Compliance as Code: CIS Hardening, OpenSCAP Gates and Policy Checks
Enforce CIS network sysctl baselines with Ansible, gate deployments on OpenSCAP results, and reject Ingress objects without TLS using an OPA admission policy.
Found 14 results for: Content Generation
Enforce CIS network sysctl baselines with Ansible, gate deployments on OpenSCAP results, and reject Ingress objects without TLS using an OPA admission policy.
How to tell when an OpenVZ container is being refused resources: read user_beancounters, interpret failcnt, and shrink MySQL and Apache to fit the limits.
How to remove the single points of failure from a small web cluster in 2009: two HAProxy nodes sharing a VRRP address in front of two or more web nodes.
A Bun or Node.js service can be slow on a VPS because of CPU steal or slow disks. How to measure both, fix the host first, and then compare runtimes fairly.
Trivy exits 0 even with CRITICAL findings. I built it from source and made it a real CI gate, then found a secret-scan skip that a green result can hide.
Building Prometheus from source on a host with older Go and Node than the repo asks for: what the build does, what warns, and how I verified the result.
Control planes built on etcd or Raft fail on slow disks. How to test fsync latency, pick between Kubernetes, K3s and Nomad, and prepare a K3s node.
How an Nginx API gateway with rate limiting and upstream keepalive, plus an opossum circuit breaker, limits cascading failures between microservices (2022…
Replace trust-by-network-location with encrypted, authenticated links: WireGuard between nodes, nginx client certificates and hardened SSH with a second factor.
Slow or timing-out Jenkins builds are often caused by iowait, swapping and a badly sized JVM heap. How to diagnose and tune each on a 2014-era Linux server.
How to build reports from raw Apache or Nginx access logs with AWStats on CentOS 6: log format, config, cron, protected access, and limits.
A reference setup for Postfix on CentOS 6 (2012): fix mail rejected or sent to spam with matching DNS, restricted SMTP, TLS submission with SASL, SPF and DKIM.
Cut disk waits on a MySQL 5.5 server on CentOS 6: convert tables to InnoDB, size the buffer pool and logs, set the flush policy, I/O scheduler and swappiness.
A 2009 reference for choosing between a VPS and a dedicated server. It covers how to find and fix OpenVZ memory-limit failures with user_beancounters.