Field Notes & Build Logs
Written from the terminal, not about it.
The Singapore Bot Wave: Why Under Attack Mode Is the Wrong Fix for WordPress
Singapore bot traffic is hammering WordPress sites. Why Cloudflare Under Attack mode is the wrong fix, and the layered rules that actually stop automated hits.
sshuttle: the VPN I already had
Why I dropped paid VPN subscriptions for sshuttle over SSH to my own VPS, how to set it up, and the limits you need to know before relying on it.
The lemp stack hardening to ensure multi tenants doesn't corrupt each other
Building an Ansible role that isolates multi-tenant WordPress at the OS level on Rocky/AlmaLinux 9, and the bugs it took to get CI passing.
Race Conditions in Parallel CI/CD Deploys: What Actually Breaks
Why parallel CI/CD deploy jobs corrupt state, and the locking, atomic-swap, and serialization fixes that stop it
SSH was up, the website wasn't: a bonding interface failure
SSH worked fine internally, but every request through Cloudflare timed out. Here is what happened, how I fixed it, and what I still do not know.
netstat to ss: how it actually started for me
netstat was slowing down on a box with thousands of connections. Here's what ss actually does differently, not just why everyone says to switch.
A WordPress reinstall does not clean a hacked site
We reinstalled core and every plugin from wordpress.org. The rogue admin came back the next morning. Here is why, and what to check instead.
SYN flood detection lies to you on a SYN-cookie kernel
Half-open connections never reach /proc/net/tcp when SYN cookies are on. Here's what to read instead.