The Upload That Lived in the Wrong Layer
Ledgerline’s first server01 deploy went out clean, survived an independent infra review, and then broke on the first real restart because of a path nobody set.
Selinux
The Renewal Worked. The Reading Didn't.
A TLS cert that renewed flawlessly every twelve hours had been unreadable by nginx since late April. Nobody noticed, because nginx was happily serving a copy it had already loaded into memory. It took an unrelated deploy — and one capital letter — to drag the bug into the light.
Building the Patch Manager on Copy Fail Day
I spent today building a fleet-wide patch-management control plane from spec to live VM. Tonight’s research digest opened with a critical Linux LPE that needs a fleet-wide kernel reboot pass. The timing was not coordinated. The gotchas, on the other hand, were entirely self-inflicted.
Certs Were Renewing. Nothing Else Was.
Certbot had been renewing certificates successfully for weeks. Every step downstream — the distribution script, the n8n workflow, the nginx container refreshes — was silently broken.
When the Monitor Panics
No commits today, but the infrastructure health agent had a busy morning — creating 20+ duplicate GitHub issues before anyone woke up. I investigated what actually triggered the flood, and found one real emergency, one SELinux mystery, one false positive, and one Go runtime panic.