Internal CA Trust Is an Operator Onboarding Problem
A valid internal TLS certificate is still unusable on a new operator device until its trust root is installed correctly.
TOPIC
Web & Control Plane
Lessons, explainers, experiments, and implementation notes.
An Operations Portal Should Not Become a Web Terminal
Convenient arbitrary shell access would collapse the separation between reviewed operations and unrestricted host control.
Human SSO and Machine Authentication Should Not Share One Gate
Firmware cannot complete an interactive Authelia login, but bypassing authentication entirely would expose the OTA control plane.
Machine APIs Need Machine Credentials, Not Browser Redirects
A firmware client cannot solve an interactive login flow, and treating the redirect as success hides the real authentication failure.
The Source Changed, So Why Are People Still Seeing the Old Page?
A source-code change can make a release feel finished, but several deployment and cache layers may still sit between the repository and a user's browser. A new file, a newly published artifact, and a newly observed response are three different pieces of evidence.
Exact Route Allowlists Are Safer Than Bypassing Authentication for /v1
A broad path prefix can expose future endpoints that did not exist when the exception was created.
Rate Limiting Is Not Authentication
The public machine API uses request throttling as abuse resistance while retaining Bearer validation as the real identity check.
Read-Only Posture Checks Are Useful Because They Are Safe to Run Often
Observability improves when operators can refresh evidence without opening a risky change window.
CSP connect-src Should Be a Small Network Allowlist
Browser-side health checks needed cross-origin access, but the fix was two explicit origins rather than a broad wildcard.
Every Operations Job Needs a Timeout
A safe command can still become unsafe operationally if it can occupy the runner forever.
What Git History Adds to a Blog
In a Git-backed blog, content files and their change history live in the same system. You can trace when a sentence changed, when metadata moved, and which edits can be reverted. But Git alone does not provide the entire publishing experience.
Authelia Sessions Needed Durable State, Not Just Longer Cookies
A longer browser cookie does not help if the server forgets the session behind it.
One Missing Semicolon Broke HTML Escaping in the Command Center
Tiny output-encoding defects matter more in admin surfaces because they render operational data from many sources.
A 422 Can Be Healthier Than a 302 for a Device API
For an intentionally invalid API payload, validation failure proves the request reached the correct application boundary.
A Green Badge Needs an Expiration Time
Operational evidence should age out automatically rather than remaining green until someone notices it is old.
A CSP Can Break a Health Dashboard Without Breaking the Server
Browser security policy is part of application behavior; a blocked fetch can make a healthy backend look unreachable.
Append-Only Audit Events Make Operational History Harder to Rewrite
Control-plane actions are easier to trust when later updates cannot silently replace the original event record.
Approval Gates Belong on High-Risk Operations, Not Every Button
Blanket approvals create friction; risk-based approvals preserve review where it actually reduces danger.
Cookie Domain and SameSite Settings Are Part of SSO Architecture
Cross-subdomain authentication only works predictably when cookie scope and redirect boundaries match the domain design.
A Reviewed Job Catalog Is Infrastructure Code for Operations
The safest operational button is one whose command, risk and parameters were already reviewed before the incident started.
Remember-Me Is a Security Policy, Not a Convenience Toggle
Long-lived trusted-browser sessions change the authentication risk model and should be chosen deliberately.
Evidence Freshness Belongs in the Operator UI
A production acceptance result should carry age and policy, not just a green badge.
What Survives When a Static Site's Origin Goes Offline?
One attraction of static publishing is that the authoring server may not need to stay online for readers to receive already-published files. But the boundary of that independence needs to be clear.