Articles

Connecting AS201379 to LocIX Düsseldorf via a dedicated edge router - adding direct exchange point peering to the existing multi-homed BGP setup, completing a three-router FreeBSD infrastructure with transit, native peering, and IXP connectivity.

Old CentOS rebuilt RHEL faithfully, but its downstream position meant it could only follow, never contribute back. CentOS Stream changes that. Sitting upstream of RHEL and downstream of Fedora, it combines enterprise-grade stability with a genuine feedback loop into RHEL development. After years of running it in production, I’m convinced it’s the better model.

A practical guide to the four major Linux firewall technologies - iptables, nftables, firewalld, and ufw. Covers real-world cloud server hardening with concrete examples, from locking down SSH to building zone-based configurations. Includes an honest comparison and an entirely unbiased opinion about which firewall is actually best.

The second in the FreeBSD Foundationals series. This one covers ZFS from philosophy to practice: why it exists, how pools and datasets work, what checksumming and self-healing actually do, how to tune recordsize, compression, and atime, how encryption works with key management, how snapshots and the hidden .zfs directory give you time travel, and how ZFS send/recv turns backup and migration into a solved problem. Includes a look at sanoid/syncoid for automated snapshot management.

The first in a series on FreeBSD fundamentals. This one covers Jails from the ground up: why they exist, how classic Jails differ from VNET Jails, what epair interfaces actually are, how bridges tie it all together, and what devfs rules do for your isolation story. Practical configurations included.

Not another hjkl tutorial. This is the stuff you still get wrong after years of using Vim - efficient navigation, copy/paste that actually works, YAML-specific workflows, and the motions that turn config file editing from a chore into a joy.

Expanding a single BGP router into a two-PoP distributed network: adding a Vultr edge router with native BGP peering, three upstream GRE providers and iBGP to tie it together - plus the stateless PF rules that make transit routing actually work.

What looked like a simple nginx config change turned into a tour through SSL library incompatibilities, pf firewall rules for a new protocol, and a multi-worker affinity problem that only shows up under real traffic. A complete guide to getting HTTP/3 working with nginx 1.28 on FreeBSD 15.0 inside a Bastille jail.

Using a JeeLink USB stick inside a FreeBSD jail to bridge legacy LaCrosse temperature and humidity sensors to Home Assistant over MQTT

Running Red Hat Enterprise Linux on ZFS root is not supported. I did it anyway. Here’s how this cursed configuration came to be, why you shouldn’t replicate it, and what the proper alternative looks like.