SumGuy's Ramblings
The art of wasting time.
Docker, self-hosting, AI/LLM, Linux, and DevOps — explained by someone who learned the hard way. No fluff, no enterprise jargon, just practical stuff that actually works on real hardware.
Recent Posts
-
Your Admin Panel Has a Side Door
Admin blocks on nginx, Caddy, and Traefik let 2 or 3 of 13 spellings through. A forged Remote-User fooled all three. Caddy's open admin port took a new config.
17 min read -
Postgres in Docker: The shm_size Gotcha
Docker gives Postgres a 64MB /dev/shm. A big parallel query then dies with 'could not resize shared memory segment'. Here is the fix and the trap behind it.
7 min read -
systemd DynamicUser: No useradd Needed
systemd DynamicUser=yes plus StateDirectory= gives a daemon a throwaway UID and a private data folder. No useradd, no dead accounts. Here are the four traps.
15 min read -
Rate Limits That Lock Out the Wrong User
Guide-style rate limits behind a CDN locked out a bystander on nginx, Caddy, and Traefik. Trusting X-Forwarded-For let a forger through 20 of 20. Fixes tested.
17 min read -
polkit Rules: Restart a Service, No sudo
Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.
13 min read -
yq: Editing YAML From the Command Line
Install the Go yq, not the Python one. Bump compose tags, patch Kubernetes manifests, merge configs and edit front matter from the shell, plus the gotchas.
13 min read -
Security Headers That Break Your Apps
Seven copy-paste security headers gave nginx static files none, let Traefik overwrite an app's own CSP, and blocked self-framing. Tested configs for all three.
17 min read -
Postgres Autovacuum Tuning for Small DBs
Leave most autovacuum globals alone, raise the cost limit, and give your one hot table a per-table scale_factor. Tested on postgres:18.6 with real numbers.
13 min read -
Home Assistant Blueprints: Write Once
Stop copy-pasting the same motion-light automation nine times. Import, write, and update Home Assistant automation and script blueprints with annotated YAML.
13 min read -
systemd Credentials: Secrets Without Env
Stop putting passwords in Environment=. systemd credentials hand secrets to services as locked-down files, encrypted at rest. Setup plus a demo you can run.
12 min read -
LLM Semantic Caching: Stop Paying Twice
Exact-match vs semantic caching for LLM calls: a small Python cache, LiteLLM and RedisVL setups, and real scores showing why restart and stop nginx collide.
16 min read -
Reverse Proxy TLS: What the A+ Hides
Same A+ before and after hardening, yet nginx drops from 25 TLS 1.2 suites to 3, and an old curve list silently strips post-quantum key exchange on all three.
16 min read
