Blog

Practical guides for running a small app on one server: deploys that drop no requests, backups you can restore, Postgres recovery, Go services and webhook receivers. Every article has working commands and real use cases.

Deploys and releases · 10 min read

Zero-downtime deploys on one VPS with Caddy and pm2

Run two copies of a Node app on two ports, health-check the new one, then switch Caddy to it. Commands, the pm2 symlink trap, and measured failed requests.

Backups and recovery · 8 min read

How to write a restore runbook you can follow at 3 a.m.

A fill-in restore runbook template for one VPS covering who does what, the order of steps, RTO and RPO in plain words, and how to drill it until it works.

Webhooks · 9 min read

Webhook signature checks that fail or quietly pass in Go

Avoid the mistakes that break or weaken webhook signature checks in Go, and see how GitHub, Stripe and Standard Webhooks differ in practice.

Webhooks · 8 min read

A durable webhook retry queue in SQLite

Build a webhook job queue on one SQLite table: claim work with leases, retry with jittered backoff, dead-letter poison events and replay them safely.

Webhooks · 9 min read

Webhook idempotency and dedupe for SQLite and Postgres

Handle at-least-once webhook delivery safely: pick event ids, use unique constraints, size the dedupe window and make side effects run once.

Webhooks · 8 min read

Verify Standard Webhooks (Polar) signatures in Go

Write a dependency-free Go verifier for Standard Webhooks signatures as used by Polar, with secret rotation, replay protection and a known-answer test.

Packaging and releasing CLIs · 10 min read

Verify a downloaded binary: checksums, GPG, minisign, cosign

Learn what sha256sum, GPG, minisign and cosign each protect against, how to verify a release by hand, and how an installer should chain the checks.

Deploys and releases · 8 min read

systemd or pm2 for a small Node app on one VPS?

Compare systemd and pm2 for one Node app on one server: the pm2 symlink trap, restart after a crash, secrets, memory limits, logs, and which we pick.

Deploys and releases · 9 min read

What a plain systemctl restart costs a Go service under load

We sent 20 requests per second through Caddy while restarting a Go service. About one in four failed. Measure your own restart, then pick a fix that fits.

VPS operations · 10 min read

SSH, ufw and fail2ban basics for a single VPS

Which sshd_config options matter, how to write ufw rules, and how to set up a fail2ban jail, with a plain account of what each layer does and does not stop.

Deploys and releases · 9 min read

systemd socket activation: no dropped requests, but a cost

Socket activation let a Go service restart without refusing a connection, but slow requests waited over five seconds. Setup, code, and when to use it.

Deploys and releases · 9 min read

Roll back a bad deploy in a minute with release folders

Keep each release in its own directory behind a current symlink, switch atomically, prune old ones, and roll back with one command, including the database caveat.