Your Caddy Admin API Is a Deployment Interface - Treat It Like Root
The admin endpoint can replace active configuration, so broad exposure changes the security boundary of the edge.
security
An Operations Portal Should Not Become a Web Terminal
Convenient arbitrary shell access would collapse the separation between reviewed operations and unrestricted host control.
Health Probes Should Not Follow Redirects Blindly
A probe that follows a redirect can report success for the wrong endpoint and hide an authentication or routing failure.
One Device, One SIP Identity
Sharing SIP credentials across devices makes revocation, auditing and fleet diagnosis ambiguous.
The Runner Is a Privilege-Separation Boundary, Not Just a Worker
Keeping host execution outside the portal containers limits what a web compromise can directly control.
Internal Services vs External Services in Voiceware
How I separate east-west service communication from user-facing exposure.
Sudo Authentication Failures Belong in the Security Timeline
Repeated sudo failures may be operator error, expired credentials or suspicious privilege-escalation attempts, and they often happen outside application logs.
Signed Firmware Changed OTA from File Delivery into a Trust Decision
A device should decide whether firmware is authorized, not merely whether the download completed successfully.
terraform_remote_state Is a Trust Boundary, Not Just a Convenience
Reading outputs from another Terraform state is convenient, but consumers generally need access to the full underlying state snapshot. That couples security and deployment boundaries.
Secrets Are the Part of a GitOps Repo I Do Not Want to “Just Add”
How to think about credentials when application manifests are intentionally stored in Git.
SSH Failure Alerts Need Warning and Critical Bursts
A few failed SSH logins are normal on an administered server, while a rapid burst can indicate brute-force activity or a broken automation credential.
The ACL That Worked Perfectly and Locked Me Out
My first memorable ACL mistake was technically correct: it blocked exactly what I told it to block, including the management traffic I still needed.
Notification Authentication Belongs Outside Git
Moving alert delivery to authenticated self-hosted ntfy introduced a publisher token that the alert-sink needs at runtime.
Store Device Enrollment Secrets as Hashes When the Server Only Needs Verification
If a token only needs to be checked, retaining the plaintext creates unnecessary breach impact.
Do Not Trust a User Identity Header Just Because Caddy Forwarded It
Identity headers are safe only when clients cannot inject equivalent values around the auth boundary.
Do Not Turn Source IP into a High-Cardinality Metric Label
Security logs contain useful source addresses, but promoting every IP to a Prometheus or Loki index label would create unbounded cardinality on an Internet-facing service.
SSH Keys Made My Home Lab Feel Like a Real Network
Moving from local console access to SSH keys changed the lab from a collection of machines into something I could actually operate and troubleshoot remotely.
Append-Only Audit Events Make Operational History Harder to Rewrite
Control-plane actions are easier to trust when later updates cannot silently replace the original event record.
Passkeys Are Cryptographically Simple Compared With Their UX State Machine
WebAuthn can prove possession of a scoped private key. The product still has to reason about synced credentials, discoverable accounts, conditional UI, recovery, re-registration, and what the browser chooses to show.
Remember-Me Is a Security Policy, Not a Convenience Toggle
Long-lived trusted-browser sessions change the authentication risk model and should be chosen deliberately.
I Treat Tailscale Access Policy as Infrastructure Code
Once the tailnet becomes a real operational network, who can reach which host and service should not live only in memory.
OTA Compatibility Is More Than a Version String
A firmware artifact can be newer and still be unsafe for the target partition table, bootloader or hardware revision.
Removing Text and Social Features Also Reduces the Security Surface
Product restraint changes threat modeling as much as it changes UX.
Audit Logs Matter Because Secret Reads Are Security Events
A successful secret request is operationally normal and still important enough to leave durable evidence.