Users, Grants, and Remote Access Without Opening 3306
Create MariaDB users with tight hosts, grant least privilege, and reach the server over SSH instead of exposing TCP 3306 to the public internet.
Databases9 min read
NetBay journal
Guides for operators
Practical guides for Linux, containers, CI/CD, self-hosting, and running VPS infrastructure from Netbay Engineering.
499 articles · 24 topics
AllLinuxLinux AdministrationWindowsLinux SecurityLinux NetworkingContainersContainers & OrchestrationKubernetesCI/CDGitHubSelf-HostingBackups & DataDatabasesApp DeploymentDNS & TLSObservabilityEmailAI AgentsAI InfrastructureAPI & AutomationProxiesCloud ArchitectureHardware & PerformanceDevOps Practices
Redis requirepass, ACLs, and Closing Port 6379
Lock Redis with requirepass or ACL users, keep 6379 off the public interface, and layer bind, auth, and a host firewall so scanners never get a PONG.
Databases8 min read
Run node_exporter and Prometheus on One VPS Node
Install node_exporter and Prometheus as systemd services on a single VPS, scrape localhost only, and keep the time series store small and restart-safe.
Observability9 min read
Run Gunicorn Behind Nginx for a WSGI Python App
Put Gunicorn behind nginx so a WSGI Python app serves TLS, buffering, and workers without exposing the application server to the public internet.
App Deployment8 min read
Reverse Proxy, App, and Database Failure Domains
Split proxy, app, and database into three failure domains on one VPS so a crash, a leak, or a lock does not take the whole stack down with it.
Cloud Architecture8 min read
Tool Calling Without a Framework on Linux VPS
Call tools from a chat model with a plain Python loop on Ubuntu: JSON schemas, a dispatch table, retries, and a hard stop without a heavy agent framework.
AI Agents8 min read
Log-Triage Agent Over journalctl on a VPS
Pipe journalctl output into an agent that fingerprints units, severity, and next checks so 3 a.m. log floods become a ranked shortlist, not a 40,000-line paste.
AI Agents8 min read
Maintaining a Rolling-Release Server: Arch Update Strategies That Work
A workable update policy for Arch servers: weekly windows, provider snapshots, .pacnew merges, package downgrades, and when to rebuild instead of updating.
Linux7 min read
Supervisor-Worker Agents for Ticket Triage
Route support tickets with a supervisor that classifies and workers that act, so each ticket has one owner and a recorded handoff on your VPS.
AI Agents8 min read
Linux Users, Groups, and File Permissions: chmod, chown, umask
Understand Linux permission bits, ownership, group-based access control, and how umask shapes default file modes.
Linux7 min read
Environments and Protection Rules in GitHub Actions
Use GitHub Actions environments to gate production deploys behind required reviewers, wait timers, branch restrictions and isolated environment secrets.
GitHub7 min read
REST vs GraphQL: A Pragmatic Decision Guide
REST stays the right default for most services, but GraphQL earns its keep in specific cases. A concrete decision framework for choosing between them.
API & Automation6 min read