Tailscale Exit Node Logic: Why Auto-Select Fails for Security and How to Fix It
Tailscale's auto exit node optimizes for latency, not trust. Here's how auto-select compares to a pinned, dispatcher-enforced exit node on laptops.
#security
13 posts
Firewall Zone Persistence: Why firewalld Runtime Changes Vanish and How to Pin Them
firewalld runtime changes disappear on reload or reconnect, and NetworkManager can override zone bindings. Here's how to make firewall zones persist.
Trust the Tailnet, Not the Network: Automating Wi-Fi Hardening with NetworkManager Dispatchers
Treat every Wi-Fi network as hostile: a NetworkManager dispatcher that pins a locked-down firewalld zone and forces a Tailscale exit node on connect.
SealedSecrets: Storing Secrets in Git Without the Risk
How SealedSecrets lets you commit encrypted secrets to Git safely, why the real risk is losing the controller's private key, and how to back it up.
Network Policies with Calico: Default Deny and Namespace Isolation
Rolling out default-deny NetworkPolicies and namespace isolation with Calico without breaking DNS, ingress, or admission webhooks.
Agent Glass-Break Patterns: Controlled Escalation for Production
How to implement controlled escalation for AI agents using safeBins and network-level constraints to prevent production catastrophes.
Kubernetes RBAC: Building Least-Privilege Service Accounts
Moving beyond cluster-admin for everything. A practical approach to scoping ServiceAccount permissions for production workloads and AI agents.
Privacy-Routed LLM Inference: Keeping Sensitive Data Out of the Cloud
How to build a routing layer for AI agents that ensures sensitive data stays on local hardware while leveraging cloud LLMs for non-private tasks.
Kyverno Admission Controllers: Policy-as-Code That Actually Works
Moving beyond the happy path of Kubernetes policy enforcement. Real-world Kyverno pitfalls, mutation loops, and the gap between docs and production.
SealedSecrets Key Backup: Don't Lose Your Encryption Keys
How to back up and recover SealedSecrets encryption keys in Kubernetes
MQTT Broker Selection: HiveMQ vs Mosquitto for Industrial Use
Comparing HiveMQ and Mosquitto for industrial IoT: scalability, security, and reliability
Proxmox API Tokens: Bash History Expansion and the ! Character
Bash history expansion breaks Proxmox API tokens — here's how to fix it
Agent Credential Management: Two-Tier Service Accounts for Secure AI Agent Workflows
Managing agent credentials with two-tier service accounts: a secure approach for AI agent orchestration