Static sites on Cloudflare Workers static assets
Serving a static Astro build from Cloudflare Workers: trailing slashes, custom 404s, caching, and the one-command deploy loop — this site's exact setup.
Engineering Notes
Engineering Notes
The working notebook: short, specific write-ups of problems solved in the lab and in production — the config that fixed it, the gotcha that cost an afternoon, the procedure worth repeating. Less polish than an article, more signal per minute.
Proxmox cluster quorum and QDevice setup
Why two-node Proxmox clusters lock up, how corosync counts votes, setting up a corosync QDevice tiebreaker, and the safe node-maintenance procedure.
Active Directory hardening: the first 10 moves
Ten AD hardening quick wins in priority order: admin tiering, Windows LAPS, killing NTLMv1 and SMBv1, krbtgt rotation, and audit policy that catches abuse.
Prometheus cardinality control: find it, kill it
Hunting high-cardinality Prometheus series with tsdb analyze and topk queries, then killing them with relabel drops, limits, and recording rules.
Wildcard certificates with Let's Encrypt DNS-01
Issuing Let's Encrypt wildcard certificates via DNS-01 with acme.sh and certbot: API-token scoping, propagation pitfalls, and renewal monitoring that works.
Diagnosing BGP session flaps systematically
A field checklist for BGP session flaps: reading reset reasons, hold-timer analysis, MTU blackholes, dampening, and TCP resets — Cisco and FRR commands.
Recovering VMware VMs after an ESXiArgs-class attack
Why ESXiArgs-style ransomware often leaves VM data intact, and the vmkfstools descriptor-rebuild procedure that brings encrypted VMs back without paying.
etcd backup and restore on kubeadm clusters
Working notes on etcd snapshot and restore for kubeadm Kubernetes clusters: exact commands, the data-dir and cluster-token gotchas, and verification steps.