Catching SSRF When Your API Fetches URLs
Prevent server-side request forgery in APIs that fetch URLs by validating schemes, blocking metadata ranges, and restricting egress.
API & Automation8 min read
NetBay journal
Guides for operators
Practical guides for Linux, containers, CI/CD, self-hosting, and running VPS infrastructure from Netbay Engineering.
499 articles · 24 topics
AllLinuxLinux AdministrationWindowsLinux SecurityLinux NetworkingContainersContainers & OrchestrationKubernetesCI/CDGitHubSelf-HostingBackups & DataDatabasesApp DeploymentDNS & TLSObservabilityEmailAI AgentsAI InfrastructureAPI & AutomationProxiesCloud ArchitectureHardware & PerformanceDevOps Practices
Harden Windows Server 2022 on a Public IPv4
Lock down Windows Server 2022 on a public IPv4: disable unused roles, enforce NLA, patch, and restrict admin ports before bots find the box.
Windows9 min read
InnoDB Buffer Pool Settings That Matter on a VPS
Size the InnoDB buffer pool from real RAM, then change only the handful of knobs that actually move query latency on a single production VPS.
Databases9 min read
Redis Persistence: RDB vs AOF on a Small VPS
Choose RDB, AOF, or both on a small VPS by weighing restart durability against High-Speed SSD writes, fork cost, and how much data you can afford to lose.
Databases9 min read
Grafana Dashboards That Answer CPU, Disk, and Memory
Build a small Grafana dashboard whose panels answer CPU steal, disk await, and memory pressure with PromQL you can defend during an incident.
Observability9 min read
Uvicorn Workers for FastAPI and ASGI on a VPS
Run Uvicorn with multiple workers for FastAPI on Ubuntu, then bind it to localhost and proxy through nginx so ASGI stays fast and private on one VPS.
App Deployment8 min read
Applying Twelve-Factor Discipline on One Box
Run a twelve-factor app on a single VPS: env config, stateless processes, port bind, stdout logs, and disposability without pretending you have a fleet.
Cloud Architecture8 min read
Tool Schemas Models Cannot Easily Misuse
Design JSON tool schemas that block SSRF, glob shells, and extra keys so a model on your Linux VPS can call tools without inventing dangerous arguments.
AI Agents8 min read
Draft Status Page Copy with an Incident Agent
Turn alerts and recent deploys into a status-page draft plus an internal timeline so on-call writes facts first and publishes only after a human review.
AI Agents8 min read
Retrieval-Augmented Agents on a Single VPS
Ground agent answers in local files and SQLite on one Lucknow VPS, then call the model API only with retrieved chunks instead of the whole corpus.
AI Agents8 min read
ufw vs firewalld vs nftables: Choosing a Server Firewall
Compare ufw, firewalld, and nftables for a Linux VPS and pick the right filtering layer for your distro, workflow, automation, and threat model.
Linux Security7 min read
openSUSE Leap on Servers: Zypper, Patterns, and YaST Overview
How zypper, patterns, and YaST fit together on openSUSE Leap, plus the patching commands, repository layout, and ncurses tools server admins use daily.
Linux6 min read