Guides

Production server work, written down.

These guides come from running production servers for small businesses, and they include what went wrong and what it cost. If a guide would only repeat the vendor documentation, it is not here. We check each technical claim against primary sources and run the commands in a test environment before publishing.

Hardening

How to secure a VPS you just bought

The eleven things worth doing on day one, in order of how much risk each one removes.

Backups

Backups that actually restore

The four ways small-business backups fail at the moment they are needed, and how to prove yours does not.

Compliance

File integrity monitoring for a small online store

What PCI DSS Requirement 11.5.2 asks for in practice, which paths matter, and how to keep the alerts readable.

Backups

A restic repository on Backblaze B2 keeps growing

B2 cannot disable versioning and the recommended lifecycle rule does not keep pace with restic. Includes what Backblaze confirmed when we escalated it.

Backups

Backblaze B2 Object Lock with restic

restic keeps working under Object Lock, but cannot set or extend locks. Covers what that protects, what it costs and how to restore after an attack.

Backups

Restic vs Borg for a small-business server

Backends, append-only, keys, pruning and the Borg 2 beta, tested side by side, with a matrix for when to pick each.

Backups

resticprofile in production, explained

A complete server and admin-host configuration, run for real: schedules, database dumps, retention that cannot be gamed, and the traps.

Security

Wazuh pricing: free to licence, not free to run

The cost of Wazuh on 1 to 10 Linux servers: Cloud list prices, hardware, and the recurring work nobody quotes.

Patching

Kernel live patching on Debian, Ubuntu, RHEL and SUSE

How it works, what it cannot fix, the real option on each distribution, and why Debian ships no live patches of its own.

Patching

Unattended upgrades not upgrading

Ten checks in diagnostic order, each reproduced on Debian 13 and Ubuntu 24.04: timers, origins, holds, phasing, locks and reboots.

Hardening

Fail2ban vs CrowdSec

What each one blocks, what CrowdSec shares by default, and why neither matters much for SSH on a private network.