Category
Infrastructure
Securing your own servers: kernel and PHP CVE patching, Vault secret rotation, Trivy and Snyk CI gates, Prometheus and Loki alerting, and leaving AWS.
8 entries
Hybrid Cloud for Regulated Workloads: Not All On-Prem
Hybrid cloud for regulated workloads, from client engagements in health, pharma and education: most services moved on-prem, while model training and some backups stayed in the cloud.
PHP2Shell in Docker: Two PHP Runtimes Nobody Listed
PHP2Shell is fixed in the PHP runtime, so a Docker image needs a newer PHP such as 8.3.36, not an app update. I found PHP inside mailcow and an LMS on my host, and patched both.
Prometheus, Grafana and Loki: What to Alert On First
What a small team should alert on first with Prometheus, Grafana and Loki: page-or-ticket alerts and a heartbeat, timed in a lab where one log alert failed silently.
Linux Kernel CVE Patching: Installed Is Not Patched
Linux kernel CVE patching splits at the hypervisor. A VPS provider patches the host kernel, sometimes with a restart; you patch and reboot every kernel you run yourself, as CVE-2026-99999 showed.
Vault Secret Rotation Fails in the Application, Not Vault
HashiCorp Vault secret rotation causes application downtime when a worker reads its credential once. Static roles do not overlap, and three fixes have measured costs in a Vault 2.1.2 sandbox.
Trivy and Snyk Gates in GitLab CI: What Should Block?
A Trivy and Snyk security gate in a GitLab CI pipeline earns its place by blocking the right merge: fixable critical and high findings stop, the rest report, and every ignore expires.
AWS to Self-Hosted Migration Cost Starts With Paperwork
An AWS to self-hosted migration for sensitive data moves stateless services first and databases last, after procurement and KYC. The real cost is the operations you take back in house.
Self-Hosting Next.js and Payload on One VPS: What Broke
How one VPS runs Next.js and Payload behind Cloudflare and nginx: the request path, why the build needs a self-hosted runner, migrations on deploy, scheduled publishing, and what is not covered.