Docker secrets are a delivery mechanism, not a vault. On a single server they do not encrypt anything. A hands-on comparison of .env, Docker secrets, systemd credentials, SOPS + age, Vault, and Kubernetes Secrets, with the commands and the honest decision rule for each.
A hands-on sysadmin comparison of Caddy, Traefik, and Nginx Proxy Manager for self-hosting: how each one models configuration, how automatic TLS works in practice, Docker discovery through labels and plugins, the security boundaries including the docker.sock question, the debugging commands that matter, and the honest answer to when GUI convenience stops scaling.
A practical, sysadmin-grade comparison of Proxmox VE and IncusOS: the argument that matters (you own Proxmox's mutable Debian base, IncusOS owns itself), atomic A/B updates, Secure Boot and TPM, storage and networking, real commands for both, the honest limits of the young IncusOS, and when each earns its keep.
A hands-on sysadmin guide to bootstrapping Kubernetes with OpenTofu and Argo CD: what the open-source Terraform fork actually is, why IaC owns day zero and GitOps owns everything after, the exact provider and Helm configuration to install Argo CD, the app-of-apps handoff, and the honest limits of the pattern.
A hands-on sysadmin guide to Naxsi, the Nginx Anti XSS and SQL Injection WAF module: how the scoring, deny-by-default model works, building and installing the maintained wargio fork on Debian, Ubuntu, and Fedora, learning mode and nxtool whitelists, what WordPress, Joomla, and Magento need to avoid false positives, the honest limits, and when ModSecurity is the better call.
A sysadmin's field guide to VPNs: what a VPN actually does to your traffic, the threat models it does and does not answer, how no-logs claims and audits really work, which providers pass the test, and a deep technical comparison of OpenVPN, WireGuard, and the proprietary protocols (NordLynx, Lightway, Catapult Hydra, Chameleon), plus a hands-on self-hosted WireGuard setup.
A hands-on sysadmin guide to AIDE for file integrity baselines and inotify-tools for real-time filesystem event monitoring: what each tool actually does, install and configuration on Debian, Ubuntu, and RHEL, scheduling the daily check, inotifywait and inotifywatch recipes, the limits that bite, and how the two complement each other.