A postmortem should leave a fact record
A postmortem is a chronological map from detected symptom to verified fix, backed by the commands that produced each fact.
Operations
Harden a systemd service by testing its boundaries
Service hardening should turn a specific unwanted operation into a denied operation while preserving the work the application must perform. systemd supplies execution settings for filesystem views, namespaces, privileges, and other resources. They are separate controls with separate limits. Adding four familiar directives does not make every readable file, reachable process, inherited descriptor, or allowed system call disappear. ...
A TLS certificate expiry is a date you can read
A certificate’s expiry is a deadline for certificate validation, not a timer that necessarily closes every existing connection. Read the certificate actually served to the intended hostname, then distinguish its validity window from the rest of the trust decision. A future notAfter date alone does not establish that HTTPS is healthy. ...
DNS changes need a cache-aware rollback window
Prepare the TTL ahead of time, observe authoritative and recursive answers, and keep both endpoints valid through the cache window.
Lower DNS TTL before a move and budget the rollback cache window
Lower the TTL early if you expect to move a hostname.
Why a small site can stay static
A static origin is a boundary you can name, cache, and roll back.
Backups are only useful after a restore rehearsal
Choose a small recovery unit, verify it, and practice restoring it somewhere disposable.