application must distinguish that rejection from an ordinary slow wait.
...
Least privilege is a threshold, not a feeling
Least privilege means granting a principal the operations required for a defined job, on the intended resources, for an appropriate lifetime. It is a testable policy rather than a reassuring label. Start with the service’s real launch identity and dependencies; an unused permission and a missing permission are different findings that need different responses.
...
MVCC selects row versions through visibility rules
Multi-version concurrency control lets PostgreSQL keep different row versions and decide which ones a query may see. An ordinary reader can continue seeing an older committed version while another transaction writes a newer one. This reduces conflicts between reading and writing, but does not give every transaction one permanently frozen view. Snapshot lifetime depends on isolation, and a transaction can see its own earlier changes even when other transactions cannot.
...
TLS 1.3 handshake basics
TLS 1.3 establishes traffic keys and authenticates the peer under the application’s trust policy. Ordinary HTTPS authenticates the server; client certificates are optional, not an automatic consequence of encryption. A successful TCP connection alone establishes neither identity nor a working HTTP service.
...
Resolution order depends on the application and its name-service path
A hostname lookup starts with the program making it. On Linux, an application using glibc name-service interfaces can consult the services listed for hosts in /etc/nsswitch.conf. A program with its own DNS client may take a different path. There is no universal sequence in which every application checks a cache, then a hosts file, then the internet.
...
