Ever wished your AI assistant could actually remember things between conversations? Not just the current chat, but the architectural decisions you made three months ago, the patterns your team agreed on, or that obscure networking fix you discovered at 2 AM? We built exactly that, a persistent, searchable long-term memory
Say goodbye to downtime when you need more storage Running out of disk space on a production VM is stressful enough without the added headache of scheduling a reboot. The good news? If you're running Linux on VMware, you can expand your disk and have the guest OS
Preface: If you're running Jenkins in an internal datacenter and using Bitbucket Cloud for source control, you've likely hit this wall: Bitbucket can't send webhooks to Jenkins because your Jenkins server isn't publicly accessible. The typical workaround? Having Jenkins poll every repository
Monitoring HAProxy is essential for maintaining reliable load balancing infrastructure. Prometheus provides powerful metrics collection, alerting capabilities, and seamless Grafana integration for visualizing HAProxy performance and health. Why Prometheus for HAProxy? Prometheus offers: * Pull-based metrics - Prometheus scrapes HAProxy metrics endpoints * Time-series database - Store historical data for trend analysis
In dynamic environments where services scale up and down automatically, static HAProxy configurations become a management burden. Consul integration enables HAProxy to automatically discover and route traffic to healthy service instances without manual configuration updates. Why Consul + HAProxy? The combination provides: * Automatic service registration - Services announce themselves to Consul
Managing HAProxy configuration traditionally requires editing files and reloading the service. The Data Plane API transforms HAProxy into a dynamically configurable load balancer with a RESTful interface, enabling real-time configuration changes without service interruption. Why Data Plane API? The Data Plane API provides: * Runtime configuration - Add/remove backends and
Mutual TLS (mTLS) provides strong authentication by requiring both client and server to present certificates. This guide shows how to configure HAProxy for mTLS to secure API endpoints, internal services, and zero-trust networks. What is mTLS? In standard TLS, only the server presents a certificate. With mTLS: 1. Server presents
When applications misbehave behind a load balancer, HTTP headers are often the culprit. This guide shows you how to debug, inspect, and manipulate HTTP headers in HAProxy to troubleshoot web application issues. Why Header Debugging Matters HTTP headers control critical aspects of web traffic: * Client IP forwarding (X-Forwarded-For) * Protocol information
HTTPS is no longer optional - it's a requirement for modern web applications. This guide shows how to integrate HAProxy with Let's Encrypt for fully automated TLS certificate provisioning and renewal, giving you secure HTTPS without manual certificate management. Overview The integration involves: 1. HAProxy serving
DNS is critical infrastructure - when DNS fails, nothing works. This guide shows how to use HAProxy to load balance DNS queries across multiple resolvers or authoritative servers, providing high availability and improved performance for your DNS infrastructure. Why Load Balance DNS? DNS load balancing offers several benefits: * High availability:
HAProxy is one of the most powerful and reliable load balancers available. While it's often associated with HTTP load balancing, HAProxy excels at Layer 4 (TCP) load balancing for any TCP-based protocol. This guide covers everything you need to know about TCP load balancing with HAProxy. Why TCP
A well-monitored DNS infrastructure provides visibility into query patterns, performance bottlenecks, and potential security issues. This final post in the BIND series covers setting up comprehensive monitoring using Prometheus and Grafana, giving you dashboards and alerts for your DNS servers. BIND Statistics Overview BIND provides extensive statistics through several channels:
bind
First, a short side note. Personal viewpoint: I’m not a fan of DNS over HTTPS (DoH). The main reason is not encryption itself—encryption is a good thing—but how DoH is implemented and deployed. Facts: DoH encapsulates DNS queries inside regular HTTPS traffic (TCP/443), making DNS traffic
bind
Traditional DNS queries travel in plaintext, exposing your browsing habits to network observers. DNS over TLS (DoT) encrypts DNS traffic between clients and resolvers, providing privacy and preventing tampering. This post covers implementing DoT on BIND 9 for both resolver and forwarder configurations. Understanding DNS over TLS How DoT Works
bind
After configuring DNSSEC validation on your resolvers, the next step is signing your own authoritative zones. This post covers the complete process of implementing DNSSEC on BIND authoritative servers, from key generation to zone signing and key rollovers. Understanding DNSSEC Keys DNSSEC uses two types of cryptographic keys: Key Signing
bind
DNSSEC (Domain Name System Security Extensions) adds cryptographic authentication to DNS responses, protecting against cache poisoning and man-in-the-middle attacks. When your resolver validates DNSSEC, it verifies that DNS responses haven't been tampered with between the authoritative server and your clients. How DNSSEC Validation Works DNSSEC creates a chain
bind
Response Policy Zones (RPZ) provide DNS-level security by allowing you to override DNS responses for specific domains. This enables blocking malicious domains, implementing content filtering, and protecting your network from phishing, malware, and other threats at the DNS layer - before connections are even established. How RPZ Works RPZ intercepts
bind
External-DNS is a Kubernetes controller that automatically creates and manages DNS records based on Kubernetes resources like Services and Ingresses. When combined with BIND using the RFC2136 (dynamic DNS) provider, you get fully automated DNS management for your Kubernetes workloads without relying on cloud DNS providers. How External-DNS Works External-DNS
bind
Dynamic DNS (DDNS) allows automated systems to update DNS records in real-time. This is essential for DHCP servers registering client hostnames, Kubernetes services updating their endpoints, or any system that needs programmatic DNS record management. BIND supports secure dynamic updates using TSIG (Transaction Signature) authentication. How Dynamic DNS Works Dynamic
bind
A properly secured DNS server is critical infrastructure. An open resolver can be abused for DNS amplification attacks, leak internal network information, or serve as a reconnaissance tool for attackers. This guide covers BIND's security features: Access Control Lists (ACLs), views for split-horizon DNS, and query restrictions to
bind
RNDC (Remote Name Daemon Control) is the administrative tool for managing BIND DNS servers. It allows you to reload zones, flush caches, view statistics, and perform other administrative tasks without restarting the entire service. RNDC uses TSIG (Transaction Signature) keys for authentication, ensuring only authorized administrators can control your DNS
Linux
An authoritative DNS server is the definitive source of DNS records for the domains it hosts. Unlike recursive resolvers that query other servers, authoritative servers directly answer queries with the records they maintain. In this guide, we'll configure BIND 9 as an authoritative-only DNS server. 1. Authoritative vs
Linux
A recursive DNS resolver is the workhorse of DNS infrastructure, handling client queries by recursively querying authoritative nameservers until it finds the answer. BIND 9 is the most widely deployed DNS software and makes an excellent choice for running your own resolver. In this guide, we'll set up
Linux
Multipathing (MPIO - Multipath I/O) is essential for high availability and performance in iSCSI storage environments. It allows multiple network paths between an initiator (client) and a target (storage), ensuring failover and load balancing. In this guide, we will set up iSCSI multipathing on Linux using Ansible, automating installation,