Infrastructure notes & small self-hosted services
A quiet corner of the internet for short write-ups on systems, networking and the occasional weekend build. No tracking, no third-party assets, no cookies.
Networking
TLS termination, reverse proxies, and keeping the moving parts boring.
Self-hosting
Small services that fit on a single box and stay out of the way.
Operations
Backups, monitoring and the unglamorous parts that keep things up.
Recent notes
Terminating TLS in one place. Keeping a single entry point for certificates makes rotation predictable. A reverse proxy in front of the app, with renewal handled automatically, removes most of the sharp edges.
Static first. If a page does not need to compute anything, serve it as a file. It is faster, easier to cache and has a much smaller surface to secure.
Boring defaults. Default deny on inbound traffic, explicit allow rules, and services bound to the interfaces they actually need. Most incidents start with something that did not have to be reachable.
Stack
This site is served from a single static file behind an nginx instance:
client -> TLS (nginx) -> static index.htmlThere is no application server, no database and no external dependency at runtime. The page you are reading is the entire deployment.
Contact
Questions or corrections are welcome by email.
hello [at] this-domain