Serving many things from one box: virtual hosts, reverse proxies, caching, and automated certificates.
29 posts
I traced one real request to this site and timed every phase. The surprising part is not the total — it is how little of it the server is responsible for, and which single phase would be worth fixing first.
nginx worker tuning measured on real throwaway containers: why worker_processes auto equals one worker per core, the worker_connections max-connections math, and the ulimit -n / worker_rlimit_nofile ceiling that actually bites. Real warnings, real fix.
A deep-dive into Content-Security-Policy (CSP): a real before/after header diff in throwaway nginx containers, how CSP nonces and hashes beat 'unsafe-inline', how frame-ancestors stops clickjacking, how Report-Only mode lets you test without breaking your site, and a copy-paste starting set for a static site.
brotli vs gzip, measured on real files: full gzip 1-9 and brotli 1-11 byte tables, compression-level CPU costs, nginx gzip and brotli setup, precompressed static assets, BREACH, and what not to compress.
Conditional requests let a client ask 'has this changed?' before downloading a body. Real curl output against a throwaway nginx: ETag + If-None-Match returning 304 Not Modified with zero body bytes, If-Modified-Since vs ETag, If-Match returning 412, and Range returning 206.
A hands-on nginx WAF test: nginx + ModSecurity + OWASP CRS 4.30 blocking a real SQL injection, XSS, and path traversal with 403s and real audit-log rule IDs (942100, 941100, 930110) — plus DetectionOnly rollout, false positives, latency, and where a WAF actually fits.
A hands-on walkthrough of nginx proxy_cache: real MISS→HIT requests against a counting origin, X-Cache-Status debugging, cache keys, bypass, stale-while-error, and the risks OSS nginx won't save you from.
A hands-on HTTP/2 vs HTTP/1.1 comparison: real curl and nghttp2 output from a throwaway nginx showing HTTP/2 multiplexing, HPACK header compression, the nginx http2 config, why TCP head-of-line blocking still needs QUIC, and honest localhost vs high-latency measurements.
A hands-on HAProxy guide: the HAProxy config model (defaults, frontend, backend), mode http vs mode tcp, roundrobin vs leastconn, active health checks that eject a dead backend live, timeouts and retries, and the stats page — reproduced on haproxy 3.0 with real output.
How to use nginx stream module as a TCP/UDP proxy. L4 vs L7 explained with real configs, ssl_preread SNI routing, UDP proxying, load balancing, and proxy_protocol.
What Accept-Ranges, Range, Content-Range, 206 Partial Content and 416 are for, why download managers and video players live on them, how If-Range makes a resumable download safe, why generated responses often can't do ranges, and how to enable it (and what breaks it) in nginx.
Behind a CDN, LB, or reverse proxy, $remote_addr is the proxy, not your user. How X-Forwarded-For, X-Real-IP, and Forwarded work, how nginx real_ip rewrites the client IP with set_real_ip_from and real_ip_recursive, why proxy_protocol is harder to spoof, and the trap of trusting a header you did not write.
A practical tour of secure cookies for session management: what HttpOnly, Secure, SameSite, Path, Domain and the __Host- prefix do, why a cookie is neither a session nor encrypted, how session and token cookies differ for CSRF, and the classic mistakes — with real curl and browser headers.
I ran a throwaway nginx in front of a one-second app, sent SIGTERM mid-flight, and watched requests die as 502 Bad Gateway — then fixed it with real connection draining: why deploys cause 502s, nginx reload vs restart, Kubernetes preStop, and a per-stack graceful-shutdown checklist.
A hands-on Traefik walkthrough: how a dynamic reverse proxy differs from nginx, how providers feed routers, middlewares and services, real Traefik Docker labels routing a container, auto-discovery as containers come online, live /api output, and when plain nginx is simpler.
How object storage really works — flat keys, whole-object writes — why the S3 API won, and how to run MinIO locally. Real commands and output for buckets, uploads, a bucket policy, a presigned URL, versioning, lifecycle rules, and the S3 SDK — plus the honest limits, and when to reach for it.
Build a tiny PKI with openssl, make nginx demand a client certificate with ssl_verify_client, verify it from curl and openssl s_client, then avoid the EKU, SAN, chain, and revocation footguns that break real mutual TLS deployments.
A hands-on Caddy vs nginx comparison for reverse proxy work: the same job written in both, real curl -I output, HTTP/3 and compression, TLS certificate handling (automatic HTTPS vs certbot), config-size and ergonomics, and a decision list.
An nginx config cookbook: how nginx location matching resolves (exact, ^~, regex, prefix), root vs alias, nginx try_files patterns for SPAs and APIs, the add_header inheritance trap, proxy_pass trailing slashes, rewrite vs return, gzip and cache headers, client_max_body_size, and reading nginx -T.
When a self-hosted Git server earns its keep, when a hosted forge is fine, and how to run Gitea or Forgejo without the sharp edges: install options, SSH vs HTTPS clone URLs, reverse proxy and TLS, webhook reachability, mail, upgrades, and a backup you have actually restored.
A concrete walk through QUIC and HTTP/3: the TCP head-of-line blocking and handshake problems they fix, UDP transport with built-in TLS 1.3, streams and connection migration, the 0-RTT and 1-RTT handshake, QPACK, UDP 443 in nginx and Caddy, and how to test it.
WireGuard in a container looks easy until the kernel module, /dev/net/tun, and NET_ADMIN get in the way. A practical WireGuard Docker guide: host vs container namespaces, NET_ADMIN, wireguard-go, kill switch and routing traps, and secrets kept out of the image.
A practical walk through HTTP caching: browser, CDN and reverse-proxy layers and who obeys whom, the Cache-Control directives that matter, ETag/Last-Modified validators, the 304 round trip, the classic no-cache misreading, cache busting vs revalidation, Vary and cookies, and a working nginx config.
A practical guide to the security headers a static site needs: HSTS and its includeSubDomains footgun, a strict Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, frame-ancestors, Permissions-Policy, and CORS — plus the nginx add_header trap and how to test it.
How I run zero-downtime deploys on a single server: the atomic symlink swap for static sites, blue-green deployment behind nginx, health-gated cutover, connection draining, nginx reload vs restart, fast rollback, and the failure modes that actually cause outages.
How I run automated TLS for dozens of subdomains: the ACME flow, HTTP-01 vs DNS-01 challenge tradeoffs, wildcard certificates with safe DNS credentials, renewal hooks, systemd timers, monitoring, rate limits, and the failure modes that actually bite.
Why client-side tracking is a privacy and performance tax, how the self-hosted analytics spectrum runs from GoAccess over server logs to GoatCounter, Umami and Plausible, and a concrete GoAccess setup — plus the honest limits of log-based measurement. The rule: measure what changes your decisions.
The self-hosted stack I actually run in 2026 — one public VPS at the front door, a private overlay network behind it, plus Gitea, log-based analytics, file sync, a password vault and mail — with an honest RAM/effort/sanity note for each, the services I refuse to self-host, and what beginners should skip on day one.
Docker is not the only way to run services. How I host sites and scheduled jobs on one VPS with nginx, systemd units and timers, flock for single-flight work, and atomic symlink deploys — plus the cases where containers really are the right call.