Blog

Find what filled your VPS disk and keep it from happening

Cap journald, rotate app logs, limit Docker logs, and find the culprit with du and ncdu when a small server reports no space left on device.

VPS operations · 11 min read

Harden a fresh Debian VPS in the first hour, step by step

A first-hour checklist for a new Debian VPS: updates, a non-root user, SSH keys, a firewall, unattended-upgrades, swap and time sync, with real commands.

Go in production · 10 min read

Graceful shutdown for a Go HTTP server under systemd

Handle SIGTERM with signal.NotifyContext, drain requests with Server.Shutdown, stop workers cleanly and set TimeoutStopSec so systemd waits long enough.

Packaging and releasing CLIs · 11 min read

A GoReleaser v2 config for a small Go CLI, line by line

Write a .goreleaser.yaml for a one-binary Go CLI covering builds, archives, checksums, version ldflags and changelog, and publish to GitHub or GitLab.

Go in production · 10 min read

GOMEMLIMIT in an 80 MB container, with the numbers

A Go program with 40 MiB of live data was OOM-killed in an 80 MiB container. See what GOMEMLIMIT fixes, what it costs in CPU, and where the limit is soft.

Go in production · 9 min read

Go SQLite reads returning 404 for rows that exist

Under load, a Go service answered 404 for rows it had just written. How we found it, the regression test that catches it, and what to check in your pool.

Go in production · 10 min read

log/slog setup for a small Go service on journald

Configure log/slog with JSON or text output, a runtime log level, request ids on every line, secret redaction, and queries that work in journalctl.

Go in production · 10 min read

Go HTTP server timeouts that survive slow and stuck clients

Set ReadHeaderTimeout, ReadTimeout, WriteTimeout and IdleTimeout correctly, add per-handler deadlines, and prove a slowloris client gets cut off.

Backups and recovery · 8 min read

I destroyed my server on purpose and timed the recovery

Script a disaster-recovery drill for one VPS. Destroy the server, rebuild from restic, check the data, and see timings and five failures it found.

Deploys and releases · 10 min read

Deploy health checks that catch bad releases

Design a health endpoint and a deploy gate that reject broken releases, with readiness versus liveness, consecutive passes, and the false greens to avoid.

Packaging and releasing CLIs · 10 min read

What a curl | sh installer for a Go binary should refuse

Write an install script for a Go release that stops on a bad checksum, odd version, plain http or unknown platform, and test each refusal.

VPS operations · 9 min read

Caddy or nginx for a one-person VPS stack, compared

An honest comparison of Caddy and nginx for one small server: automatic TLS, config size, what each does better, and when nginx is the right pick.