Notes on backend, infra, and the occasional bad decision
Mostly Linux, mostly networking, mostly things I had to debug at 2am.
Routing multiple TLS backends through one port with nginx stream
SNI-based routing lets a single public port forward connections to different internal services based on the hostname in the TLS handshake — no certificate termination required at the edge.
When network_mode: host actually makes sense
Bridge networking is the right default for almost everything. Here's the short list of cases where it isn't, and what breaks when you get it wrong.
Socket activation in systemd, and why your service "isn't running"
A service unit showing inactive (dead) doesn't mean it's broken — sometimes it just means systemd is waiting for the first connection before starting it.
Automating certificate renewal without taking the service down
A short writeup on standalone vs webroot authentication, and keeping a renewal hook from silently failing.
Debugging a connection that opens but never sends data
Some failures don't throw an error — the handshake completes, the socket stays open, and nothing moves. Notes on isolating where the data actually stops.