Notes

A boring, reliable TLS renewal routine 2026-10-18

Every few years I rediscover that certificate renewal is a thing that breaks exactly once: the day you forget it exists. The current routine is deliberately dull — acme.sh in cron, certificates copied to a plain directory, a reload hook per consumer. The whole thing is fifteen lines of shell and has survived three provider migrations.

The trick, if there is one, is to keep the renewal path completely separate from whatever serves traffic. Renew into files, then let each service pick them up. When something goes wrong you debug a file copy, not a distributed system.

The day my IPv6 prefix wandered off 2026-09-30

A residential prefix is a gentleman's agreement. Mine was renumbered on a Tuesday, and everything that hard-coded it — firewall rules, DNS AAAA records, one very proud monitoring script — failed in thirteen different ways. The fix was boring: derive, don't hard-code. The lesson was the usual one: anything you write down by hand will be wrong by the time you need it.

Quarterly backup drill: restoring a node from scratch 2026-08-14

A backup you have never restored is a rumour. Four times a year I pick one node, wipe a spare VM, and rebuild it from the archives with a stopwatch running. This quarter's time: 41 minutes, of which 12 were spent remembering the passphrase format. Write the passphrase format down.

Comparing public DNS resolvers from three vantage points 2026-06-02

I spent a weekend timing the usual suspects from home, from a Frankfurt VPS and from a phone on hotel Wi-Fi. The results matched nobody's marketing: the fastest resolver from one vantage point was the slowest from another. Conclusion: measure from where you actually are, or just use whatever validates DNSSEC and stop thinking about it.