Secrets, Certificates, and Credential Rotation
Manage .env files, encrypt secrets with Ansible Vault, and rotate credentials without downtime.
Devops
Kernel and Systemd Service Hardening
Tune kernel parameters with sysctl and sandbox services with systemd to reduce your VPS attack surface.
Caddy Hardening: Security Headers and Rate Limiting
Add security headers, rate limiting, and server identity removal to your Caddy configuration.
Docker Security on a Shared VPS
Why Docker bypasses your UFW rules, how to fix it, and container hardening practices that matter on a shared VPS.
UFW, fail2ban, and Banning Repeat Offenders
Configure UFW rules, build a fail2ban jail for Caddy access logs, and escalate bans for repeat offenders with the recidive jail.
SSH Hardening: Ed25519 Keys and Disabling Root Login
Lock down SSH access with ed25519 keys, disable root login, and remove unused authentication methods.
Provision an Ubuntu VPS and Create a Deploy User
Set up a DigitalOcean droplet from scratch: first SSH connection, deploy user, UFW baseline, and unattended upgrades.
Production Linux: Secure and Maintain Your Own VPS
A 10-post series covering the full lifecycle of a production Linux VPS — from first login to disaster recovery.
Manage DigitalOcean Infrastructure With Ansible for Laravel and PHP Apps
How to structure an Ansible repo to manage two DigitalOcean droplets, six Laravel apps, and a Go microservices platform without replacing the existing Deployer workflow.
Wiring Spec Drift Detection Into Your Monorepo
How to turn a spec drift detector from a script nobody runs into a hard gate across your task runner, git hooks, and CI pipeline.