self-hosting Why I run my VPS from a chat topic on my phone instead of SSH How a question about logging expenses from my phone became a ChatOps listener on a private ntfy server: rebuilt four times in a day, then broken in four instructive ways once it met the real server.
docker Why the Infra Repo Should Never Contain Your Data nextcloud/, nextcloud_data/, db/, and redis/ are bind-mounted directories that live entirely on vmi2633427, are gitignored on purpose, and are explicitly not backed up by the repo that describes the stack running on top of them.
git A Deploy Key That Can Only Pull root on vmi2633427 has no GitHub identity of its own, and the deploy only ever needs to pull — so the key it authenticates with is generated, scoped, and verified to be read-only before it ever touches the server.
security What Key Rotation Actually Stops (and What It Doesn't) Rotating an age key re-encrypts secrets/db.enc.env to a new recipient list going forward. It does nothing to the plaintext an old key already read, and nothing to the ciphertext still sitting in earlier git commits.
sops Keeping Secrets in a Private Git Repo Without Actually Leaking Them secrets/db.enc.env is committed to a private GitHub repo, key names visible, values encrypted — and two independent age keys, one per machine, mean neither one alone has to be shared with the other.
docker Three Docker Networks, Fixed Subnets, One Reason: Firewall Rules That Don't Move frontend, socket, and backend are declared with fixed CIDR blocks on vmi2633427 for a reason that has nothing to do with routing and everything to do with what a firewall rule can trust.
docker Don't Give Your Reverse Proxy Root on the Host Traefik needs to know which containers exist and what labels they carry — it does not need exec, write, or image management. tecnativa/docker-socket-proxy is the difference between those two things.
traefik The TLS Handshake Nobody at Home Sees: Full vs Full-Strict Behind Cloudflare Traefik on vmi2633427 issues no certificates and holds no ACME credentials — the browser's cert and the origin's cert are two entirely different documents, and closing the gap between them is one flag in Cloudflare's dashboard.
