Tag
Traces, Tempo and the LGTM stack
I added Grafana's all-in-one otel-lgtm image next to this site's Scala/Play backend: an OpenTelemetry Java agent and Traefik send OTLP to it, Keycloak gates Grafana to one email, and the collector strips query strings. Here is the setup, the guardrails, and what the first traces showed.
Security and privacy, in practice
For a month my Keycloak admin console was one HTTPS request from anyone. How I closed it at the Traefik edge, opened a loopback-only door over SSH, and the details that decide whether the tunnel works or locks you out.
Security and privacy, in practice
The cheapest security win on a single-container stack lives at the reverse proxy. Here's the four-header Traefik middleware I shipped, the two things I deliberately held back, and the report-only CSP rollout I'm lining up next.
How I added a public, server-rendered blog to a login-gated CV site without a second app or container — one jar, two hostnames, and a host-dispatch filter.