Category
9 posts
5 posts
How my OpenVPN fallback on TCP 443 is configured, why tls-crypt made it stop answering scanners, how I build client profiles, and the steps for adding and revoking a client.
Building a new certificate authority for my OpenVPN fallback with easy-rsa, choosing validity periods, staging the files with strict permissions, and replacing 150 lines of inlined certificates with five directives.
Adding one phone to my OpenVPN fallback revealed that the private key of the old certificate authority no longer existed anywhere. How I searched for it, and the 30-second check that proves whether a certificate and a key belong together.
How I set up a minimal VPN gateway with two open ports, SSH only on the internal network, a login account without sudo and a default-deny nftables firewall that fits on one screen.
The first post in my Owning the Edge series. The VPN into my servers broke in three ways at once, so instead of repairing a box I did not control, I built my own gateway, internal network and DNS from scratch.
2 posts
An in-process cron scheduler with a generation token, a promise lock, and soft-delete reconciliation — plus the drift panel that turns destructive sync into a recoverable operation.
Designing an Express + Better Auth service where deactivated users cannot sign in even when the database is down, tokens die on role change, and audit logging can never block a login.
1 post
When a model answers over private knowledge, the answer must never leak what it used. How to scrub IRIs, UUIDs, and query fragments across streaming chunk boundaries, and how to project provenance as an allowlist.
1 post
The small but sharp security machinery behind an API endpoint: in-memory token buckets, peppered SHA-256 with constant-time comparison, and deterministic session namespacing.