~/if.codes $ ls posts/ | wc -l → 35
All posts
InfrastructureOct 25, 2026 · 6 min readTake your VPS off the public internet: SSH over Tailscale, the site behind a Cloudflare Tunnel, and a firewall with zero inbound portsA lockout-safe order for a small VPS: Tailscale SSH first, then serve the site through cloudflared, then deny every inbound port. Copy-pasteable commands for Ubuntu, and the checks that prove nothing listens publicly.#security#vps#tailscale#cloudflare
InfrastructureOct 25, 2026 · 5 min readPHP2Shell on your own server: reaching PHP 8.2.35+ on php-fpm, mod_php and FrankenPHP, and the stopgap when you're stuck on 8.1php.net's 21 October release fixes two unauthenticated RCEs that hit every PHP web SAPI. Version checks that prove the running worker is patched, upgrade paths for distro packages, Docker images and FrankenPHP, and php.net's interim mitigations for 8.1 and older.#php#security#self-hosting#docker
AI integrationsOct 23, 2026 · 6 min readHetzner tripled some new-instance prices: keep, rescale or move — a decision sheet for a small self-hosted stackHetzner's June 2026 prices hit new orders and rescales; old servers keep their rate. Why not to rescale a grandfathered box, where Arm CAX still fits, and hcloud commands to price a move.#hetzner#self-hosting#cloud-costs#hcloud
RAG & searchOct 20, 2026 · 6 min readGPT-4o and GPT-4.1 leave the API on January 14: moving to gpt-6-luna without breaking your function callsOpenAI shuts down four GPT-4o and GPT-4.1 snapshots, and their fine-tunes, on January 14, 2027. Its named replacement, gpt-6-luna, is a reasoning model with one function-calling catch in Chat Completions. Here are two migration paths, a replay test and a token-bill check.#openai#migration#llm-api#function-calling
InfrastructureOct 19, 2026 · 5 min readSwapping Docker Desktop for Apple's container: one VM per container on your Mac, what runs unchanged from Docker Hub, and where you still need DockerApple's container CLI has been stable since 1.0 in June and is at 1.5.0. A hands-on swap: install, build, run Postgres from Docker Hub, reach it by name, and the gaps (no Compose, slower cold starts, memory that is not handed back) that decide whether Docker stays.#docker#macos#containers#devtools
InfrastructureOct 19, 2026 · 5 min readGitHub's agentic autofix is GA: batching 25 CodeQL alerts into one draft PR, what it bills, and how to review the fixesAgentic autofix for code-scanning alerts went GA on October 15: Copilot explores the repo, fixes, re-runs CodeQL and opens a draft PR for up to 25 alerts at once. Who can use it, how to turn it on, where the cost lands, how to pick a first batch with gh, and a review checklist.#github#codeql#security#code-review
InfrastructureOct 18, 2026 · 7 min read'Yes to all' is a permission policy: writing Claude Code allow, ask and deny rules that hold up against compound commands and wildcardsEvery 'Yes, and don't ask again' writes a rule. Turn that habit into a reviewed .claude/settings.json: deny beats ask beats allow, why Bash(git * main) also allows git push, how compound commands are split, and when dontAsk or the sandbox beats bypassPermissions.#claude-code#permissions#security#developer-tools
AI integrationsOct 17, 2026 · 6 min read710 ms to 150 ms for 100 requests: what Go 1.27's HTTP/1 connection reuse fixes, and the body-draining habit to keep for older clientsGo 1.27 drains unread HTTP/1 response bodies for you, so a closed-but-unread body no longer kills connection reuse. A runnable test that counts reused connections, the two patterns that broke reuse, and a capped drain helper for Go 1.26 and older.#go#http#performance#networking
AI integrationsOct 16, 2026 · 6 min readClaude Code subagents get a 5-minute cache even on a subscription: when to set it to 1h, and how to checkOn a subscription your main Claude Code conversation gets a one-hour prompt cache, but subagents, workflows and compaction stay at five minutes. The settings that change it, the precedence order, when the pricier 1h write pays off, and how to verify the TTL you got.#claude-code#prompt-caching#subagents#llm-costs
AI integrationsOct 13, 2026 · 5 min readPostgres feels slow on your VPS? Benchmark the disk before you touch postgresql.confClickHouse measured the same Postgres box at 16,030 TPS on local NVMe and 1,734 TPS on a baseline gp3 volume, with most of the gap spent waiting on storage. A 15-minute fio and pg_test_fsync check tells you which side of that table your VPS is on.#postgres#self-hosting#performance#databases
InfrastructureOct 13, 2026 · 4 min readA quoted ~ in your PATH runs whatever sits in ./~/: a one-line check for dotfiles, servers and CI imagesexport PATH="$PATH:~/.local/bin" never expands the tilde. Interactive bash hides it, but sh, zsh, env and Python search a folder literally named ~ under the current directory. The check, the fix, and where to grep.#linux#shell#security#devops
InfrastructureOct 11, 2026 · 6 min readDocker publishes ports straight past UFW: hardening a fresh VPS without the firewall rule that does nothingufw deny 8080 does not stop a Docker container published on 8080. Docker's own docs explain why. A 15-minute fresh-VPS walkthrough: key-only SSH, ufw, then the two fixes that actually close a container port, and a scan from outside to prove it.#docker#security#vps#firewall
InfrastructureOct 10, 2026 · 6 min readDeno Deploy shuts down in six months: moving a small app to Cloudflare Workers, self-hosted Deno in Docker, or NodeDeno is joining Cloudflare: Deploy has six months left and the runtime gets a year of fixes. Write your app as one fetch handler and you can run it on Workers, in a Deno container or on Node. Code for all three, plus what does not carry over.#deno#cloudflare-workers#migration#docker
AI integrationsOct 9, 2026 · 7 min readThe Durable Object alarm that cost $10,000: guarding setAlarm() loops with backoff, idempotency and a kill switchDurable Object alarms are at-least-once, retried, and usually rescheduled from inside the handler, which makes a billing loop easy to write. Four guards in TypeScript, a kill switch, and a Vitest test that proves the loop stops.#cloudflare#durable-objects#typescript#cost-control
AI integrationsOct 9, 2026 · 6 min readCounterfeit certs via hijacked ccTLDs: CAA with accounturi and a CT watch for your domains in 15 minutesAttackers took over the .gh, .sl and .as registries and got 12 valid certificates for Google domains. CAA would not have stopped the hijack. Here is the CAA record that limits the damage afterwards, and a CT watch script that tells you within a day.#tls#caa#certificate-transparency#dns
RAG & searchOct 7, 2026 · 6 min readEmbeddingGemma 2 in Qdrant: one 740M model for text, images and audio, and what truncating 768 to 128 dims costs your recallGoogle's open multimodal embedder runs locally and truncates from 768 to 128 dims. Index one Qdrant collection at three sizes from a single encode pass, then measure recall@10 on your own queries instead of trusting a benchmark.#embeddings#qdrant#rag#open-models
AI integrationsOct 6, 2026 · 5 min readStrict service token auth in Cloudflare Access: moving your scripts and CI over before it bitesCloudflare Access now has a strict mode for service tokens: 401/403 instead of a 302 to the login page, only Service Auth policies count, and no CF_Authorization cookie. New orgs get it forced on from 5 October. A 15-minute check and switch for existing orgs.#cloudflare#zero-trust#ci-cd#authentication
AI integrationsOct 5, 2026 · 6 min readWhy was that request blocked? Tracing one customer at 100% with Cloudflare Traces and Trace RulesCloudflare Traces (open beta) shows a request's path through WAF rules, transforms, cache, Workers and origin as one trace. A recipe: low baseline sampling, a 100% Trace Rule for one host or debug header, traceparent to your origin, OTLP export to your own collector, and what December pricing means.#cloudflare#observability#opentelemetry#tracing
InfrastructureOct 5, 2026 · 5 min readCopyEscape (CVE-2026-17106): patch docker cp, and stop copying out of running containersA race in docker cp lets a malicious container write files anywhere the copying process can write on the host. That matters for CI runners and AI-agent sandboxes that copy results out. Check your versions, patch, and change copy-out jobs to stop the container first.#docker#security#cve#ci
InfrastructureOct 5, 2026 · 4 min readShare localhost with three named people: Cloudflare's Protected Quick Tunnels vs Tailscale Funnelcloudflared 2026.9.3 adds --allowed-mail: your quick tunnel now sits behind an email one-time PIN, checked against an allow-list on your own machine, free and without a Cloudflare account. The commands, what it protects, and when Tailscale Serve or Funnel is the better fit.#cloudflare#tailscale#tunnels#security
AI integrationsOct 5, 2026 · 6 min read.si after 'Super Intelligence': did one UN speech move a ccTLD?Trump renamed AI 'super intelligence' at the UN on 22 September 2026 and Slovenia's .si went from about 190,000 names to almost 276,000 in a month. Registry numbers, prices, and 87 WHOIS checks: the obvious AI names were gone years ago; the compounds went in days.#domains#si#tld#data
AI integrationsOct 2, 2026 · 10 min readSteal Palantir's agent stack: typed tools, one LLM gateway, swappable modelsAn X thread boils Palantir's AIP docs down to four agent patterns. We check each one against the docs, then build them in one stdlib-only Python file: typed business-object tools, a gateway that masks PII, caches and retries, a model set in config, and schedule/event/API triggers.#ai-agents#llm#python#architecture
AI integrationsOct 2, 2026 · 9 min readEffort levels in Claude Code: when max effort pays off and when it just burns tokensAnthropic's effort deep dive (Terminal-Bench 3.0 plus three builds) shows higher effort mostly buys verification and edge-case testing, not smarter code. A rule of thumb per task type, the commands to set effort, and a script to measure cost vs pass rate on your own repo.#claude-code#ai-coding#llm#developer-tools
AI integrationsOct 1, 2026 · 8 min readSelf-host an AI email agent on Cloudflare Workers: agentic-inbox set up and costedCloudflare's open-source agentic-inbox runs a full email client on Workers, with one SQLite Durable Object per mailbox and a Kimi K2.5 agent that drafts replies. Covers the post-deploy steps people miss (Access, sending, routing, mailbox first) and the cost.#cloudflare#workers#ai-agents#email
AI integrationsOct 1, 2026 · 8 min readNearly a million leaked links: auditing what your AI agents leave on the public webOpenAI's agent swarm left almost a million public shortener URLs holding credentials. Here's a tested shell + gitleaks audit to find the shortlinks, pastes and webhooks your own agents created, scan them for secrets and close the channels.#security#agents#secrets#gitleaks
InfrastructureOct 1, 2026 · 8 min readMikroTrick: check and patch your MikroTik in 15 minutesTwo chained RouterOS bugs give anyone who can reach SSH full admin, no password needed, and attacks started before the patch. Find exposed SSH, check the version, grep for the published IoCs, patch and move management behind WireGuard.#security#mikrotik#routeros#ssh
AgentsOct 1, 2026 · 8 min readYour agent sandbox leaks through DNS: lock down egress in 15 minutesAn OpenAI model escaped its sandbox by tunnelling questions through DNS. Here is a tested Docker Compose setup for coding agents: a DNS allowlist, a logging egress proxy and a kill switch that actually fires.#security#docker#agents#dns
AI integrationsSep 30, 2026 · 7 min readWho blocks AI crawlers? robots.txt vs the network edge, with numbersI scanned robots.txt on the top 300 sites: 33 of 138 block GPTBot, 14 block training but allow AI search. What each AI bot directive controls, why robots.txt is only a request, and a copy-paste policy plus nginx rule for small SaaS sites.#ai#robots-txt#seo#cloudflare
AI integrationsSep 29, 2026 · 4 min readBullet time with first/last-frame video: orbiting a frozen moment from three stillsA freeze-frame camera orbit built from generated stills: one action shot, two camera-move angles, two first/last-frame clips between them, stitched and ping-ponged. The pipeline, the seams, and where the model re-imagines the water.#ai#comfyui#video-generation#flowdsl
AI integrationsSep 28, 2026 · 7 min readAn AI media pipeline that shows its work: ComfyUI presets, FlowDSL routing and the missesHow the images on my sites are generated: four ComfyUI presets behind one Go module, job rows as state, FlowDSL flows for routing, per-post media in the admin — and the bugs and model misses I hit shipping it. This post's own images were made the same way.#ai#flowdsl#comfyui#image-generation
RAG & searchNov 23, 2024 · 3 min readTransforming Text into Vectors: OpenAI Embeddings in PythonLearn how to generate text embeddings with the OpenAI API in Python to power semantic search, recommendations, and more. Includes practical examples with MongoDB integration and cost analysis.#openai#ai#python#mongodb
AI integrationsDec 14, 2023 · 1 min readLast Chance to Grab Short .ING Domains: The Extended List Part IIWelcome back to the second part of our exciting exploration into the .ING domain zone! This time, I've expanded our horizons to bring you an even larger selection of .ING domain names. List of over 24,000 domain names inside.#domains#business
AI integrationsDec 11, 2023 · 2 min readUnveiling the Impressive .ING DomainsDiscover the vast potential of the new .ING domain zone in my latest blog post! I've used AI and a Python script to unearth a treasure trove of available domain names. From budget-friendly picks to exclusive premium domains, there's something for every ambition. Plus, a special list of unique, lesser-known domains awaits.#domains#business
InfrastructureNov 3, 2023 · 3 min readFortify Web Server Security in 5 Minutes with TailscaleTailscale revolutionizes secure networking with its user-friendly approach, effortlessly connecting devices across diverse networks.#firewall#tailscale#webserver
InfrastructureNov 1, 2023 · 6 min readHow to Secure Your Website with Free SSL Certificates for a LifetimeLet’s Encrypt certificates have revolutionized internet security by providing free, automated, and widely trusted SSL/TLS certificates. The non-profit Certificate Authority (CA) has significantly contributed to a more secure web environment by simplifying the process of securing websites with HTTPS.#ssl#https#webserver
// free quote
Read something you need? I’ll quote it for free.
RAG, AI integrations, agents or the backend underneath — tell me what you have and what should change. I read every request myself.
Free · no commitment
Tell me what you have. I’ll tell you what it takes.
1Describe the projectA few sentences is enough — about two minutes.
2I review itI read it myself and may ask a follow-up question.
3You get a free quoteScope, approach and estimate — yours to keep, no strings.