SumGuy's Ramblings
The art of wasting time.
Docker, self-hosting, AI/LLM, Linux, and DevOps — explained by someone who learned the hard way. No fluff, no enterprise jargon, just practical stuff that actually works on real hardware.
Recent Posts
-
systemd Path Units: React to New Files
Run a job the moment a file lands. A systemd .path unit plus a oneshot service, tested triggers, the retrigger loop that kills it, and when inotifywait wins.
13 min read -
inotifywait: Scripts That React to Files
Use inotifywait to run shell scripts when files change, and entr to rerun a command on save. Tested gotchas: half-written files, rename saves, watch limits.
15 min read -
Langfuse vs Phoenix: Self-Host LLM Tracing
Langfuse v4 runs six containers and idles near 1.1 GiB of RAM. Phoenix v21 runs two and idles near 0.5 GiB. Here is what each traces and what each costs you.
12 min read -
Your Admin Panel Has a Side Door
Admin blocks on nginx, Caddy, and Traefik let 2 or 3 of 13 spellings through. A forged Remote-User fooled all three. Caddy's open admin port took a new config.
17 min read -
Postgres in Docker: The shm_size Gotcha
Docker gives Postgres a 64MB /dev/shm. A big parallel query then dies with 'could not resize shared memory segment'. Here is the fix and the trap behind it.
7 min read -
systemd DynamicUser: No useradd Needed
systemd DynamicUser=yes plus StateDirectory= gives a daemon a throwaway UID and a private data folder. No useradd, no dead accounts. Here are the four traps.
15 min read -
Rate Limits That Lock Out the Wrong User
Guide-style rate limits behind a CDN locked out a bystander on nginx, Caddy, and Traefik. Trusting X-Forwarded-For let a forger through 20 of 20. Fixes tested.
17 min read -
polkit Rules: Restart a Service, No sudo
Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.
13 min read -
yq: Editing YAML From the Command Line
Install the Go yq, not the Python one. Bump compose tags, patch Kubernetes manifests, merge configs and edit front matter from the shell, plus the gotchas.
13 min read -
Security Headers That Break Your Apps
Seven copy-paste security headers gave nginx static files none, let Traefik overwrite an app's own CSP, and blocked self-framing. Tested configs for all three.
17 min read -
Postgres Autovacuum Tuning for Small DBs
Leave most autovacuum globals alone, raise the cost limit, and give your one hot table a per-table scale_factor. Tested on postgres:18.6 with real numbers.
13 min read -
Home Assistant Blueprints: Write Once
Stop copy-pasting the same motion-light automation nine times. Import, write, and update Home Assistant automation and script blueprints with annotated YAML.
13 min read
