I Audited the OpenVPN Server I Wrote a Guide For
Two years after publishing a guide to restricting OpenVPN clients to specific IPs, I audited the server it built, and most of the findings trace back to the guide.
Tag: devops
Tightening a dev VM that was quietly living without a firewall
What a routine security audit found on a small always-on dev VM: passwordless databases, no host firewall, over-privileged jobs, and how it got fixed.
When an Always Free server gets smaller
What Oracle's smaller Ampere A1 Always Free limits mean for a self-hosted ARM server, and how I redesigned mine around a 12 GB, 2-core budget.
Rebuilding a Small k3s Host Without Making It Precious
Notes from wiping an old single-node k3s setup and rebuilding it with a smaller, cleaner baseline for ingress, certificates, and persistent storage.
Voice Control for Hermes Agent over Telegram
How I wired Hermes Agent to accept Telegram voice notes, transcribe them locally, and reply with local text-to-speech without adding another paid speech API.
The Hard Part of AI PR Review Is Not Reading the Diff
A practical look at Alibaba OpenCodeReview, why diff-only AI review is not enough, and how to use AI reviewers without trusting them too much.
Tightening Hermes Agent Security for Local Sensitive Work
How I tightened my Hermes agent setup after adding a local model for PII and credential-sensitive work: tool limits, manual approvals, and a quiet watchdog.
Securing Hermes Agent with OpenShell
Why I run Hermes Agent inside OpenShell when it reads untrusted content, and how filesystem, network, process, and credential policy change the security model.
Zombie PostgreSQL replicas: the WAL segment removed deadlock
PostgreSQL replicas on Kubernetes can get stuck in a WAL segment removed loop that passes liveness checks, and three fixes stop it for good.
Production Ruby Debugging: A Progressive Escalation Guide
A progressive escalation guide to debugging Ruby applications in Kubernetes production without restarting: rbspy, kubectl debug, signals, rbtrace, and gdb.
Incus vs. Docker: System Containers vs. App Containers
A practical comparison of Incus and Docker: when system containers suit development environments better than single-process application containers.
Redis High Availability: Shared Sessions and Fault Tolerance
How to split Redis into isolated session, cache, and Sidekiq instances so a cache blip never logs users out or stops background jobs.
Identity-Aware GCS Access Instead of Hashed Secret URLs
Replacing hashed 'secret' URLs in Google Cloud Storage with IAM Conditions and domain-restricted access that verifies identity instead of hiding a path.
Faster Rails Docker Feedback Loop: Runtime Deps and HMR
How I reduced Docker development friction across three Rails apps by removing rebuild-heavy steps, adding runtime dependency sync, and enabling webpack HMR.
Redis Cleanup and Memory Management in Kubernetes
A production-tested guide to keeping Redis healthy in Kubernetes: memory control, safe cleanup patterns, Sidekiq pitfalls, backups, and troubleshooting.
Sending Email from an Ubuntu VM on Oracle Cloud (OCI)
A Postfix and OCI Email Delivery setup guide covering SMTP auth, sender approval, SPF/DKIM/DMARC, and the errors that block delivery.
Choosing a Website Stack for a 1C1G Server
A comparison of static sites, WordPress, headless CMS, and Node.js CMS options for a 1 vCPU, 1GB RAM server, by memory use and stability.
Optimizing a 1C1G Ubuntu Cloud Server
A production-tested checklist for making a 1 vCPU, 1GB RAM Ubuntu server stable: swap, kernel tuning, service removal, and MySQL/PHP-FPM limits.
Zero-Downtime GKE Upgrades with PostgreSQL in the Cluster
A blue/green node pool runbook for upgrading GKE clusters with PostgreSQL running as a StatefulSet, without a maintenance window.
Zero-downtime GKE upgrades with PostgreSQL failover
Blue/green node pools plus a Kubegres replica promotion let you upgrade a GKE cluster, PostgreSQL included, without a maintenance window.
PostgreSQL MD5 to SCRAM-SHA-256: a zero-downtime migration
PostgreSQL 18 deprecates MD5 authentication, and migrating to SCRAM-SHA-256 in mixed mode lets you switch pg_hba.conf without downtime or forced app changes.
From 499 to 200: Fixing Nginx Timeouts in a Rails API
How Puma worker timeouts and Nginx 499 errors expose slow Rails requests, and how to fix them with aligned timeouts, background jobs, and caching.
Securing AWS Credentials: aws-vault vs 1Password
Storing long-lived AWS access keys in ~/.aws/credentials is a common anti-pattern; aws-vault and the 1Password AWS Shell Plugin both fix it with short-lived STS tokens.
Optimizing Android Builds in GitHub Actions
Android builds in GitHub Actions run 10-30 minutes unoptimized; layered Gradle and Yarn caching plus scoped environment secrets get that down to a few minutes.
PostgreSQL 18: What's New and How to Upgrade
PostgreSQL 18 adds better query parallelism, parallel logical replication apply, and more flexible partitioning, plus the pg_upgrade and dump/restore paths to get there.
Migrating a GCP Classic Load Balancer to Global External
GCP lets you migrate a Classic Application Load Balancer to the Global External Load Balancer with a staged, four-state rollout that avoids downtime.
Enabling Local HTTPS for Development and Debugging
Local HTTPS matters because browser APIs like Service Workers require a secure context, and this covers Caddy, Nginx with mkcert, Puma-dev, and Cert-Manager.
Redis Sentinel Split-Brain: Fixing It on Kubernetes
How Redis Sentinel split-brain happens during Kubernetes node maintenance, and the sentinel tuning, anti-affinity, and PDB changes that stopped it.
Build and Push Docker Images to Quay.io with GitHub Actions
A working GitHub Actions workflow that builds a Docker image and pushes it to Quay.io using a scoped robot account and repository secrets.
Why npm ci Runs prepare Scripts for Git Dependencies
npm ci is not the script-free install it looks like; it still runs prepare scripts for Git-based dependencies, which broke Husky in CI.
Catching Database Configuration Drift Between Microservices
Two services sharing a database can pass every test and still fail in production if their DB configuration silently drifts apart.
Kubernetes Node Upgrades: Cordon, Drain, and Failover
A cordon-drain-upgrade runbook for Kubernetes nodes, plus the PodDisruptionBudgets, priority classes, and lifecycle hooks that prevent outages.
When AWS Lambda Makes Sense for a Single API Endpoint
A decision framework for when AWS Lambda fits a single API endpoint, and when a container or dedicated server is the better call instead.
Upgrading Bitnami Redis Helm Charts Without Downtime
A runbook for upgrading Bitnami's Redis Helm chart in Kubernetes, covering node migration, debug dry runs, and a tested rollback plan.
ARG, ENV, and BuildKit secrets: how each behaves in Docker
ARG, ENV, exported shell variables, and BuildKit secret mounts each persist differently in a Docker image, and only one of them is actually safe for tokens.
Linux kill signals: graceful shutdown in containerized workers
SIGTERM, SIGKILL, and grace periods control whether a containerized worker finishes its job before Kubernetes or Supervisord kills it outright.
Retry mechanisms for flaky CI and Docker builds
Wrapping curl, bundle install, and Docker builds in retry logic turns transient network failures in CI into automatic retries instead of full pipeline restarts.
jq and yq: transforming embedded key-value strings in YAML
jq and yq combine to turn a YAML file's embedded key=value strings into properly structured, typed fields, using a single scan and from_entries pipeline.
Kubectl aliases and functions that actually save time
A set of kubectl aliases and shell functions for pod access, JSONPath queries, and log searching that cut real typing out of day-to-day Kubernetes work.
Docker secrets: how layers leak them and how BuildKit fixes it
Docker's layer history persists secrets baked into ARG and ENV instructions, and BuildKit secret mounts are the practical fix that keeps them out of the image.
Docker Buildx --on-error: drop into a shell when a build fails
The --on-error flag in Docker Buildx drops you into a shell inside the failing build step so you can inspect state instead of guessing from logs.
How to Debug Docker Image Builds
Practical techniques for debugging Docker image builds: BuildKit output flags, inspecting intermediate layers, nsenter tricks, and multi-stage build targets.
Leapp vs aws-vault: Comparing AWS CLI Credential Tools
A practical comparison of Leapp and aws-vault for managing AWS CLI credentials, covering SSO and IAM setup, session tokens, and when each tool fits better.
Running Multiple Processes in a Single Container
Six ways to run multiple processes in one Docker container, from GNU Parallel and Foreman to a custom entrypoint script, Supervisord, and tmux, with trade-offs.
k3s on Ubuntu: Install, kubectl Access, and Unauthorized Errors
How to install k3s on Ubuntu, connect with kubectl, and fix the 'You must be logged in to the server (Unauthorized)' error caused by kubeconfig or expired certs.
Supervisord: Process Management for Containers and VMs
How supervisord monitors and restarts UNIX processes through simple INI-style config, with a working example for MySQL, PHP, and an init script.
Rails in Kubernetes: Migrations, Jobs, and Puma
Running a Ruby on Rails app in Kubernetes means containerizing it correctly and handling migrations, background jobs, and Puma as separate concerns.
Materialized Views: Speeding Up Queries with a Tradeoff
Materialized views cache expensive PostgreSQL queries as physical tables, trading storage and refresh cost for fast reads, plus how pgpool fits in.
GitHub Actions Variables: env, Contexts, Secrets, and Matrix
How GitHub Actions variables work in practice: env blocks, context variables, secrets, matrix strategies, and passing step outputs between steps.
PostgreSQL Sequence Conflicts After an Upgrade: How to Fix Them
Upgrading PostgreSQL can leave sequences out of sync with table max values, causing duplicate-key errors and blocked sign-ins, fixed here with SQL and bash.
Zero-Downtime PostgreSQL Upgrades With Logical Replication
A bash script that sets up PostgreSQL logical replication, publications, and subscriptions to perform a major-version upgrade without downtime.
Redis Sentinel: How Automatic Failover Actually Works
How Redis Sentinel provides high availability: quorum-based monitoring, master election, automatic failover, and what your client applications must do to follow along.
Production Debugging Techniques for Rails Apps
Practical production debugging techniques for Rails: log analysis, replicating production data, rbtrace live injection, feature-flagged debug modes, and replica apps.
Rails Secrets: Credentials, 1Password, and Cloud Vaults
A rundown of Rails credentials, environment variables, 1Password CLI, and cloud secret managers like AWS Secrets Manager and Vault, and when to use each.
Config Approaches: Files, Env Vars, and Config Servers
A comparison of YAML config files, Rails encrypted credentials, environment variables, and centralized config servers, with the trade-offs of each approach.
Postgres 'Too Many Connections': Debugging Pgpool-II Limits
Debugging a Postgres 'too many connections' error through Pgpool-II's num_init_children and max_pool settings, and the fix that stopped clients queueing.
Scaling PostgreSQL on Kubernetes with Kubegres
How Kubegres brings primary/standby failover, automatic backups, and PITR to a self-hosted PostgreSQL cluster on Kubernetes without a managed database bill.
GCP 502 Errors from GKE Readiness Probe Failures
A GKE 502 with 'failed_to_pick_backend' traced back to readiness probes failing on every pod at once, and the liveness probe and anti-affinity fixes that resolved it.
Pgpool-II: Middleware for PostgreSQL
Pgpool-II sits between PostgreSQL and its clients as a connection pooler and load balancer, and this covers the Kubernetes setup that keeps writes consistent.
Defending Against DoS Attacks
How to defend against DoS and DDoS attacks with request throttling, input validation, firewall rules, load balancers, and cloud-based mitigation.
rsync：系统管理员的备份利器
系统管理员的日常工作重点在于维护系统稳定运行并提供服务，其中数据备份尤为关键。尽管许多管理员对服务器安全性关注不足，但对备份技术却兴趣浓厚。鉴于商业产品成本高昂，自由软件如rsync成为理想选择。本文将详细介绍rsync的特性、使用方法及实用脚本。