Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Redirects are promises about where
A redirect is a response that asks a client to make a new request at a different target. Its Location field and status code describe both destination and method behavior. Browsers often follow redirects automatically, but a library can stop, inspect, or reject them. Treat every hop as observable protocol data: the final page alone cannot tell you whether a POST became a GET, whether credentials crossed an origin boundary, or whether a loop consumed the retry budget.
...
Compression negotiation is content negotiation
HTTP compression selects a coded representation, not a new media type. Gzipped text remains text after decompression. A useful check therefore asks three questions: was the coding acceptable, did the transfer become smaller, and did decoding recover the intended bytes? A compression checkbox or a successful status code cannot answer all three.
...
Cache headers are a two-way contract with browsers
An origin defines storage and freshness policy; a cache decides whether its stored response can satisfy the next request. When it cannot reuse that response directly, validators can make checking cheaper. These are separate decisions. Finding Cache-Control and ETag in one successful response does not prove that the next request follows the intended path.
...
Log rotation needs writer handoff and a retention budget
Log rotation divides a continuing stream into files that can be retained, searched, compressed, and eventually removed. A useful policy defines both when to rotate and which history to keep. It must also account for how the application holds its output file open. Renaming a pathname and successfully redirecting future log records are separate steps in that operational contract.
...
SSH key hygiene is mostly limiting where a key works
SSH key hygiene starts with knowing which credential grants which access, who owns it, and how that access ends. A key comment helps people maintain an inventory, but it is not an authenticated owner record or an authorization rule. Track fingerprints alongside accountable owners, intended accounts, permitted operations, and a removal plan. Generating a modern key is only the beginning.
...
A firewall policy must match the packet path, family, and chain order
A firewall applies packet policy at particular points in a network stack. A useful rule therefore names more than a port: its address family, hook, direction, state conditions, and place among other rules matter. With nftables, base chains attach to Netfilter hooks at specified priorities. The effective packet path, rather than the order of descriptions in an operations document, determines which decisions a packet encounters.
...
Harden a systemd service by testing its boundaries
Service hardening should turn a specific unwanted operation into a denied operation while preserving the work the application must perform. systemd supplies execution settings for filesystem views, namespaces, privileges, and other resources. They are separate controls with separate limits. Adding four familiar directives does not make every readable file, reachable process, inherited descriptor, or allowed system call disappear.
...
A TLS certificate expiry is a date you can read
A certificate’s expiry is a deadline for certificate validation, not a timer that necessarily closes every existing connection. Read the certificate actually served to the intended hostname, then distinguish its validity window from the rest of the trust decision. A future notAfter date alone does not establish that HTTPS is healthy.
...
