I spent the last few weeks reading about BGP after running into a routing issue that I could not explain with traceroute alone. These are rough notes, not a tutorial. The basics BGP (Border Gateway Protocol) is how autonomous systems on the internet exchange routing information. An autonomous system (AS) is a network or group of networks operated by a single organization, identified by an AS number (ASN). For example, Cloudflare is AS13335, Hetzner is AS24940. ...

When something is slow or unreachable on the network, the first instinct is to blame the server. But the problem is often somewhere in between. These are the tools I reach for when I need to figure out where packets are getting lost or delayed. Traceroute basics Traceroute shows the path packets take from your machine to a destination. It works by sending packets with increasing TTL (Time to Live) values. Each router along the path decrements the TTL by one, and when it reaches zero, that router sends back an ICMP Time Exceeded message. This reveals each hop. ...

I recently moved a domain to a new server and had to wait for the change to take effect everywhere. The process is commonly called “DNS propagation,” but that term is a bit misleading. Here is what actually happens. DNS is not a broadcast system When people say “DNS is propagating,” it sounds like your new record is being pushed out to servers around the world. That is not how it works. ...

After setting up my VPS, security was the next priority. A server on the public internet gets probed constantly. Within hours of going live, the auth log fills up with failed SSH login attempts from all over the world. This post covers the measures I took. None of this is novel, but having it written down in one place is useful. SSH hardening SSH is the primary way you access a Linux server, which makes it the primary target for attackers. The default configuration is functional but permissive. ...

I have been running Nginx on a 1 vCPU / 2 GB RAM VPS for a while now. These are my notes on configuration choices that make sense at this scale. The defaults are mostly fine Nginx is efficient out of the box. For a small site serving static files, you can run the default configuration and it will handle far more traffic than your server will ever see. But there are a few things worth adjusting. ...

When I first set up HTTPS on my server, I realized I did not fully understand what was happening behind the scenes. I knew I needed a certificate, and I knew Let’s Encrypt was free, but the details were fuzzy. So I dug into it. What TLS actually does TLS (Transport Layer Security) provides three things for a connection between a client and a server: Encryption. The data in transit cannot be read by anyone observing the network. Authentication. The client can verify it is talking to the intended server, not an impostor. Integrity. The data cannot be modified in transit without detection. When your browser connects to a site over HTTPS, a TLS handshake happens before any HTTP data is exchanged. During this handshake, the server presents its certificate. ...

When I decided to rent a VPS for personal projects, I spent some time thinking about location. I ended up choosing a data center in Amsterdam. Here is how I arrived at that decision and what the setup looks like. Why Amsterdam A few factors made Amsterdam a good fit. Network connectivity. Amsterdam is one of the most interconnected cities in Europe. AMS-IX is one of the largest internet exchange points in the world. In practice this means good peering, low latency to most of Western Europe, and solid routing to the rest of the world. ...

I wanted a blog on my VPS that would cost almost nothing in resources. Static site generators were the obvious choice, and after looking at a few options I went with Hugo. Why Hugo The main appeal is simplicity. Hugo is a single binary. There is no runtime, no dependency tree, no Node modules folder growing to 800 MB. You write Markdown, run one command, and get a folder of HTML files ready to serve. ...