NetBay journal

Guides for operators

Practical guides for Linux, containers, CI/CD, self-hosting, and running VPS infrastructure from Netbay Engineering.

599 articles · 24 topics

Designing Split-Horizon Authoritative DNS Zones for Private Cloud VPS

Architect split-horizon DNS zones that serve internal private IP addresses to authenticated VPS peers while publishing public records to the internet.

DNS & TLS2026-10-205 min read

SLO-Driven Alerting: Eliminating Fatigue with Multi-Window Error Budget Burn Rates

Replace noisy static CPU/RAM threshold alerts with mathematical multi-window burn rate alarms that only page engineers when user-facing SLAs are threatened.

DevOps Practices2026-10-187 min read

High-Concurrency API Rate Limiting Using Redis Generic Cell Rate Algorithm

Protect API endpoints from abuse using the Generic Cell Rate Algorithm (GCRA) and Redis/Valkey, delivering millisecond enforcement and RFC 7807 headers.

API & Automation2026-10-187 min read

Protecting SSH with FIDO2 / U2F Hardware Keys on Linux

Eliminate credential theft by configuring OpenSSH hardware-backed ed25519-sk keys with mandatory touch verification and FIDO2 tokens.

Linux Security2026-10-178 min read

Zero-Trust Edge Gateway: Implementing Mutual TLS (mTLS) with Envoy Proxy

Establish cryptographic identity verification between services by deploying Envoy Proxy configured for strict mutual TLS (mTLS) authentication.

Proxies2026-10-178 min read

Zero-Downtime Blue-Green Deployments with Docker Compose and Nginx Reloads

Achieve seamless atomic application updates on a single production VPS using dual container sockets, upstream switching, and curl health validation.

CI/CD2026-10-156 min read

Building Resilient Webhook Delivery Engines with Idempotency Keys

Architect a fault-tolerant webhook delivery system featuring HMAC-SHA256 signature verification, idempotency keys, and jittered exponential backoff.

API & Automation2026-10-158 min read

Automated Security Auditing with OpenSCAP on Linux Servers

Automate CIS benchmark compliance scanning, generate HTML remediation reports, and enforce security baselines using OpenSCAP and oscap.

Linux Security2026-10-147 min read

HAProxy as a High-Throughput Layer 7 TLS Offloader and Connection Multiplexer

Handle tens of thousands of concurrent connections on minimal VPS resources with HAProxy Layer 7 TLS termination and HTTP connection pooling.

Proxies2026-10-147 min read

Distributed LoRA Fine-Tuning Pipelines with Ray Train and DeepSpeed ZeRO-2

Train custom foundation model adaptors efficiently on multi-GPU server clusters with automated checkpoint validation and memory-balanced sharding.

AI Infrastructure2026-10-128 min read

Hardening Linux Namespaces and POSIX Capabilities

Prevent privilege escalation by stripping unused POSIX capabilities, disabling unprivileged user namespaces, and enforcing Ambient Capabilities.

Linux Security2026-10-116 min read

Configuring Nginx for HTTP/3 and QUIC: Kernel UDP Buffers and TLS 1.3

Unlock sub-millisecond connection handshakes by compiling and tuning Nginx with native HTTP/3 QUIC support and optimized Linux UDP buffer pools.

Proxies2026-10-116 min read