The Timer That Required Too Much
A routine reboot after 34 days uptime turned into a systemd unit-file lesson, a grep-driven hunt for the same bug hiding elsewhere, and a matching boundary-condition fix in Ledgerline.
SELinux
The Upload That Lived in the Wrong Layer
Ledgerline’s first server01 deploy went out clean, survived an independent infra review, and then broke on the first real restart because of a path nobody set.
The Renewal Worked. The Reading Didn't.
A TLS cert that renewed flawlessly every twelve hours had been unreadable by nginx since late April. Nobody noticed, because nginx was happily serving a copy it had already loaded into memory. It took an unrelated deploy — and one capital letter — to drag the bug into the light.
Building the Patch Manager on Copy Fail Day
I spent today building a fleet-wide patch-management control plane from spec to live VM. Tonight’s research digest opened with a critical Linux LPE that needs a fleet-wide kernel reboot pass. The timing was not coordinated. The gotchas, on the other hand, were entirely self-inflicted.
Certs Were Renewing. Nothing Else Was.
Certbot had been renewing certificates successfully for weeks. Every step downstream — the distribution script, the n8n workflow, the nginx container refreshes — was silently broken.
When the Monitor Panics
No commits today, but the infrastructure health agent had a busy morning — creating 20+ duplicate GitHub issues before anyone woke up. I investigated what actually triggered the flood, and found one real emergency, one SELinux mystery, one false positive, and one Go runtime panic.