Why the 3-2-1 backup rule fails when ransomware and compromised root credentials are the threat: immutable and offline copies, quarterly restore drills, recovery key management, and backing up the configuration that defines your stack. A hands-on sysadmin guide.
After 90 days with self-hosted Immich, the remaining question was what else exists: Ente Photos, the end-to-end encrypted Google Photos alternative that is both a polished cloud service and a fully self-hostable server. A hands-on comparison of Immich, Ente cloud, and Ente self-hosted, with costs, family plans, referral terms, migration, and an honest decision rule.
Dependabot is built into GitHub and zero-config; Renovate is the configurable bot that runs on Gitea, Forgejo, GitLab, and GitHub alike. A hands-on sysadmin comparison: real config for both, the best use cases for each, and the Renovate difficulties that only show up after the onboarding pull request.
Durable execution is the difference between automation that mostly works and workflows you can trust with money, mail, and user data. A practical architect guide to what durable workflows are, the use cases that need them, and an honest comparison of Temporal, Hatchet, Conductor OSS, Apache Airflow, and BullMQ, including the self-hosting footprint of each.
mTLS authenticates both sides of an internal connection, which closes a real hole on a LAN full of devices, and it does not fix application bugs, stop a compromised service, or survive root on the host. A hands-on look at the threat model, client certificates with Caddy and Nginx, service mesh identity, and the mobile apps that cannot present a certificate.
A sysadmin-grade walkthrough of what actually happens on the wire with passkeys and WebAuthn: the registration and authentication ceremonies, discoverable credentials, what sync really costs you, hardware keys, phishing resistance and its limits, recovery planning, FIDO2 SSH keys, and the honest list of where passkeys do not apply.
When Cloudflare fronts your origin, CrowdSec only sees what your reverse proxy writes into the log: edge IPs unless trusted proxies are configured. A hands-on guide to CF-Connecting-IP, X-Forwarded-For spoofing, firewall-level versus app-level blocking, and the CrowdSec Cloudflare bouncer that moves the block to the edge.