A simple routine for server backups
Backups are only useful if you can restore from them. This note describes a small routine built from rsync, checksums and a monthly restore drill.
Keeping SSH access tidy
Key-only logins, a non-default port and a short allow-list go a long way. A few lines of sshd_config and what each one is for.
Automating certificate renewal with DNS validation
Why DNS validation survives firewalls that HTTP validation does not, and how to wire a renewal hook that reloads only what changed.