Articles

Standalone write-ups of methods we use on client work: the problem in general terms, the pattern, the code and the traps.

• Upgrading Postgres a major version inside Docker Swarm

  A step-by-step runbook for moving a Postgres service in a Docker Swarm stack to a new major version by dump and restore, with a rollback that keeps the old data directory intact.

• Free CVE and end-of-life checks for a server fleet, and five traps

  Ansible, endoflife.date and the NVD API can tell you which servers run end-of-life software and which versions have known CVEs, provided you avoid five traps that make a naive check report a fleet as clean when it is not.

• Pin the digest: why Swarm ran the previous build

  When a Docker Swarm deploy reuses one tag per environment, a service can restart onto the image a node already had, and handing Swarm the image digest removes that ambiguity.

• Verified Postgres TLS when no host chains to a public root

  If your app connects to Postgres with rejectUnauthorized: false, the connection is encrypted but the server's identity was never checked. Here is how to turn verification on when the certificate is signed by a private CA, without taking production down.

• Silent zeros: four times a pipeline said success and was not

  A batch job that crashes is easy to deal with: something goes red and someone looks. The harder case is a job that runs, exits 0, posts a green tick, and produced nothing, or produced yesterday's data again, or checked nothing at all. We call these silent zeros.

• A destroy gate for Terraform on GitHub's free plan

  If your pipeline can apply Terraform, it can delete things, and this is how to make every deletion and every replacement need its own explicit approval using only what a free GitHub plan provides.

• Records that stop anyone sending mail as your parked domains

  A domain that publishes no mail policy can be put in anyone's From: line, and four DNS records close that gap for every domain you own but do not use for mail.

• Keep the last N backups in S3 when Lifecycle cannot

  S3 Lifecycle can delete backups older than 30 days, but it cannot keep "the newest seven", and the difference shows up on the day your backups stop arriving.

• Crash forensics for a cloud VM in one Ansible run

  A read-only Ansible playbook, written once and run the moment a failed VM comes back, collects the evidence for the usual causes before it rotates away, and on a client's production server it pointed to CPU-credit throttling.