Tag
Security and privacy, in practice
For a month my Keycloak admin console was one HTTPS request from anyone. How I closed it at the Traefik edge, opened a loopback-only door over SSH, and the details that decide whether the tunnel works or locks you out.
Security and privacy, in practice
A logging-only honeypot on my Hetzner box: an unprivileged user, a systemd sandbox with one non-obvious trap that silences it, and fail2ban to turn every knock into a self-expiring firewall ban.
Running the box: Docker, Linux, the JVM
My production Postgres publishes no port at all, and I still open it in DBeaver from my laptop. The one-line ssh -L everyone reaches for connects happily and then refuses every query — for a reason that's easy to miss, and eight bytes that prove when you've actually fixed it.