Hardening & Secrets
SSH, firewalls, secrets and locking down a server without locking yourself out.
11 articles
Nginx Reverse Proxy, TLS and Rate Limiting: The Config You Should Actually Be Running
A one-line proxy_pass is not a reverse proxy. Real timeouts, correct forwarded headers, a Mozilla-grade TLS block and limit_req zones that stop credential stuffing without breaking your own app.
Stop Committing Keys: A Secrets Workflow for Two-Person Teams Using SOPS and age
You do not need Vault. You need encrypted secrets in git, one age key per human, and a pre-commit hook that refuses the mistake. Full setup, offboarding in two commands, and when to actually upgrade.
Surviving a Bot Flood on a $20 VPS: nginx limit_req, fail2ban and Cloudflare Free in the Right Order
Diagnose before you block. A cost-ordered defence for small servers: Cloudflare's single free rate limit rule, nginx limit_req zones that do not break real browsers, fail2ban jails, and stale-while-updating caching.
Kubernetes Has No Cross-Namespace Secrets: Why Manual Copies Always Drift
A Pod cannot reference a Secret in another namespace and Kubernetes will not sync copies for you. Here is why, and the three mechanisms that actually hold up.
"Too Many Certificates Already Issued": Fixing Let's Encrypt Rate Limits
The duplicate certificate limit is 5 per exact name set per week and global across all accounts, so switching clients cannot help. Here is what actually works.
Your DDNS subdomain keeps hitting Let's Encrypt rate limits, and it is not a bug
If certificates fail on a shared DDNS suffix like duckdns.org, you are sharing one rate-limit bucket with every other customer. Here is why, and the only real fix.
Your fail2ban Stopped Banning Anyone and Never Told You
fail2ban fails silently: a dead filter looks exactly like a quiet internet. Here is the post-upgrade check that proves your jails still work, and how to alert on zero bans.
The GitHub Actions Pwn Request: How Fork PRs Steal Your Secrets
pull_request_target plus a fork checkout hands your CI secrets to any attacker. Here is the mechanism, the tj-actions lesson, and the two-workflow fix.
IP Rate Limiting Won't Stop Credential Stuffing: What Actually Does
Distributed credential stuffing rotates thousands of IPs, each trying once, sliding under every per-IP limit. Here is the per-account, breached-password and MFA stack that stops it.
Stop Using chmod 777: What to Do Instead When You Get Permission Denied
chmod 777 makes a file world-writable and turns an uploads folder into a remote code execution path. Here is how to actually diagnose Permission denied and fix it with chown and 755/644.
Kubernetes Secrets Are base64, Not Encrypted: What Actually Protects Them
A Kubernetes Secret is base64-encoded plaintext, not a vault. Here is what actually protects it: encryption at rest, tight RBAC, and an external secrets manager.