linux
The operating system underneath everything: permissions, systemd, sysctl, and the parts that bite.
-
I Reverse-Engineered My Smart Ring BLE Protocol Clean-Room
COLMi R02, Realtek RTL8762E, BLE from Linux and a Pixel 10a. 16-byte framing, an unenforced checksum, and a clean-room method with evidence levels.
-
Multicast Service Discovery on a Host With a WireGuard Interface
"Required key not available" (ENOKEY) on multicast sendto: kernel WireGuard has no peer for 239.0.0.0/8. Filter interfaces on IFF_MULTICAST and IFF_POINTOPOINT.
-
The NTP Clock Jump That Made the Scheduler Skip a Week of Measurements
time.time() vs time.monotonic() in a Python scheduler: a backwards NTP step delayed runs by nine days. Monotonic durations and a jump-injecting test.
-
kube-proxy in iptables Mode and Native nftables Rules in the Forward Chain
kube-proxy iptables-nft sync silently aborts on native nftables rules a mesh agent adds to the FORWARD chain. Fix: nft delete rule by handle, ip and ip6.
-
From a Large Allowlist to Three Denials: Permissions for a Coding Agent
bwrap --unshare-net --cap-drop ALL instead of a command allowlist: sandboxing a coding agent's shell so rm -rf and curl cannot leave the workspace.
-
Host Probes via the Textfile Collector Pattern
node_exporter --collector.textfile.directory: torn .prom writes fixed by write-temp-then-rename, and stale files caught with a last-run timestamp alert.
-
WireGuard Route Selection: Per-Host /32 Versus Subnet Routes With NAT
WireGuard AllowedIPs overlap: a /24 on a gateway peer and a /32 on a direct peer break the return path. Longest-prefix-match and a /32 on both ends.
-
Overlay Mesh Networking with NetBird: Peer Addressing and the Public DNS Fallthrough
NetBird mesh hostnames resolve to the public host via a zone wildcard when the mesh resolver is down. Fix: a *.mesh blackhole record and accept-new.
-
Auto-Unsealing Vault Without Cloud KMS or a TPM, Using Tang and Clevis
clevis encrypt sss with Tang pins to auto-unseal Vault without cloud KMS or a TPM: binding Shamir key shares, a systemd unit, and the t threshold.
-
SMR Drives in a Replicated Cluster: Finding the Disk That Ruins the Pool
lsblk ZONED=none does not rule out drive-managed SMR. A 30-minute fio randwrite probe and p99 latency ratio catch the cliff before it hits a Ceph OSD.
-
Infrastructure as Code with Ansible: Making a Host Reproducible from the Repository
ansible-playbook --check --diff and a changed=0 second run as proof a host matches its repository, with a container demo that corrects a hand edit.
-
Provisioning a Single-Board Computer as an Industrial Edge Node
/proc/device-tree/model read by Ansible to load board-revision vars via include_vars with_first_found, with a generic fallback and a container test.
-
chmod -R and the setgid Bit: Why a Four-Digit Mode Is Not Enough
chmod -R 775 clears the setgid bit of 2775 directories, so new files lose the shared group. Separate find -type d and -type f, and assert with stat -c %a.
-
Docker Registry Credentials for Two Local Users on One Host
"may require 'docker login'" for a deploy user after root logged in: credentials live in each user's ~/.docker/config.json. Per-user login with Ansible.
-
Reasserting Kernel Sysctls That Docker Silently Reverts
net.ipv4.ip_forward = 1 although sysctl.d says 0: dockerd rewrites it at start. A oneshot unit After=docker.service reruns sysctl --system.
-
Migrating the SSH Port Mid-Playbook Without Locking Ansible Out
Ansible meta: reset_connection after changing the sshd Port: validate with sshd -t, flush_handlers, and ping before closing the old port.