A loopback-only proxy for prototyping northway's feed reader
How northway’s browser prototype keeps its API key off client JavaScript with a loopback-only Node proxy, before any of it reaches the production Pi build.
Security
Keep SQLite data in a private child directory, not at the Docker volume root
Mounting a durable volume straight onto the directory you chmod’d in the image throws away that permission — bake a private child path instead.
Splitting one Dockerfile into API and maintenance images
A shared runtime stage plus two build targets keeps CLI maintenance tools out of the deployed API image, and a script proves it on every build.
Hardening a manual Claude Code review workflow in GitHub Actions
How a human-triggered ‘@claude review’ workflow got locked down to read-only, bounded-diff, revision-verified reviews after the official tag-mode example turned out to be implementation-capable by default.
Backup and Disaster Recovery
Automate backups, test restores, and build a disaster recovery runbook for your VPS.
Monitoring, Alerting, and Incident Response
Set up lightweight monitoring and alerting for a solo-developer VPS, plus a post-incident checklist.
Automated Patching and Server Maintenance
Configure automatic security patches, detect stale services with needrestart, and keep logs and Docker images from filling your disk.
Secrets, Certificates, and Credential Rotation
Manage .env files, encrypt secrets with Ansible Vault, and rotate credentials without downtime.
Kernel and Systemd Service Hardening
Tune kernel parameters with sysctl and sandbox services with systemd to reduce your VPS attack surface.
Caddy Hardening: Security Headers and Rate Limiting
Add security headers, rate limiting, and server identity removal to your Caddy configuration.