32articles
A hands-on sysadmin guide to bootstrapping Kubernetes with OpenTofu and Argo CD: what the open-source Terraform fork actually is, why IaC owns day zero and GitOps owns everything after, the exact provider and Helm configuration to install Argo CD, the app-of-apps handoff, and the honest limits of the pattern.
A hands-on sysadmin guide to Naxsi, the Nginx Anti XSS and SQL Injection WAF module: how the scoring, deny-by-default model works, building and installing the maintained wargio fork on Debian, Ubuntu, and Fedora, learning mode and nxtool whitelists, what WordPress, Joomla, and Magento need to avoid false positives, the honest limits, and when ModSecurity is the better call.
A sysadmin's field guide to VPNs: what a VPN actually does to your traffic, the threat models it does and does not answer, how no-logs claims and audits really work, which providers pass the test, and a deep technical comparison of OpenVPN, WireGuard, and the proprietary protocols (NordLynx, Lightway, Catapult Hydra, Chameleon), plus a hands-on self-hosted WireGuard setup.
A hands-on sysadmin guide to AIDE for file integrity baselines and inotify-tools for real-time filesystem event monitoring: what each tool actually does, install and configuration on Debian, Ubuntu, and RHEL, scheduling the daily check, inotifywait and inotifywatch recipes, the limits that bite, and how the two complement each other.
Grav 2.0 is a flat-file PHP CMS with Markdown and YAML content, a first-party REST API, an MCP server, and a new SvelteKit 5 admin. Astro is a content-driven JavaScript framework with typed content collections and islands. A hands-on comparison of content models, templating, admin, deployment, and when to pick which.
SMS two-factor authentication was a real upgrade, but SIM swapping, SS7 interception, and real-time phishing have turned the code into a second password an attacker can read. Why it now gives a false sense of security, and what to use instead: TOTP apps, passkeys, hardware keys, and printed recovery codes.
A sysadmin's hands-on walkthrough of a scratch-based, rootless Docker image for the SimpleX Chat CLI. Since the chat server binds 127.0.0.1 only (issue #6449 is still open), a small socat bridge exposes it on 0.0.0.0. Full multi-stage Dockerfile, build and run commands, and the honest trade-offs.
Spin up and tear down a vast.ai GPU box from the CLI: the vast-qwen.sh script searches offers, rents a 2x RTX 3090, serves Qwen3.8-27B-FP8 through vLLM, and exposes an OpenAI-compatible endpoint over SSH, plus the honest cost math on renting versus subscriptions.
SimpleX Chat is the first messenger with no user identifiers at all: no phone number, no username, no account. Here is what that changes for day-to-day users, how you actually connect with people, and how it compares to WhatsApp and Telegram on privacy and metadata.
A practical comparison of Pullfrog and Vercel's Foreman (the eve software factory): how the four-station pipeline and the GitHub Actions bot each turn issues into reviewed PRs, with real configuration, trust boundaries, and when to use which.
A hands-on, sysadmin-grade guide to Vercel Eve: how the filesystem-first agent framework works, from scaffolding and tools to durable sessions, sandbox backends, and deployment, plus a deep comparison of Eve, Mastra 1.55, and Flue 2.0.
A practical, sysadmin-grade comparison of Fail2ban and CrowdSec: how each detects and blocks malicious traffic, the architecture that separates them (local log analysis vs community-shared intelligence), real configuration and commands, honest pros and cons, and when to run Fail2ban, CrowdSec, or both.
npm vs pnpm in 2026: official benchmark data including the Rust-based pnpm 12, workspace workflows, and the supply chain case for switching, from blocked build scripts and minimum release age to git hooks and editor tooling.
After 90 days running self-hosted Immich instead of Google One for our family photos: what worked, what it actually costs, why your data finally stays on hardware you own, and the honest gaps that are still missing for families, straight from the project's own roadmap and issue tracker.
A sysadmin-grade guide to Docker Sandboxes for AI agents: microVM isolation layers, credential injection that keeps API keys out of the sandbox, sbx secret management, the MCP gateway, and what is not isolated by default.
A sysadmin-grade comparison of Docker Compose and Kubernetes for running many self-hosted apps: where Compose starts to hurt, how k3s changes the calculus, and how rootful Kubernetes is actually secured with RBAC, admission control, securityContext, seccomp, and network policies, and how that differs from rootful Docker.
A practical, sysadmin-grade comparison of Docker and Podman for running many self-hosted apps: Compose vs Quadlet, rootful vs rootless security and host-tool debugging, Watchtower vs podman auto-update, Docker API compatibility, and when Kubernetes is the real answer.
A developer-focused walkthrough of the Systhoughts cron expression playground: build and edit expressions, read plain-English explanations, and inspect next runs on a timeline. Four worked examples, the weekday/dialect/timezone mistakes to avoid, and small challenges to try.
Where tokens actually go when you use AI coding agents, how RTK, Caveman, ccusage, Context7, and Repomix cut the waste, and a simple before/after way to measure what you saved.
A skeptical, source-checked comparison of Mastra 1.55 and Flue 2.0 for TypeScript teams new to agentic AI: mental models, durability, memory, RAG, sandboxes, licenses, local vs hosted tooling, and ten concrete use-case picks.
A beginner-friendly guide to the four most popular local AI tools. What each one actually does, where it shines, where it falls short, and how to combine them into one workflow.
NetBird is a WireGuard mesh VPN; Pangolin + Newt is an identity-based remote access platform. An honest comparison of architecture, real commands, costs, and rough edges, from someone running one and evaluating the other.
A clear breakdown of Google Drive for Business pricing in 2025, including real-world costs, hidden fees, and when it makes sense to choose cheaper alternatives
What are Svelte 5 Snippets? A simple example reducing redundancy, boosting reusability, and simplifying your codebase.
Retrieving your Windows product key is essential for reinstalling, transferring licenses, and keeping it for future reference. Here's a quick and straightforward command to easily access your key.
Learn how to automate the build and deployment of an Astro website using a Continuous Integration (CI) pipeline with Woodpecker CI. Streamline your workflow with step-by-step instructions for building with Node.js and automated upload via SCP to a remote server.
Learn how to containerize a SvelteKit app with Prisma and Bun using a multi-stage Dockerfile. Discover workarounds for Prisma compatibility, the benefits of distroless images, and the importance of running non-root containers for enhanced security.
Learn how to containerize and run a legacy Mono application using Docker. This step-by-step guide covers creating a Dockerfile, setting up Docker Compose, and leveraging health checks and auto-healing for seamless deployment.
Astro vs. SvelteKit: Which framework is best for your next project? Strengths, use cases, and unique features of Astro and SvelteKit to help you decide whether to prioritize speed, static content, or dynamic interactivity for your website.
Frequent password changes, once a staple of cybersecurity, are no longer effective. While initially designed to protect against basic threats, they often lead to weaker passwords and unnecessary disruptions.