SOPS plus age is the git-native way to keep secrets out of plaintext commits: age key setup, .sops.yaml creation rules, the daily encrypt and decrypt workflow, GitOps integration with Flux and Argo CD, key rotation, a recovery strategy that survives a lost laptop, and the honest limits of the pattern.
Docker secrets are a delivery mechanism, not a vault. On a single server they do not encrypt anything. A hands-on comparison of .env, Docker secrets, systemd credentials, SOPS + age, Vault, and Kubernetes Secrets, with the commands and the honest decision rule for each.
A hands-on sysadmin comparison of Caddy, Traefik, and Nginx Proxy Manager for self-hosting: how each one models configuration, how automatic TLS works in practice, Docker discovery through labels and plugins, the security boundaries including the docker.sock question, the debugging commands that matter, and the honest answer to when GUI convenience stops scaling.
A practical, sysadmin-grade comparison of Proxmox VE and IncusOS: the argument that matters (you own Proxmox's mutable Debian base, IncusOS owns itself), atomic A/B updates, Secure Boot and TPM, storage and networking, real commands for both, the honest limits of the young IncusOS, and when each earns its keep.
A hands-on sysadmin guide to bootstrapping Kubernetes with OpenTofu and Argo CD: what the open-source Terraform fork actually is, why IaC owns day zero and GitOps owns everything after, the exact provider and Helm configuration to install Argo CD, the app-of-apps handoff, and the honest limits of the pattern.
A hands-on sysadmin guide to Naxsi, the Nginx Anti XSS and SQL Injection WAF module: how the scoring, deny-by-default model works, building and installing the maintained wargio fork on Debian, Ubuntu, and Fedora, learning mode and nxtool whitelists, what WordPress, Joomla, and Magento need to avoid false positives, the honest limits, and when ModSecurity is the better call.
A sysadmin's field guide to VPNs: what a VPN actually does to your traffic, the threat models it does and does not answer, how no-logs claims and audits really work, which providers pass the test, and a deep technical comparison of OpenVPN, WireGuard, and the proprietary protocols (NordLynx, Lightway, Catapult Hydra, Chameleon), plus a hands-on self-hosted WireGuard setup.