mTLS authenticates both sides of an internal connection, which closes a real hole on a LAN full of devices, and it does not fix application bugs, stop a compromised service, or survive root on the host. A hands-on look at the threat model, client certificates with Caddy and Nginx, service mesh identity, and the mobile apps that cannot present a certificate.
A sysadmin-grade walkthrough of what actually happens on the wire with passkeys and WebAuthn: the registration and authentication ceremonies, discoverable credentials, what sync really costs you, hardware keys, phishing resistance and its limits, recovery planning, FIDO2 SSH keys, and the honest list of where passkeys do not apply.
When Cloudflare fronts your origin, CrowdSec only sees what your reverse proxy writes into the log: edge IPs unless trusted proxies are configured. A hands-on guide to CF-Connecting-IP, X-Forwarded-For spoofing, firewall-level versus app-level blocking, and the CrowdSec Cloudflare bouncer that moves the block to the edge.
SOPS plus age is the git-native way to keep secrets out of plaintext commits: age key setup, .sops.yaml creation rules, the daily encrypt and decrypt workflow, GitOps integration with Flux and Argo CD, key rotation, a recovery strategy that survives a lost laptop, and the honest limits of the pattern.
Docker secrets are a delivery mechanism, not a vault. On a single server they do not encrypt anything. A hands-on comparison of .env, Docker secrets, systemd credentials, SOPS + age, Vault, and Kubernetes Secrets, with the commands and the honest decision rule for each.
A hands-on sysadmin comparison of Caddy, Traefik, and Nginx Proxy Manager for self-hosting: how each one models configuration, how automatic TLS works in practice, Docker discovery through labels and plugins, the security boundaries including the docker.sock question, the debugging commands that matter, and the honest answer to when GUI convenience stops scaling.
A practical, sysadmin-grade comparison of Proxmox VE and IncusOS: the argument that matters (you own Proxmox's mutable Debian base, IncusOS owns itself), atomic A/B updates, Secure Boot and TPM, storage and networking, real commands for both, the honest limits of the young IncusOS, and when each earns its keep.