step-ca's ACME provisioner speaks RFC 8555. Add it with step ca provisioner add acme --type ACME, and certbot, Traefik, or Caddy can request internal certs via http-01, https://www.valtersit.com/vault/configure-acme-provisioner-for-lets-encryptstyle-internal-ce-bbe066/
#acme #step-ca #ValtersIT

Knot DNS 3.x KASP automates DNSSEC key generation, ZSK/KSK rollover and re-signing with a declarative policy block. Set it up on Ubuntu, Debian or RHEL: https://www.valtersit.com/vault/configure-knot-dns-automatic-dnssec-signing-with-kasp-and-on-5131eb/ #knot-dns #dnssec #ValtersIT

Nginx passive health checks via max_fails and fail_timeout evict failing upstreams. Pair with proxy_next_upstream and timeout limits for resilient load balancing.

https://www.valtersit.com/vault/nginx-upstream-passive-health-checks-with-fail-timeout-and-r-7109db/

#nginx #loadbalancer #ValtersIT

Scan live process memory for malware with YARA on Linux. Walks all PIDs, matches signatures in RAM without halting services. Ubuntu/Debian/RHEL. https://www.valtersit.com/vault/execute-yara-memory-scan-on-all-running-processes-for-malici-cde17d/ #security #yara #ValtersIT

GoBGP as a BGP route reflector: set cluster ID in [global.route-reflector.config], mark peers with route-reflector-client = true. Scales iBGP beyond full-mesh.
https://www.valtersit.com/vault/configure-gobgp-route-reflector-with-cluster-id-and-client-g-75ea23/
#route-reflector #ibgp #ValtersIT

Set spec.shards on the Prometheus CR and the operator spins up N StatefulSets, hashing each target's __address__ to scrape a disjoint 1/N slice. Beats high https://www.valtersit.com/vault/scale-prometheus-shards-with-operatormanaged-sharding-for-hi-f00d6d/

#prometheus #sharding #ValtersIT

Set up AWS S3 Cross-Region Replication via AWS CLI: IAM role, KMS keys, metadata preservation, target storage class. Continuous async redundancy across regions.
https://www.valtersit.com/vault/aws-s3-crossregion-replication-setup-via-aws-cli-ed72e3/
#aws #s3 #ValtersIT

Initialize a PostgreSQL physical standby with pg_basebackup in stream mode. It auto-creates a replication slot, opening two connections: one for a consistent https://www.valtersit.com/vault/initializing-physical-standby-cluster-via-streamed-pgbasebac-84b4b3/
#postgresql #pg_basebackup #ValtersIT

Volatility 3 malfind spots injected code: it walks each process VAD tree, flags PAGE_EXECUTE_READWRITE regions not backed by disk, then disassembles page https://www.valtersit.com/vault/identify-injected-code-and-shellcode-memory-pages-using-malf-4644e9/
#volatility3 #malware-analysis #ValtersIT

Pydantic 2.5+ Union[discriminator=...] routes validation by literal type tag, skipping trial-and-error on every submodel. Faster and stricter for polymorphic event payloads. https://www.valtersit.com/vault/tagged-union-discriminator-for-polymorphic-event-payloads-8ada79/ #pydantic #python #ValtersIT

Hand-roll bash arg parsing: long/short opts, combined flags, -- handling. No getopts, no getopt. Bash 4.3+. https://www.valtersit.com/vault/robust-bash-argument-parser-without-getopts-using-manual-shi-88f755/ #bash #cli #ValtersIT

Configure TAP aggregation on Arista EOS to feed an out-of-band IDS. Combine SPAN sources into one logical stream via hardware replication. https://www.valtersit.com/vault/configure-tap-aggregation-group-for-outofband-ids-feed-503e55/ #arista #tap-aggregation #ValtersIT

Pipe YAML into jq via yq for complex queries: yq eval -o=json file.yaml | jq '.items[] | select(.enabled)'.
https://www.valtersit.com/vault/convert-yaml-to-json-and-pipe-to-jq-for-complex-queries-98d836/
#yq #jq #ValtersIT

Probe TCP services beyond port checks: Blackbox Exporter module does TLS SNI handshakes, sends custom payloads (Redis PING, binary frames), matches response bytes https://www.valtersit.com/vault/tcp-payload-matching-with-tls-sni-and-custom-handshake-timeo-a2e567/

#blackbox #tcp-probe #ValtersIT

Set up persistent VXLAN overlays with systemd-networkd using .netdev and .network files, auto-created at boot. No manual ip commands needed.
https://www.valtersit.com/vault/configure-vxlan-with-systemdnetworkd-for-persistent-overlays-ad933a/
#vxlan #systemd-networkd #ValtersIT

OpenSSL 3 drops engines for providers. Wire a PKCS11 module through p11-kit so EVP ops hit the token via C_Sign/C_Decrypt. Config walkthrough for Ubuntu, Debian, RHEL.
https://www.valtersit.com/vault/configure-openssl-3-provider-to-load-a-pkcs11-module-via-p11-7dd1db/
#openssl3 #pkcs11 #ValtersIT

systemd-networkd lets you run static IPv6 and RFC 7217 stable-privacy SLAAC on one interface. IPv6PrivacyExtensions=kernel gives stable, non-MAC-linkable IIDs.

https://www.valtersit.com/vault/pin-static-ipv6-with-rfc-7217-stable-privacy-addresses-in-sy-a0d705/

#ipv6 #slaac #ValtersIT

PKCS11 key wrap/restore with C_WrapKey and C_UnwrapKey: encrypted blob only the peer token can decrypt. pkcs11-tool --wrap/--unwrap, CKM_AES_KEY_WRAP or CKM_RSA_PKCS_OAEP.

https://www.valtersit.com/vault/back-up-hsm-keys-to-a-wrapped-blob-and-restore-on-a-peer-tok-5f5740/

#pkcs11 #wrap #ValtersIT

Generate YAML from env vars with yq. The -n flag builds a null node, env() pulls values, output redirects to a new file. Lightweight templating, no deps.

https://www.valtersit.com/vault/generate-yaml-from-template-with-environment-variables-4b214c/

#yq #templating #ValtersIT

Monitor gRPC services with Blackbox Exporter's gRPC prober over TLS. Sends HealthCheckRequest, verifies SERVING in response. Perfect for K8s microservices.

https://www.valtersit.com/vault/grpc-service-health-checking-using-health-check-protocol-ove-580440/

#grpc #blackbox-exporter #ValtersIT