SumGuy's Ramblings
The art of wasting time.
Docker, self-hosting, AI/LLM, Linux, and DevOps — explained by someone who learned the hard way. No fluff, no enterprise jargon, just practical stuff that actually works on real hardware.
Recent Posts
-
Rate Limits That Lock Out the Wrong User
Guide-style rate limits behind a CDN locked out a bystander on nginx, Caddy, and Traefik. Trusting X-Forwarded-For let a forger through 20 of 20. Fixes tested.
17 min read -
polkit Rules: Restart a Service, No sudo
Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.
13 min read -
yq: Editing YAML From the Command Line
Install the Go yq, not the Python one. Bump compose tags, patch Kubernetes manifests, merge configs and edit front matter from the shell, plus the gotchas.
13 min read -
Security Headers That Break Your Apps
Seven copy-paste security headers gave nginx static files none, let Traefik overwrite an app's own CSP, and blocked self-framing. Tested configs for all three.
17 min read -
Postgres Autovacuum Tuning for Small DBs
Leave most autovacuum globals alone, raise the cost limit, and give your one hot table a per-table scale_factor. Tested on postgres:18.6 with real numbers.
13 min read -
Home Assistant Blueprints: Write Once
Stop copy-pasting the same motion-light automation nine times. Import, write, and update Home Assistant automation and script blueprints with annotated YAML.
13 min read -
systemd Credentials: Secrets Without Env
Stop putting passwords in Environment=. systemd credentials hand secrets to services as locked-down files, encrypted at rest. Setup plus a demo you can run.
12 min read -
LLM Semantic Caching: Stop Paying Twice
Exact-match vs semantic caching for LLM calls: a small Python cache, LiteLLM and RedisVL setups, and real scores showing why restart and stop nginx collide.
16 min read -
Reverse Proxy TLS: What the A+ Hides
Same A+ before and after hardening, yet nginx drops from 25 TLS 1.2 suites to 3, and an old curve list silently strips post-quantum key exchange on all three.
16 min read -
PUID and PGID: Container Permission Fights
Why Sonarr, qBittorrent and Jellyfin fight over bind-mounted files, how PUID/PGID works in the image, when Docker's user: fits better, and how to share media.
12 min read -
systemd-run: Units Without Unit Files
systemd-run starts transient services, scopes, and timers with resource limits and sandboxing, no unit file needed. Replace nohup, at, and ulimit habits.
13 min read -
My 125B Local Run Ran Out of Weekend
A 125B MoE ran an agent job locally for 72 hours and made real progress. A free 120B cloud route finished the same job in 7. Here is where the time went.
14 min read
