Hardening a Public-Facing Service Beyond the Basics
You have closed the ports and set up key-only SSH. This is the next layer: making the service itself unable to do damage if it is compromised, using directives you…
Getting a Domain and Its DNS Right
Buying the domain is the easy part. Where the nameservers point, which records exist, and what your TTL is on the day you move — those are what decide whether…
Centralising Logs When One Server Is No Longer Enough
Three machines means three journals and no way to follow a request across them. Here is a small, honest setup using Loki and Alloy — and a note about Promtail,…
Sending Email From Your Server (And Why You Probably Should Not Run a Mail Server)
Your application needs to send password resets. That is a solved problem and takes an afternoon. Receiving mail on your own box is a different job entirely, and this is…
Moving an Existing Service Into a Container
Taking something installed with apt and running it in a container instead, without discovering three weeks later that it was writing somewhere you forgot. The inventory, the parallel run, and…
A Home File and Media Server
Storage that other machines can reach, permissions that survive more than one user, Samba and NFS side by side, and media streaming — plus the sentence about RAID that people…
A WireGuard VPN, Set Up Properly
Reaching your own machines from anywhere, in about forty minutes. Key generation, the one setting everybody misunderstands, split versus full tunnel, and how to diagnose a handshake that never happens.
A Staging Environment on One Server
A second copy of your application on the same machine, with its own database and no way to email your customers. What must be separated, how to refresh it safely,…
Disk Encryption on a Linux Laptop, Done Properly
LUKS protects a laptop that is switched off and stolen — and nothing else. Setting it up, backing up the header that everything depends on, and the honest trade in…
Self-Hosting Your First Application, End to End
Taking one application from a compose file to a working service on your own server: bound to localhost, behind TLS, backed up, and alerting you when it stops. About two…