I Switched to Jellyfin and Never Looked Back: When Plex Hit $250
After Plex Pass's pricing policy change, I detail my experience switching to Jellyfin, from setup to performance, security to user experience…
55 posts found.
After Plex Pass's pricing policy change, I detail my experience switching to Jellyfin, from setup to performance, security to user experience…
I've shared my experiences on how to harden a new VPS with essential security steps in the first 45 minutes. SSH, firewall, and user management.
A step-by-step guide on how to start a homelab from scratch in 2026 by setting up a low-power (6W) home server with an Intel N100 processor mini PC.
I detailed my transition from Google Photos to Immich, the challenges I faced, and the specifics of photo management on my own server, step by step.
Learn how to respond quickly and effectively to critical CVEs in the kernel with a practical 3-step approach.
I analyze 3 steps infrastructure managers should prioritize when responding to critical kernel CVEs, based on field experience.
As a system architect for 20 years, I'm sharing the Linux commands that have saved me the most time, helped me solve the deepest problems, and are always at my.
I explain how I set up CI/CD processes in my side projects using pragmatic approaches and the challenges I encountered during these processes.
I examine three critical challenges in the Linux kernel CVE patching process, with concrete examples and practical solutions.
We examine why delaying responses to kernel security vulnerabilities can be costly with concrete examples. Read to understand the price of procrastination.
I explain step-by-step a security vulnerability encountered during a client project and how I patched it on my own VPS. Lessons from field experience.
I detail the process that began with my VPS's swap usage suddenly spiking and the system crashing, including the kernel CVE patch and the steps I took to.
A detailed look at the Out-of-Memory (OOM) Killer incidents I experienced on my VPS, the intricacies of system memory management, and the silent deaths caused.
A practical guide to swap issues encountered when using Docker on small VPS instances and kernel patch solutions. Detailed analysis with my experiences.
A pragmatic analysis of swap memory issues and their solutions encountered while experimenting with Kubernetes on a small VPS.
A step-by-step guide on how I moved my GitHub Actions runner to my own VPS and reduced costs, while meeting my specific needs.
I'm sharing a step-by-step guide on how I identified resource consumption issues on my own VPS and applied limits to Docker containers.
I deeply investigated Docker disk space issues on a small VPS, from image layers to logs, and shared practical solutions.
Swap usage on my VPS suddenly spiked. I detail the root cause, solution, and lessons learned from this issue that began with a kernel CVE patch.
Want to understand the hidden swap trap on Linux systems and learn memory management strategies for high-performance systems? Detailed…
A field guide to understanding, preventing, and recovering from kernel panics in production. How to keep your systems stable.
Making privileged access visible on the bastion: tlog/sudo I/O logging, the access model and a SIEM pipeline.
Collecting core dumps in production: limits, retention, encryption, access and a practical runbook for safe analysis during an incident.
A practical setup and runbook for shipping journald logs over mTLS to a central collector — without adding agents — while running a disciplined disk budget…
Walks through kdump installation, validation and a sustainable production dump retention flow so you can capture vmcore and triage quickly when a kernel panics.
Quick triage, measurement and safe tuning steps (ring, queue, IRQ, RPS) under packet drops, high softirq load and ksoftirqd pressure.
A golden image approach that hardens and tests the server image at build-time, accelerating patch, drift and emergency CVE workflows.
A runbook for shrinking deploy impact by separating connection acceptance into a socket unit, so the listening port never drops during service restarts.
Reduce 'stuck but not dead' failures with systemd WatchdogSec + notify: unit configuration, restart policy, and alarm integration.
Practical tcpdump techniques for collecting minimal-yet-sufficient packet evidence during incidents: filters, snaplen, ring buffer, privacy, and handover…
Managing kernel security patches without reboot pressure: a live-patch approach, the risks, a ring strategy, and operational discipline.
A practical chrony runbook for enterprise servers covering secure NTP (NTS), access restrictions, verification commands, and alarm thresholds.
Turn 'what's on which server?' into a living inventory; a guide for scaling osquery queries with FleetDM into operational and security signal.
Reduce risk while moving production firewall rule sets from iptables to nftables using observability, wave-based rollout, and fast rollback.
Hardening admin access with OpenSSH security keys (ed25519-sk) using PIN + touch confirmation, while keeping break-glass scenarios intact.
An OpenSSH CA-based approach to set up auditable, time-bound SSH access in place of shared bastion accounts and long-lived keys.
Constrain services into a tighter permission set without changing the application itself: filesystem, capability, syscall, and network limits.
A practical approach that makes privileged operations observable and auditable in production using sudo, auditd rules, and log forwarding.
A practical guide for generating signals before the nf_conntrack table fills up, applying safe sysctl tuning, and recovering in a controlled way during an…
A runbook to triage the connect timeout crisis when the SYN backlog/accept queue fills up, apply rapid mitigation, and design lasting resilience.
PSI, systemd-oomd policy, testing, and recovery steps to catch a node OOM crisis early and evict workloads in a controlled way.
A practical way to manage server services with systemd and Podman Quadlet, free from the Docker daemon dependency.
An AppArmor guide for securing server services through process-level constraints rather than generic hardening.
A guide describing how to set up an nftables-based egress policy layer to control which destinations servers can reach in the outside world.
An rsyslog and RELP-based setup that keeps critical logs intact through TCP drops as they ship to a central system.
Set up a policy-based routing layout on Linux servers with Netplan that separates primary and secondary uplinks based on source network.
A low-friction profiling approach with Suricata to make service-to-service traffic visible inside the data center.
A Chrony-based guide to making clock drift visible across distributed Linux servers and reducing operational risk.
An approach to monitoring network flows at the kernel level and correlating them with service latency and error budget signals.
A Keepalived-based VRRP failover approach for reducing single-VIP dependency in internal management services.
A guide to Ansible-based drift auditing for measuring and reporting deviations from the expected state on Linux servers.
A guide to making your Linux server security baseline repeatable and auditable with Ansible.
A Falco-based setup guide for surfacing suspicious runtime behavior across Linux and Kubernetes environments.
A guide for tracking flows, latency, and connection behavior on Linux servers with eBPF without drowning in packet capture.
An approach for moving server configuration out of manual labour and into a safe, repeatable automation flow.