Two name servers, one zone, and a TSIG key to glue them together. That is the smallest authoritative…
Two laptops, three home-lab servers, and a VPS in Frankfurt. Old me wired that together with WireGuard, an…
Stand up a forward proxy on your LAN and you get a single chokepoint for outbound HTTP and…
A static IP on a Linux server should take five minutes to set. On Ubuntu 26.04 LTS, Netplan…
PF is one of the reasons people stay on FreeBSD once they try it. It’s a stateful packet…
BIND 9 remains the de facto DNS server for the internet, ISC’s reference implementation, now in its 9.18…
HAProxy is the Swiss army knife of load balancers. Nothing else gives you the same combination of HTTP-level…
WireGuard on FreeBSD 15 is in-kernel. No ports module, no kmod dance. pkg install wireguard-tools, configure two files,…
The default advice for new HTTPS services on GCP is “use a Global External ALB.” It’s usually right.…
Per-service ManagedCertificate attached to a per-service target HTTPS proxy is why you have 120 forwarding rules across 4…
A single wildcard cert covering every service on a shared LB is what turns cert sprawl from a…
Cert sprawl starts with DNS. If the zone you issue certs against isn’t locked down first, every cert…
