Tag: security

cert-manager makes Let's Encrypt automatic on Kubernetes, once. Then you scale, hit DNS-01 quirks, wildcard limits, and rate-limit walls. Here's the full survival guide.

Zeek (formerly Bro) turns network traffic into structured logs you can actually query. The IDS that doesn't shout, it documents. Setup and use in a home lab.

ModSecurity 3 is end-of-life and Coraza is the open-source successor, Go-native, faster, and friendlier. Here's the migration story and what actually changes.

Stop the .env-in-1Password dance. SOPS encrypts secrets per-key, age provides modern crypto, and git stores them safely. Here's how to ship it without the traps.

Passkeys finally killed passwords for real users. Here's what WebAuthn actually is under the hood, and how to roll passkeys out on your self-hosted services.

Native ZFS dataset encryption vs LUKS under your pool, which layer to encrypt at, performance trade-offs, key management, and raw send/recv.

OpenConnect replaces the bloated AnyConnect client on Linux. Run ocserv for a self-hosted Cisco-compatible VPN server, no 200MB installer required.

Zero-trust access for SSH, k8s, and databases, HashiCorp Boundary vs Teleport compared on identity, session recording, and self-host fit.

TLS tunneling for legacy plaintext services, stunnel's X.509 cert model vs spiped's pre-shared key simplicity, and when each one actually wins.

Containers are not VMs. Here are the real escape vectors, privileged mode, mounted sockets, kernel CVEs, and the runtime hardening that actually helps.

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

age replaces GPG for file encryption with a sane CLI, SSH key reuse, and zero key management drama. Here's how they compare and exactly when each one wins.