networking
Overlay meshes, routing, MTU, and the layers that fail quietly.
-
Prometheus HTTP Service Discovery Backed by a Live Inventory
A static Prometheus targets file is correct on the day someone last edited it and wrong every day after that infrastructure changes. This walks through Prometheus's HTTP service discovery mechanism, backed by a live inventory rather than a file, with a complete example that runs on a laptop.
-
Forward Auth: Putting Real Authentication in Front of Software That Has None
Legacy admin panels, monitoring dashboards and device UIs frequently have no login of their own, yet they are exactly the systems you least want exposed. Forward auth lets a reverse proxy ask an external service, on every request, whether the caller may proceed, without changing a line of the backend. Here is the subrequest protocol, the header-spoofing mistake that undermines it, and a complete Traefik plus Keycloak stack that enforces it.
-
WireGuard Route Selection: Per-Host /32 Versus Subnet Routes With NAT
WireGuard's AllowedIPs sets both which packets a peer may send and which route the kernel installs for it, and overlapping AllowedIPs resolve by longest-prefix-match rather than by which peer you meant. This walks through a reproducible case where that silently breaks the return path, and how to make the route explicit on both ends.
-
Group-Based Default-Deny Instead of Hand-Maintained Peer Lists
Per-peer VPN rules accumulate one exception at a time until nobody can say who is allowed to reach a given service. This article builds a NetBird policy set around groups instead of peer addresses, replaces the default allow-all policy with default-deny, and shows a script that checks the resulting access matrix against what the policy set claims to allow.
-
Overlay Mesh Networking with NetBird: Peer Addressing and the Public DNS Fallthrough
An overlay mesh gives every machine a stable address and a direct encrypted path to every other one, replacing a hub-and-spoke VPN. It also gives internal hostnames a silent way to resolve to the wrong place the moment the mesh resolver is not in the loop. This walks through why, and includes a runnable DNS setup that reproduces the fallthrough and the one-line fix that closes it.
-
How a VPN Client Silently Shrinks Your Pod Network MTU
A CNI that auto-detects MTU from the node's default-route interface bakes in that value once, at start-up, and never revisits it. When a VPN client later puts a lower-MTU hop in the path, the mismatch fails silently rather than with an error, and this article shows how to reproduce, diagnose and fix it.
-
ndots and the Accidental Search-Domain Leak in Pod DNS
Kubernetes gives every pod a DNS search list and ndots:5 by default, which is usually harmless. Add a custom internal domain to that search list and it stops being harmless: an ordinary external hostname can resolve through the internal domain's own records before it is ever tried as written. Here is why, and three ways to close it off.
-
Runtime Configuration for an Angular Container Without Rebuilding
A frontend that reads its backend URL from an environment variable at build time needs a full rebuild for every deployment target, which defeats the point of building an image once. This article generates the frontend's runtime configuration from a container-start entrypoint instead, with a complete Dockerfile and compose setup that proves one image serves two different backends without being rebuilt.
-
Powering and Discovering Peripherals over PoE with Multicast Announcements
Running separate power cabling to every sensor multiplies installation cost, and without some form of discovery, every new module has to be manually addressed and registered before anything can use it. This covers what Power over Ethernet actually buys you, and builds a small multicast-based announcement protocol so peripherals can be plugged in and found automatically, with a working announcer and collector you can run in two containers.