Bulk-audit DMARC, SPF, and DKIM across partner domains. Three DNS queries per domain, risk-ranked CSV output. Runs on Ubuntu 22.04/Debian 12 with bash and dig.
https://www.valtersit.com/vault/bulkaudit-dmarc-posture-across-a-partner-domain-portfolio-2b4f2b/
#dmarc #third-party-risk #ValtersIT

Lock down Node.js with systemd sandboxing: ProtectSystem, ProtectHome, PrivateTmp for namespace isolation and strict resource controls. Full unit config:
https://www.valtersit.com/vault/hardened-systemd-service-unit-with-process-sandboxing-for-no-55fa6e/
#systemd #nodejs #ValtersIT

Control Karpenter node termination with granular disruption budgets. Cron schedules + node limits for safe HA maintenance. Kubernetes 1.26+, EKS, Karpenter https://www.valtersit.com/vault/setting-granular-disruption-budgets-for-highavailability-mai-c8e9b8/

#karpenter #high-availability #ValtersIT

Stop hardcoding subnet and SG IDs in EC2NodeClass. Use AWS tags instead: Karpenter queries the EC2 API at runtime, picks subnets by free IP space, and matches security https://www.valtersit.com/vault/configuring-ec2nodeclass-for-dynamic-subnet-and-security-gro-f207e0/ #karpenter #aws #ValtersIT

RabbitMQ's pause_minority mode halts isolated nodes when they lose quorum, avoiding split-brain during network splits. Track heartbeat loss against cluster https://www.valtersit.com/vault/hardening-network-partition-strategy-using-pause-minority-mo-79cea1/ #rabbitmq #high-availability #ValtersIT

Wire semantic-release into CI: every push to main auto-bumps the version, updates the changelog, tags, publishes to npm, and cuts a GitHub release from your https://www.valtersit.com/vault/automate-semantic-versioning-and-publishing-with-semanticrel-8314d4/

#semantic-release #ci #ValtersIT

Implement Pact provider state handler in Express: verifier POSTs JSON w/ state+params so you can seed DB before each interaction https://www.valtersit.com/vault/provider-state-handler-for-pact-verification-with-express-ec15ba/ #pact #contract #ValtersIT

ZFS snapshots give you RPO=snapshot interval at near-zero cost. Tiered retention + 5-min schedules = instant rollback on Ubuntu, Debian, FreeBSD.

https://www.valtersit.com/vault/configure-zfs-snapshots-with-rpoaligned-retention-for-instan-c6b16c/

#zfs #snapshot #ValtersIT

Update nested YAML keys in place with yq and env vars. Atomic, safe for prod. Works on Linux, macOS, WSL2.

https://www.valtersit.com/vault/inplace-update-nested-key-using-environment-variable-057647/

#yq #kubernetes #ValtersIT

Velero DR restore excluding system namespaces, with update policy for resource conflicts and priority ordering: CRDs, StorageClasses, PVs, PVCs first. https://www.valtersit.com/vault/emergency-disaster-recovery-cluster-restoration-excluding-sy-3581f7/ #velero #disaster-recovery #ValtersIT

Run Kaniko on EKS without long-lived keys. Use IRSA: the pod gets temporary ECR creds via OIDC + the AWS SDK chain. No secrets needed.
https://www.valtersit.com/vault/kaniko-build-with-aws-ecr-authentication-using-iam-roles-for-952bcd/
#kaniko #aws #ValtersIT

Taint a dedicated DOKS node pool via doctl, then match pods with tolerations + node affinity. Scheduler only lands critical workloads there. Full config:
https://www.valtersit.com/vault/isolating-critical-workloads-using-dedicated-node-pools-and--a50f4b/
#doks #kubernetes #ValtersIT

EXPLAIN ANALYZE in MySQL 8.0.18+ runs your query and shows real row counts, iterator times, and loops, not estimates. Find the actual bottleneck.

https://www.valtersit.com/vault/use-mysql-80-explain-analyze-to-diagnose-actual-query-execut-0f1414/

#mysql #mysql8 #ValtersIT

apachectl graceful sends SIGUSR1 so kids re-fork with new ModSecurity rules while old ones finish in-flight requests. Rule tree recompiles per child at startup. Zero downtime.
https://www.valtersit.com/vault/hotreload-modsecurity-rules-without-dropping-connections-ae2d16/
#apache #reload #ValtersIT

AWS CLI creates strict CloudFront Cache Policies that whitelist only essential headers, locking down your cache key. https://www.valtersit.com/vault/aws-cloudfront-create-strict-cache-policy-via-aws-cli-1d46fe/ #aws #cloudfront #ValtersIT

tc prio qdisc gives strict priority bands. Band 0 drains before 1, 1 before 2. Attach fq_codel per band, match DSCP EF/CS5/CS6 to band 0 for VoIP, DNS, routing. Full how-to: https://www.valtersit.com/vault/prioritizing-voip-and-dns-with-tc-prio-qdisc-and-tos-matchin-521ff0/ #tc #dscp #ValtersIT

Volatility 3 can parse Windows registry hives straight from RAM, even without disk files. Grab hivelist, then printkey walks cells, values and timestamps https://www.valtersit.com/vault/extract-and-parse-offline-windows-registry-hives-from-volati-a9a215/ #volatility3 #registry-forensics #ValtersIT

Cilium Tetragon attaches eBPF to kernel tracepoints/kprobes, blocking process exec, file and network activity at the syscall boundary. TracingPolicy can log or https://www.valtersit.com/vault/ebpf-runtime-enforcement-with-tetragon-for-privilege-escalat-46f458/

#ebpf #zero-trust #ValtersIT

Inventory installed packages + CVEs via osquery. Query joins deb/rpm/Homebrew data against a cached NVD feed, outputs name, version, source, arch. https://www.valtersit.com/vault/continuous-inventory-of-installed-packages-and-known-cves-wi-73b07d/ #osquery #cve #ValtersIT

SRv6 End.X binds a SID to an L3 adjacency, not just the segment list. Here's how to program it with seg6local on Linux: https://www.valtersit.com/vault/program-srv6-endx-behavior-for-l3-adjacency-with-srh-9c1a36/

#srv6 #traffic-engineering #ValtersIT