Starlab bloghttps://starlab.io.vn/blog/Scripts, Go services and handbooks for running a small app on one VPS: deploys that drop no requests, backups you can restore, a Go webhook receiver.en Zero-downtime deploys on one VPS with Caddy and pm2https://starlab.io.vn/blog/zero-downtime-deploys-one-vps/https://starlab.io.vn/blog/zero-downtime-deploys-one-vps/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesRun two copies of a Node app on two ports, health-check the new one, then switch Caddy to it. Commands, the pm2 symlink trap, and measured failed requests. How to write a restore runbook you can follow at 3 a.m.https://starlab.io.vn/blog/write-a-restore-runbook/https://starlab.io.vn/blog/write-a-restore-runbook/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoveryA fill-in restore runbook template for one VPS covering who does what, the order of steps, RTO and RPO in plain words, and how to drill it until it works. Webhook signature checks that fail or quietly pass in Gohttps://starlab.io.vn/blog/webhook-signature-pitfalls/https://starlab.io.vn/blog/webhook-signature-pitfalls/Mon, 09 Nov 2026 00:00:00 +0000WebhooksAvoid the mistakes that break or weaken webhook signature checks in Go, and see how GitHub, Stripe and Standard Webhooks differ in practice. A durable webhook retry queue in SQLitehttps://starlab.io.vn/blog/webhook-retry-queue-sqlite/https://starlab.io.vn/blog/webhook-retry-queue-sqlite/Mon, 09 Nov 2026 00:00:00 +0000WebhooksBuild a webhook job queue on one SQLite table: claim work with leases, retry with jittered backoff, dead-letter poison events and replay them safely. Webhook idempotency and dedupe for SQLite and Postgreshttps://starlab.io.vn/blog/webhook-idempotency-dedupe-patterns/https://starlab.io.vn/blog/webhook-idempotency-dedupe-patterns/Mon, 09 Nov 2026 00:00:00 +0000WebhooksHandle at-least-once webhook delivery safely: pick event ids, use unique constraints, size the dedupe window and make side effects run once. Verify Standard Webhooks (Polar) signatures in Gohttps://starlab.io.vn/blog/verify-standard-webhooks-go/https://starlab.io.vn/blog/verify-standard-webhooks-go/Mon, 09 Nov 2026 00:00:00 +0000WebhooksWrite a dependency-free Go verifier for Standard Webhooks signatures as used by Polar, with secret rotation, replay protection and a known-answer test. Verify a downloaded binary: checksums, GPG, minisign, cosignhttps://starlab.io.vn/blog/verify-downloads-checksums-signatures/https://starlab.io.vn/blog/verify-downloads-checksums-signatures/Mon, 09 Nov 2026 00:00:00 +0000Packaging and releasing CLIsLearn what sha256sum, GPG, minisign and cosign each protect against, how to verify a release by hand, and how an installer should chain the checks. systemd or pm2 for a small Node app on one VPS?https://starlab.io.vn/blog/systemd-or-pm2-small-node-app/https://starlab.io.vn/blog/systemd-or-pm2-small-node-app/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesCompare systemd and pm2 for one Node app on one server: the pm2 symlink trap, restart after a crash, secrets, memory limits, logs, and which we pick. What a plain systemctl restart costs a Go service under loadhttps://starlab.io.vn/blog/systemctl-restart-drops-requests/https://starlab.io.vn/blog/systemctl-restart-drops-requests/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesWe sent 20 requests per second through Caddy while restarting a Go service. About one in four failed. Measure your own restart, then pick a fix that fits. SSH, ufw and fail2ban basics for a single VPShttps://starlab.io.vn/blog/ssh-firewall-fail2ban-basics/https://starlab.io.vn/blog/ssh-firewall-fail2ban-basics/Mon, 09 Nov 2026 00:00:00 +0000VPS operationsWhich sshd_config options matter, how to write ufw rules, and how to set up a fail2ban jail, with a plain account of what each layer does and does not stop. systemd socket activation: no dropped requests, but a costhttps://starlab.io.vn/blog/socket-activation-not-free-lunch/https://starlab.io.vn/blog/socket-activation-not-free-lunch/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesSocket activation let a Go service restart without refusing a connection, but slow requests waited over five seconds. Setup, code, and when to use it. Roll back a bad deploy in a minute with release foldershttps://starlab.io.vn/blog/rollback-in-under-a-minute-symlink-releases/https://starlab.io.vn/blog/rollback-in-under-a-minute-symlink-releases/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesKeep each release in its own directory behind a current symlink, switch atomically, prune old ones, and roll back with one command, including the database caveat. When a restore succeeds and hands you the wrong datahttps://starlab.io.vn/blog/restore-succeeded-wrong-data/https://starlab.io.vn/blog/restore-succeeded-wrong-data/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoveryRestores that exit 0 can return old, empty or partial data. Learn six ways it happens and how to check row counts and freshness so a restore proves itself. Restore PostgreSQL to a timestamp with recovery_target_timehttps://starlab.io.vn/blog/restore-postgres-to-a-timestamp/https://starlab.io.vn/blog/restore-postgres-to-a-timestamp/Mon, 09 Nov 2026 00:00:00 +0000Postgres and dataStep by step PITR on PostgreSQL 15 to 17 with recovery.signal, restore_command and recovery_target_time, plus timelines and how to verify the result. restic forget and prune: how the keep flags decidehttps://starlab.io.vn/blog/restic-retention-policies-explained/https://starlab.io.vn/blog/restic-retention-policies-explained/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoveryHow restic forget --keep-daily, --keep-weekly and --keep-monthly combine, what prune really deletes, and how to pick a policy and test it with --dry-run. A restic backup recipe for SQLite and Postgres on one VPShttps://starlab.io.vn/blog/restic-backup-sqlite-postgres/https://starlab.io.vn/blog/restic-backup-sqlite-postgres/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoveryBack up a small server with restic without corrupt databases, using SQLite online backup, pg_dump with roles, aborts on bad dumps and a restore test. Reproducible Go builds: build twice, compare the hasheshttps://starlab.io.vn/blog/reproducible-go-builds-two-directories/https://starlab.io.vn/blog/reproducible-go-builds-two-directories/Mon, 09 Nov 2026 00:00:00 +0000Packaging and releasing CLIsBuild the same Go commit in two directories, compare the bytes, and learn which flags and settings make the hashes match or differ. Receiving signed webhooks in Go with a durable queuehttps://starlab.io.vn/blog/receiving-webhooks-go/https://starlab.io.vn/blog/receiving-webhooks-go/Mon, 09 Nov 2026 00:00:00 +0000WebhooksBuild a webhook receiver in Go that verifies signatures, dedupes deliveries, stores events in SQLite and processes them with retries, on one VPS. PostgreSQL WAL archiving from scratch on a single Debian VPShttps://starlab.io.vn/blog/postgres-wal-archiving-from-scratch/https://starlab.io.vn/blog/postgres-wal-archiving-from-scratch/Mon, 09 Nov 2026 00:00:00 +0000Postgres and dataTurn on archive_mode, write a safe archive_command, take a pg_basebackup, and prove with pg_stat_archiver that WAL really reaches the archive. How much data a disk failure costs with WAL archivinghttps://starlab.io.vn/blog/pitr-how-much-can-you-lose/https://starlab.io.vn/blog/pitr-how-much-can-you-lose/Mon, 09 Nov 2026 00:00:00 +0000Postgres and dataWe killed a PostgreSQL server mid-write and restored from the archive alone, so you can choose archive_timeout from measured loss instead of guessing. pg_dump vs physical backup vs PITR: which to usehttps://starlab.io.vn/blog/pg-dump-vs-physical-backup-vs-pitr/https://starlab.io.vn/blog/pg-dump-vs-physical-backup-vs-pitr/Mon, 09 Nov 2026 00:00:00 +0000Postgres and dataA decision guide to logical dumps, pg_basebackup and point-in-time recovery, with a comparison table and recommendations by database size and RPO. Monitoring backups so that silence never means successhttps://starlab.io.vn/blog/monitoring-backups-so-silence-is-not-success/https://starlab.io.vn/blog/monitoring-backups-so-silence-is-not-success/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoverySet up dead-man's-switch pings, exit-code handling, snapshot age checks and failure alerts for a restic backup, so a job that stops running gets noticed. Monitor one VPS without Prometheus, Grafana or a stackhttps://starlab.io.vn/blog/monitor-one-vps-without-a-stack/https://starlab.io.vn/blog/monitor-one-vps-without-a-stack/Mon, 09 Nov 2026 00:00:00 +0000VPS operationsCron, curl and systemd are enough to catch a down app, a filling disk, low memory, an expiring certificate and a silent backup. Working scripts included. Database migrations that survive a zero-downtime deployhttps://starlab.io.vn/blog/migrations-during-zero-downtime-deploys/https://starlab.io.vn/blog/migrations-during-zero-downtime-deploys/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesUse expand and contract to change a SQLite or Postgres schema while two releases overlap, with the lock pitfalls and the safe forms of common changes. Find what filled your VPS disk and keep it from happeninghttps://starlab.io.vn/blog/journald-logrotate-disk-full/https://starlab.io.vn/blog/journald-logrotate-disk-full/Mon, 09 Nov 2026 00:00:00 +0000VPS operationsCap journald, rotate app logs, limit Docker logs, and find the culprit with du and ncdu when a small server reports no space left on device. Harden a fresh Debian VPS in the first hour, step by stephttps://starlab.io.vn/blog/harden-a-fresh-debian-vps/https://starlab.io.vn/blog/harden-a-fresh-debian-vps/Mon, 09 Nov 2026 00:00:00 +0000VPS operationsA first-hour checklist for a new Debian VPS: updates, a non-root user, SSH keys, a firewall, unattended-upgrades, swap and time sync, with real commands. Graceful shutdown for a Go HTTP server under systemdhttps://starlab.io.vn/blog/graceful-shutdown-go-http-server/https://starlab.io.vn/blog/graceful-shutdown-go-http-server/Mon, 09 Nov 2026 00:00:00 +0000Go in productionHandle SIGTERM with signal.NotifyContext, drain requests with Server.Shutdown, stop workers cleanly and set TimeoutStopSec so systemd waits long enough. A GoReleaser v2 config for a small Go CLI, line by linehttps://starlab.io.vn/blog/goreleaser-config-small-cli/https://starlab.io.vn/blog/goreleaser-config-small-cli/Mon, 09 Nov 2026 00:00:00 +0000Packaging and releasing CLIsWrite a .goreleaser.yaml for a one-binary Go CLI covering builds, archives, checksums, version ldflags and changelog, and publish to GitHub or GitLab. GOMEMLIMIT in an 80 MB container, with the numbershttps://starlab.io.vn/blog/gomemlimit-in-an-80mb-container/https://starlab.io.vn/blog/gomemlimit-in-an-80mb-container/Mon, 09 Nov 2026 00:00:00 +0000Go in productionA Go program with 40 MiB of live data was OOM-killed in an 80 MiB container. See what GOMEMLIMIT fixes, what it costs in CPU, and where the limit is soft. Go SQLite reads returning 404 for rows that existhttps://starlab.io.vn/blog/go-sqlite-stale-reads/https://starlab.io.vn/blog/go-sqlite-stale-reads/Mon, 09 Nov 2026 00:00:00 +0000Go in productionUnder load, a Go service answered 404 for rows it had just written. How we found it, the regression test that catches it, and what to check in your pool. log/slog setup for a small Go service on journaldhttps://starlab.io.vn/blog/go-slog-small-services/https://starlab.io.vn/blog/go-slog-small-services/Mon, 09 Nov 2026 00:00:00 +0000Go in productionConfigure log/slog with JSON or text output, a runtime log level, request ids on every line, secret redaction, and queries that work in journalctl. Go HTTP server timeouts that survive slow and stuck clientshttps://starlab.io.vn/blog/go-http-timeouts-slow-clients/https://starlab.io.vn/blog/go-http-timeouts-slow-clients/Mon, 09 Nov 2026 00:00:00 +0000Go in productionSet ReadHeaderTimeout, ReadTimeout, WriteTimeout and IdleTimeout correctly, add per-handler deadlines, and prove a slowloris client gets cut off. I destroyed my server on purpose and timed the recoveryhttps://starlab.io.vn/blog/destroy-your-server-recovery-drill/https://starlab.io.vn/blog/destroy-your-server-recovery-drill/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoveryScript a disaster-recovery drill for one VPS. Destroy the server, rebuild from restic, check the data, and see timings and five failures it found. Deploy health checks that catch bad releaseshttps://starlab.io.vn/blog/deploy-health-checks-that-mean-something/https://starlab.io.vn/blog/deploy-health-checks-that-mean-something/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesDesign a health endpoint and a deploy gate that reject broken releases, with readiness versus liveness, consecutive passes, and the false greens to avoid. What a curl | sh installer for a Go binary should refusehttps://starlab.io.vn/blog/curl-pipe-sh-installer-checks/https://starlab.io.vn/blog/curl-pipe-sh-installer-checks/Mon, 09 Nov 2026 00:00:00 +0000Packaging and releasing CLIsWrite an install script for a Go release that stops on a bad checksum, odd version, plain http or unknown platform, and test each refusal. Caddy or nginx for a one-person VPS stack, comparedhttps://starlab.io.vn/blog/caddy-vs-nginx-one-person-stack/https://starlab.io.vn/blog/caddy-vs-nginx-one-person-stack/Mon, 09 Nov 2026 00:00:00 +0000VPS operationsAn honest comparison of Caddy and nginx for one small server: automatic TLS, config size, what each does better, and when nginx is the right pick. Caddy blue/green config for a one-server app, line by linehttps://starlab.io.vn/blog/caddy-blue-green-config-walkthrough/https://starlab.io.vn/blog/caddy-blue-green-config-walkthrough/Mon, 09 Nov 2026 00:00:00 +0000Deploys and releasesSwitch a Caddy 2 reverse proxy between two upstream ports with a generated snippet and a graceful reload, with health checks and retry settings explained. The 3-2-1 backup rule applied to a single VPShttps://starlab.io.vn/blog/backup-3-2-1-for-one-vps/https://starlab.io.vn/blog/backup-3-2-1-for-one-vps/Mon, 09 Nov 2026 00:00:00 +0000Backups and recoveryTranslate 3-2-1 backups to one small server. See what counts as a copy, where the offsite one goes, how object storage compares with SFTP, and what it costs.