Production server work, written down.
These guides come from running production servers for small businesses, and they include what went wrong and what it cost. If a guide would only repeat the vendor documentation, it is not here. We check each technical claim against primary sources and run the commands in a test environment before publishing.
How to secure a VPS you just bought
The eleven things worth doing on day one, in order of how much risk each one removes.
BackupsBackups that actually restore
The four ways small-business backups fail at the moment they are needed, and how to prove yours does not.
ComplianceFile integrity monitoring for a small online store
What PCI DSS Requirement 11.5.2 asks for in practice, which paths matter, and how to keep the alerts readable.
BackupsA restic repository on Backblaze B2 keeps growing
B2 cannot disable versioning and the recommended lifecycle rule does not keep pace with restic. Includes what Backblaze confirmed when we escalated it.
BackupsBackblaze B2 Object Lock with restic
restic keeps working under Object Lock, but cannot set or extend locks. Covers what that protects, what it costs and how to restore after an attack.
BackupsRestic vs Borg for a small-business server
Backends, append-only, keys, pruning and the Borg 2 beta, tested side by side, with a matrix for when to pick each.
Backupsresticprofile in production, explained
A complete server and admin-host configuration, run for real: schedules, database dumps, retention that cannot be gamed, and the traps.
SecurityWazuh pricing: free to licence, not free to run
The cost of Wazuh on 1 to 10 Linux servers: Cloud list prices, hardware, and the recurring work nobody quotes.
PatchingKernel live patching on Debian, Ubuntu, RHEL and SUSE
How it works, what it cannot fix, the real option on each distribution, and why Debian ships no live patches of its own.
PatchingUnattended upgrades not upgrading
Ten checks in diagnostic order, each reproduced on Debian 13 and Ubuntu 24.04: timers, origins, holds, phasing, locks and reboots.
HardeningFail2ban vs CrowdSec
What each one blocks, what CrowdSec shares by default, and why neither matters much for SSH on a private network.