12posts
The smallest automation in the smart home is also one of the most useful: a Wake-on-LAN packet that spins a sleeping server back to life. A sysadmin read on WoL use cases, Home Assistant automations, coexisting with Zigbee smart plugs, waking on demand, and how to shut down gracefully without cutting power under load.
Coding agents decide at runtime what to call, so the boundary has to sit outside the agent. A sysadmin's guide to default-deny egress: the agent sandbox defaults for Claude Code, Codex, ChatGPT Work, and Docker Sandboxes, the firewall and proxy layers that enforce allowlists, and where egress controls still leak.
A practical walkthrough that turns a bare Debian install into a secure, maintainable server with Ansible: SSH hardening and a deploy user, unattended-upgrades with the reboot policy you actually want, restic-based backups on a systemd timer, and a pinned Docker Engine install plus Compose deploys, with the reasoning and trade-offs behind every step.
A sysadmin guide to running OpenTelemetry traces on a small stack: one Collector, OTLP from your applications, sampling that keeps errors and drops the boring traffic, Tempo or Jaeger v2 as the backend, and the limits that bite when the whole pipeline runs on one box.
A sysadmin guide to systemd-journald persistence: where the journal actually lives, the two steps that make it survive reboots, the size and retention knobs that stop it eating the disk, the silent ways entries still go missing right before a crash, and the journalctl calls that read the previous boot once the machine has already come back up.
A sysadmin guide to the Linux watchdog timer: what the kernel watchdog device actually does, why a hardware watchdog and the softdog module are not the same thing, and five steps to arm it safely, from systemd RuntimeWatchdogSec and per-service WatchdogSec to the userspace watchdog daemon, with the tests that prove it fires before you need it.
When Cloudflare fronts your origin, CrowdSec only sees what your reverse proxy writes into the log: edge IPs unless trusted proxies are configured. A hands-on guide to CF-Connecting-IP, X-Forwarded-For spoofing, firewall-level versus app-level blocking, and the CrowdSec Cloudflare bouncer that moves the block to the edge.
A hands-on sysadmin guide to AIDE for file integrity baselines and inotify-tools for real-time filesystem event monitoring: what each tool actually does, install and configuration on Debian, Ubuntu, and RHEL, scheduling the daily check, inotifywait and inotifywatch recipes, the limits that bite, and how the two complement each other.
A sysadmin's hands-on walkthrough of a scratch-based, rootless Docker image for the SimpleX Chat CLI. Since the chat server binds 127.0.0.1 only (issue #6449 is still open), a small socat bridge exposes it on 0.0.0.0. Full multi-stage Dockerfile, build and run commands, and the honest trade-offs.
A practical, sysadmin-grade comparison of Fail2ban and CrowdSec: how each detects and blocks malicious traffic, the architecture that separates them (local log analysis vs community-shared intelligence), real configuration and commands, honest pros and cons, and when to run Fail2ban, CrowdSec, or both.
A practical, sysadmin-grade comparison of Docker and Podman for running many self-hosted apps: Compose vs Quadlet, rootful vs rootless security and host-tool debugging, Watchtower vs podman auto-update, Docker API compatibility, and when Kubernetes is the real answer.
A developer-focused walkthrough of the Systhoughts cron expression playground: build and edit expressions, read plain-English explanations, and inspect next runs on a timeline. Four worked examples, the weekday/dialect/timezone mistakes to avoid, and small challenges to try.