Hardening a Public-Facing Service Beyond the Basics
You have closed the ports and set up key-only SSH. This is the next layer: making the service itself unable to do damage if it is compromised, using directives you…
Getting a Domain and Its DNS Right
Buying the domain is the easy part. Where the nameservers point, which records exist, and what your TTL is on the day you move — those are what decide whether…
Centralising Logs When One Server Is No Longer Enough
Three machines means three journals and no way to follow a request across them. Here is a small, honest setup using Loki and Alloy — and a note about Promtail,…
Manjaro, EndeavourOS and CachyOS: The Arch Derivatives Compared
They all give you Arch without the manual install, and then they differ on the one thing that matters most — whether you are getting packages from Arch's repositories or…
The BSDs: FreeBSD, OpenBSD and NetBSD, for Linux People
Not distributions of a kernel but complete operating systems, developed as a single thing, under a licence that lets anyone ship them without giving anything back. What that actually changes,…
Slackware: The Oldest One Still Standing
The last stable release was in February 2022, which sounds like abandonment and is not — the development branch was updated yesterday. Here is what Slackware actually is, and the…
Container Host Distributions: Fedora CoreOS, Flatcar and Talos
Server operating systems that exist only to run containers. No package manager to speak of, no SSH in one case, and updates that arrive as a whole new image —…
Syncthing: Your Own Files, on All Your Machines, With No Cloud
Continuous file sync between your own devices, encrypted in transit, with nobody's server holding a copy. Plus the Android situation, which changed in 2024 and trips up everyone arriving from…
Docker Compose: One File That Describes the Whole Thing
A compose file turns a long docker run command nobody can remember into something you can read, version and hand to someone else. Plus the version numbering that will confuse…
Caddy vs nginx: Certificates You Never Think About Again
Caddy gets you HTTPS in a two-line config file with no certbot, no cron job and no renewal to forget. That is a real saving, and there are still good…