supervisorctl reread diffs conf.d/ against live state, update then starts new, stops removed, restarts changed processes. Zero downtime, no daemon restart.

https://www.valtersit.com/vault/zerodowntime-configuration-reloading-and-delta-deployment-3a2d1d/

#supervisor #cicd #ValtersIT

Cut GuardDuty noise from VPN egress. Use create-ip-set to add trusted IPs; the detector excludes them in Recon, UnauthorizedAccess, Backdoor.
https://www.valtersit.com/vault/add-trusted-ip-set-to-guardduty-to-reduce-false-positives-fr-3b7051/
#aws #guardduty #ValtersIT

Migrate Shuffle from SQLite to external PostgreSQL for production. Set DB_TYPE=postgres plus DB_HOST, PORT, USER, PASSWORD, NAME in core and backend services. Ubuntu https://www.valtersit.com/vault/migrate-shuffle-to-external-postgresql-for-production-7ee529/ #shuffle #postgresql #ValtersIT

Audit GPU passthrough with IOMMU group and ACS checks. Script maps /sys/kernel/iommu_groups, detects pcie_acs_override, flags shared bridges. Validated on Proxmox 8 and https://www.valtersit.com/vault/audit-gpu-passthrough-security-with-iommu-group-and-acs-chec-dfda6e/
#iommu #security #ValtersIT

Audit every request in K8s and ship events to a webhook backend for real-time analysis. Audit policy + omitStages + dynamic webhook config for Kubernetes 1.24+. https://www.valtersit.com/vault/kubernetes-audit-log-policy-with-dynamic-webhook-backend-01fa24/ #kubernetes #audit #ValtersIT

Validate WSS upgrades with blackbox exporter: check HTTP 101, Upgrade headers, and ping-pong frames over TLS.

https://www.valtersit.com/vault/websockets-pingpong-frame-validation-over-secure-tls-56f789/

#blackbox #websockets #ValtersIT

Tamper-evident audit logs with hash chaining using OpenSSL and bash. Each entry hashed with the previous hash, so any edit breaks the chain. Verify integrity https://www.valtersit.com/vault/tamperevident-audit-logs-with-hash-chaining-using-openssl-8fd584/

#openssl #tamper-evident #ValtersIT

Harden Shuffle Docker containers with non-root user, read-only FS, cap_drop: [ALL], no-new-privileges. Compose override for real security. https://www.valtersit.com/vault/harden-shuffle-docker-containers-with-nonroot-user-and-reado-00bed4/ #docker #security #ValtersIT

Point Shuffle at an external RabbitMQ broker to scale its task queue. Set BROKER_URL to an amqp:// URL and workers connect to a dedicated cluster. https://www.valtersit.com/vault/scale-shuffle-task-queue-with-external-rabbitmq-865d63/ #shuffle #rabbitmq #ValtersIT

Enable Chaos Monkey config in Spinnaker app manifests via API with curl. Set opt-in, target ASGs, termination probability. Ubuntu/Debian/RHEL.
https://www.valtersit.com/vault/enabling-chaos-monkey-configuration-in-spinnaker-application-4b8ae7/
#chaosmonkey #spinnaker #ValtersIT

Rolling tcpdump captures: full packets, interface/protocol filters, ring-buffer file size limits for continuous forensic PCAP rotation. https://www.valtersit.com/vault/stream-rolling-forensic-packet-capture-with-filtered-size-li-2103f3/ #tcpdump #security #ValtersIT

Cut VXLAN broadcast noise with ARP suppression: VTEPs answer ARP locally from FDB/neighbor tables instead of flooding the overlay. Needs Linux 4.9+ and iproute2 4.9+. Setup https://www.valtersit.com/vault/enable-arp-suppression-on-vxlan-to-reduce-broadcast-traffic-f737ae/
#vxlan #linux #ValtersIT

Deploy BGP EVPN with FRR for dynamic VXLAN FDB learning. FRR 6.0+ on Ubuntu, Debian, RHEL. Configures EVPN control plane with advertise-all-vni.
https://www.valtersit.com/vault/deploy-bgp-evpn-with-frr-for-dynamic-vxlan-fdb-learning-b17d44/
#linux #vxlan #ValtersIT

pkcs11-tool --keypairgen creates RSA-4096 keys inside the token via C_GenerateKeyPair. Private exponent never crosses the HSM boundary, non-extractable by default. https://www.valtersit.com/vault/generate-an-rsa4096-keypair-directly-on-a-pkcs11-token-e2fc06/ #pkcs11 #rsa #ValtersIT

Avoid PITR failures by validating archived MySQL binary logs. `mysqlbinlog --verify-binlog-checksum` recalculates the 4-byte CRC32 per event to detect corruption.

#mysql #binlog #ValtersIT

https://www.valtersit.com/vault/verify-binlog-integrity-with-mysqlbinlog-and-checksums-9760cd/

Salt top files evaluate top-to-bottom, later matches win, so dev/staging/prod can share a base and diverge only in pillar overrides. Full walkthrough: https://www.valtersit.com/vault/multienvironment-top-file-with-pillar-override-precedence-6c2a90/ #saltstack #topfile #valtersit

Strip secrets from YAML before sharing. yq eval 'del(.password, .token)' -i file.yaml removes sensitive keys in place. Safely paste configs into tickets or repos.

https://www.valtersit.com/vault/safely-remove-sensitive-keys-before-sharing-yaml-977f9e/

#yq #security #ValtersIT

Dump your NVIDIA vBIOS from /sys/bus/pci/devices/[bdf]/rom and strip the UEFI GOP header so passthrough guests that fail to init the card get a clean ROM. https://www.valtersit.com/vault/extract-and-patch-nvidia-vbios-rom-for-passthrough-guests-5b9ae1/ #vbios #nvidia #ValtersIT

Scan Git commits for secrets with gitleaks. Uses Shannon entropy and TOML rules to find leaked API keys. Run gitleaks detect --source . --redact #api #gitleaks #ValtersIT

https://www.valtersit.com/vault/api-key-entropy-and-secret-scanning-across-git-history-with--f47eeb/

Arista EOS: cap prefixes per BGP neighbor with maximum-prefix, warn before you tear down. Syslog at threshold, reset at hard limit. https://www.valtersit.com/vault/enforce-bgp-maximum-prefix-with-warning-threshold-and-loggin-7d935f/ #arista #bgp #ValtersIT