-
One password in 13 places: inventory and rotation of home-lab secrets
An inventory found 62 plaintext credentials in my workload specs and one password reused 13 times. How I moved them into Secrets, built a pointer registry on Vaultwarden, and rotated with proof.
-
9,151 critical CVEs, mostly in images I wasn't running
My weekly Trivy report counted 9,151 criticals across 1,925 images; only 152 were running. How I scoped the scan, cleaned old tags safely, triaged by fixable, and patched a PHP RCE the same day.
-
On single-node Kubernetes, RollingUpdate can mount your database twice
With one replica, RollingUpdate starts the new pod before stopping the old, and on a single node both mount the same ReadWriteOnce volume. How I audited 123 Deployments, fixed 15 with zero downtime, and what really slowed Qdrant.
-
A self-hosted classroom with SSO-only login and token-locked Jitsi
Version 1 of my self-hosted classroom had two logins, a 'changeme' API key and Jitsi secrets in Git. Version 2 uses SSO headers only, roles from groups and per-room Jitsi tokens. The design and the traps.
-
How my Kubernetes dashboard locked me out of my own SSO
Headlamp's backend retried a dead OIDC refresh token every 5 seconds with no backoff, and Authelia's per-IP rate limiter then blocked my own login. The wrong theory, the upstream race, a Helm drift landmine and the watchdog that caps it.
-
Secrets in GitOps history: scan by key name, then rotate
My Kubernetes manifests repo had credentials from its first commit. Why value-shaped scans drown in noise and still miss passwords, how key-name scanning with triage found the real ones, and why rotation, not deletion or history rewrites, is the fix.
-
Prometheus WAL on a RAM disk: the trade-offs, and my empty tmpfs
My Prometheus config said the WAL lived on a RAM disk. The tmpfs held 0 bytes; the 785 MB WAL was on the SSD all along. Why, whether it was ever a good idea, and where RAM disks do help.
-
My first restore test reported 0 tables and 0 errors
I had checked 49 backup sets for months but never restored one. The first test restored nothing and reported success. How to test Postgres restores safely, and three ways backups and restores quietly lie.
-
A 20-second power cut, an 8-hour outage: LUKS on a home server
My server lost power at 00:31, came back by itself, then waited 8 h 25 min at a hidden LUKS passphrase prompt. How to prove it from systemd timestamps, triage the cold-boot alert storm, and choose an unattended unlock.
-
Running Gitea and CI inside the cluster they deploy
Lessons from a self-hosted Gitea in k3s: why git push hits the SSO login page, getting passwords out of 7 remote URLs, a Git server OOM-killed at 512 MiB and 2 GiB, and what act_runner needs before 365 tests pass in 82 seconds.
-
The one-second race that hid my nginx config change
A Kubernetes rollout started a new pod one second before its ConfigMap was updated, and a subPath mount kept the old nginx config forever. How kubectl apply order and subPath combine, and the checklist that prevents it.