Managing Secrets on a VPS: Permissions, Env, Vault
Store API keys and tokens safely on a Linux VPS with strict file permissions, protected environment files, and vault basics that survive a leak.
Linux Security7 min read
NetBay journal
Guides for operators
Practical guides for Linux, containers, CI/CD, self-hosting, and running VPS infrastructure from Netbay Engineering.
599 articles · 24 topics
AllLinuxLinux AdministrationWindowsLinux SecurityLinux NetworkingContainersContainers & OrchestrationKubernetesCI/CDGitHubSelf-HostingBackups & DataDatabasesApp DeploymentDNS & TLSObservabilityEmailAI AgentsAI InfrastructureAPI & AutomationProxiesCloud ArchitectureHardware & PerformanceDevOps Practices
Keeping a Monorepo Sane: CODEOWNERS and Path-Scoped Checks
A large monorepo only stays usable with clear ownership. Use CODEOWNERS routing and path-scoped CI to keep review targeted and merges stay fast.
GitHub7 min read
A Layered API Security Checklist for Production
A production-ready API security checklist covering transport, auth, validation, throttling, and monitoring before you ship your API to production.
API & Automation8 min read
Zero-Downtime Node Restarts with systemd Sockets
Keep the listening socket in systemd so Node restarts do not drop the bind, and nginx clients stop seeing connection refused during deploys.
App Deployment8 min read
DR for a Single Datacenter: RPO and RTO Plans
Set honest RPO and RTO numbers when the origin is one Lucknow datacenter: replica nodes, tested restores, and offsite copies you actually own.
Cloud Architecture8 min read
Indexes That Get Used: PostgreSQL EXPLAIN Basics
Read EXPLAIN ANALYZE until you can tell a Seq Scan from an Index Scan, then add btree indexes that match filters, joins, and ORDER BY clauses.
Databases9 min read
Install WordPress on a VPS Without a Marketplace
Install WordPress by hand on Ubuntu with nginx, PHP-FPM, and MariaDB: core files, wp-config, permalinks, and hardening without a one-click app marketplace.
App Deployment9 min read
Cron Agents: Scheduled LLM Jobs on Linux VPS
Schedule LLM work with systemd timers, lock files, and spend caps so nightly jobs finish, log, and fail loud instead of overlapping on your VPS.
AI Agents8 min read
SELinux for Beginners: Understanding Enforcing, Permissive, and Targeted
SELinux denies by default where file permissions allow everything. Understand enforcing, permissive, targeted policy, and how to read a denial calmly.
Linux7 min read
OpenID Connect Instead of Static Secrets in GitHub Actions
Replace long-lived cloud credentials in GitHub Actions with OpenID Connect — short-lived minted tokens bound to your repository by a trust policy.
GitHub8 min read
Forward Proxies: When a Server Proxies Outbound Traffic
Forward proxies relay outbound requests from your clients to the internet; learn when you need one and how to run a small, safe one on your VPS.
Proxies6 min read
DMARC Policy: From None to Reject Safely
Start DMARC at p=none, read aggregate reports, then raise to quarantine and reject once every legitimate sender aligns. Do not skip the report week.
Email8 min read