Server & DevOps Articles & Deep Dives
In-depth Server & DevOps articles and technical deep dives from the Private DevOps team - architecture patterns, trade-offs, and production-grade analysis for infrastructure teams.
44 articles in this topic
The GitHub to GitLab Migration Nobody Warns You About
GitLab imports your repositories, reviews and history almost completely. It imports none of your GitHub Actions. What moves, what you rewrite, and when.
Read articleHow to Recover an EC2 Instance You Can No Longer SSH Into
When a box stops answering there is an order to work through, and two of the options only exist if somebody enabled them on a calm afternoon months earlier. This covers what the status checks are telling you, reading console output, the serial console and everything it needs configured in advance, and the volume detach and reattach route as the last resort. The part worth reading before you need it is which mechanisms have prerequisites, because that decides what is available to you at 2am.
Read articleHow to Migrate a Server to AWS Without a Big Bang Cutover
A big bang cutover is a plan with exactly one attempt in it. The incremental version costs a little more elapsed time and keeps a working rollback available until the very last step. This walks through the inventory that decides whether the cutover is clean, continuous replication that runs while the old server keeps serving, a dress rehearsal you can repeat, the DNS time to live arithmetic you have to do backwards from the cutover date, and the single action that ends the rollback window for good.
Read articleHow to Upgrade PostgreSQL Major Versions With Almost No Downtime
An in-place major upgrade takes your database down for as long as the upgrade runs, and once it has started there is no way back. Logical replication turns that into a cutover you can measure in seconds, with the old server still consistent and still able to take traffic if the first minute goes badly. The method works because the new server is built and caught up while the old one keeps serving. The risk is entirely in what logical replication declines to carry across, so this guide spends most of its time on sequences, DDL, large objects and tables without a replica identity.
Read articleHow to Change a Schema on a Busy MySQL Table Without Locking It
A plain ALTER on a large InnoDB table can hold up every writer until it finishes, which on a busy table means an outage nobody scheduled. Modern MySQL does far more instantly than most teams realise, so the first job is checking whether you need a tool at all. When you do, the copy-and-swap approach builds a shadow table, keeps it in step from the binary log, and swaps the two at the end. This guide covers what the table has to look like for that to work, and how to stop a migration safely once it is running.
Read articleHow to Run Ephemeral CI Runners on Your Own Hardware
A build that passes because of something left behind by the previous build is not a passing build, it is a coincidence. Ephemeral runners remove that class of problem by giving every job a machine that has never run anything else. GitHub supports this directly through single-use runner registration and just-in-time configuration, so the runner deregisters itself after one job and your automation disposes of the host. This guide covers both approaches, the Kubernetes version, and the one situation where self-hosted runners are the wrong answer.
Read articleHow to Keep a Build Cache That Survives Ephemeral Runners
Throwing away the runner after every job is the right call, and it costs you the build cache unless the cache lives somewhere else. On GitHub Actions it already does, which means the real work is writing keys that hit instead of keys that always miss. This guide covers restore-keys and how partial matching actually resolves, the hidden part of a cache key that nobody sets, why a cache saved on a feature branch is invisible to main, and what to do when a bad cache entry starts poisoning every run.
Read articleHow to Restore One Table From a Full Cluster Backup
Somebody emptied one table and the rest of the database is still taking orders. Restoring the whole backup over production would throw away every write since the dump, to fix damage that lives in a single table. This is the side restore instead, with the format choice that decides whether selective restore is even possible, the pg_restore flags that behave differently from the pg_dump ones you know, and the foreign keys and sequences that turn a successful restore into a broken application an hour later.
Read articleHow to Patch on a Schedule Without a Maintenance Window
A quarterly maintenance window means three months of known vulnerabilities waiting for a Saturday night, and then forty machines changing at once while everyone is asleep. Patching continuously and restarting in waves gets fixes on faster and removes the outage entirely. Here is the configuration that actually applies updates rather than only downloading them, how the machine tells you whether a reboot is genuinely required, and how to build waves so no two hosts behind the same load balancer ever go down together.
Read articleHow to Back Up and Restore etcd Before You Need It
A verified etcd snapshot is the difference between a control plane you rebuild in twenty minutes and a cluster you reassemble from memory over a weekend. This walks through taking a snapshot on a self-managed cluster, proving the file is actually restorable rather than merely present, and bringing a cluster back that no longer comes up. It also covers the commands that moved between binaries in recent etcd releases, because the old ones are the ones everybody copies.
Read articleHow to Set Requests and Limits From Real Usage Instead of Guesses
Copied resource blocks cause two expensive problems at once, pods killed for memory they never used and latency nobody can explain. This shows how to read what your workloads actually consume, how CPU throttling shows up in metrics, and why a CPU limit and a memory limit are completely different decisions. The result is a set of numbers you can defend in a review instead of numbers that were inherited from a tutorial.
Read articleHow to Run Cron in Kubernetes So Jobs Never Overlap or Vanish
Scheduled work in Kubernetes fails in two quiet ways, a slow job that starts a second copy of itself and a schedule that silently stops firing. Both are configuration, not luck. This covers the CronJob fields that control concurrency, missed schedules, history retention and failure handling, with the actual defaults, so the nightly billing run is still there in the morning and there is a log to read when it is not.
Read articleHow to Do Canary Releases Without a Service Mesh
You can send five percent of production traffic at a new version, watch the error rate, and roll back in seconds without installing a service mesh. This walks through replica weighted canaries with a progressive delivery controller, real percentage splitting at the edge, an automated pass or fail check against Prometheus, and the rollback path. It also covers what changed when Kubernetes retired Ingress NGINX in March 2026.
Read articleHow to Cut LCP With an Image Pipeline Without Touching the Theme
On most content and commerce pages the Largest Contentful Paint element is a single image, which means one image decides the score. This guide covers the decisions that belong to the delivery layer rather than to a template, from format negotiation on the Accept header to the size actually credited by the metric, the priority the browser assigns to an image before layout, and the one attribute that quietly ruins a hero. Every attribute here is checked against the HTML standard or web.dev, including which images must never be lazy loaded.
Read articleHow to Write Alerts That Wake a Human Only When a Human Is Needed
An on-call rota fails long before anyone quits, at the moment the team stops reading the pages. This guide covers the three changes that keep that from happening: alerting on what a customer can feel rather than on a cause, replacing threshold pages with burn rate alerts against an objective, and grouping so that one incident produces one notification. It ends with a query that tells you which of your alerts nobody has acted on, and what to do with them.
Read articleHow to Run OpenTelemetry on a Small Cluster Without a Vendor Bill
A self-hosted OpenTelemetry path is genuinely within reach for a team that does not want its observability metered by somebody else. This guide covers the parts that matter, starting with what the collector actually does with a pipeline, then the difference between running it as an agent and as a gateway, where traces, metrics and logs can land, and how to work out how much disk a retention window needs before you commit to it. Every component name and default here is checked against the OpenTelemetry and backend documentation.
Read articleHow to Tune a Linux Server That Falls Over Only at Peak
Load average under one, CPU half idle, and for four minutes every evening the site returns errors. The limits that bite at peak are queues and counters rather than utilisation, which is why no dashboard you own is measuring them. This guide shows where to read the accept queue overflow counter, the PHP-FPM log lines that name the pool ceiling in plain words, the ephemeral port range, and the connection tracking table, along with the sysctl and nginx directives that raise each one. Every observation command comes before the change it justifies.
Read articleHow to Move Off cPanel Without Breaking Mail
A web request that lands on the old server serves a slightly stale page. A message that lands on the old server sits in a mailbox the customer can no longer reach, and it never moves on its own. This is the migration order that keeps every message reachable throughout, with the inventory items that break silently, the TTL work that has to happen days ahead, repeated incremental imapsync passes across the cutover, and the authentication records that must travel with the mail. The DKIM private key does not come with the mailboxes, and that is the step most migrations discover afterwards.
Read articleHow to Build a Backup You Have Actually Restored
A backup job that reports success is a receipt, not a guarantee. The line that shows up on almost every infrastructure audit is not missing backups, it is backups nobody has ever restored. This is the setup that turns one into the other: a weekly job that restores last night's copy into a scratch container, runs a real query against it, and pages you when the row count is wrong. Plus the failure modes that only surface on restore day, from missing roles to a dump that quietly left the large objects behind.
Read articleHow to Find the One Query That Is Actually Killing You
The query that is hurting you is usually not the slow one. It is the fast one that runs two million times an hour. pg_stat_statements ranks by total time rather than by how a query feels, which is why it finds the real answer in about ten minutes. Here is how to turn it on, which columns to sort by and why, the two configuration defaults that quietly give you nothing, and what to do with the query once you have it.
Read articleHow to Drain a Node Without Dropping a Single Request
kubectl drain politely evicts your pods and your users still see errors, because a pod that is terminating is not automatically a pod that has stopped receiving traffic. The gap between those two states is where the dropped requests live. This is how to close it with a pre-stop delay, a grace period long enough for real requests, and a disruption budget that stops the node from taking your last replica with it.
Read articleHow to Pool Connections Without Pgbouncer Lying to You
PgBouncer in front of Postgres is the standard fix for connection exhaustion, and the standard way to break an application in ways that only appear under load. The reason is pool mode: session pooling is safe and pools almost nothing, transaction pooling gives you the numbers you wanted and quietly removes session state your ORM assumed. Here is what each mode actually does, which features stop working, and the settings that decide whether it helps.
Read articleHardening A Fresh Ubuntu 24.04 VPS In 15 Minutes
A fresh public Ubuntu 24.04 VPS sees SSH brute-force attempts within a minute of getting an IP. The 15-minute hardening run that closes the obvious doors before production traffic, with the verification commands.
Read articleAdopting npm stage publish In Your CI Without Breaking Releases
npm staged publishing landed in CLI 11.15.0 on May 22, 2026. Adopting it in CI is two-line work for simple repos and a small project for monorepos. The migration plan from npm publish to npm stage publish, with the changes release automation expects.
Read articleYour MySQL Upgraded Itself Overnight. Here's What Happened
cPanel's nightly updates silently upgraded MySQL 8.4 to 9.7 on thousands of servers. Here is what broke, why rollback was nearly impossible, and how to prevent it.
Read articleHow to Set Up Automated Server Backups with Restic and S3 on Ubuntu
A complete walkthrough for setting up encrypted, deduplicated server backups with Restic and S3-compatible storage on Ubuntu, including systemd timers, verification, and restore procedures.
Read articleNginx vs Caddy in 2026: Which Reverse Proxy Should You Use?
A head-to-head comparison of Nginx and Caddy as reverse proxies in 2026, covering automatic SSL, configuration syntax, performance benchmarks, plugin ecosystems, and guidance on when to choose each.
Read articleZero-Downtime Deployments with K3s and ArgoCD - A Practical Guide
A hands-on guide to achieving zero-downtime deployments using K3s and ArgoCD, covering GitOps workflows, rolling update strategies, health checks, and complete YAML manifests.
Read articleServer Hardening Checklist for Ubuntu 24.04 - The Complete Guide
A comprehensive server hardening checklist for Ubuntu 24.04, covering SSH configuration, firewall setup, fail2ban, unattended upgrades, CIS benchmarks, audit logging, and kernel hardening.
Read articleMySQL Master-Slave Replication Setup Guide (Source-Replica Syntax for 8.4)
MySQL 8.4 removed the master-slave syntax entirely, so CHANGE MASTER TO and SHOW SLAVE STATUS now fail outright. This guide uses the current source-replica syntax that works on both 8.0 and 8.4, with a full mapping table, GTID setup, HAProxy read distribution, and the two things that actually break in production: Seconds_Behind_Source lying to you, and reading your own writes.
Read articleKubernetes HPA Deep Dive: Scaling Under Load
Configure Kubernetes Horizontal Pod Autoscaler with custom metrics, scaling policies, and behavior tuning for predictable production auto-scaling.
Read articleServer Monitoring with Prometheus and Grafana
Build a production monitoring stack with Prometheus, Grafana, and Alertmanager for infrastructure visibility, custom dashboards, and incident alerting.
Read articleBuilding CI/CD Pipelines with GitHub Actions
Design production-grade CI/CD pipelines using GitHub Actions with matrix builds, environment protection rules, and automated rollback strategies.
Read articleZero-Downtime Kubernetes Deployments: Complete Guide
Master rolling updates, blue-green deployments, and canary releases in Kubernetes to achieve true zero-downtime production deployments.
Read articleFixing "421 Misdirected Request" for Plesk Sites on Ubuntu 22.04 After Apache Update
Resolve the 421 Misdirected Request error affecting all HTTPS sites on Plesk for Ubuntu 22.04 after an Apache update, caused by changed SNI requirements in the nginx-to-Apache proxy chain.
Read articleSecure Static Content Hosting with S3, CloudFront, and Basic Authentication
Learn how to host static assets in S3, serve them globally via CloudFront with Origin Access Control, and enforce Basic Authentication at edge locations using Lambda@Edge.
Read articleHow to Enable IPv6 on AWS EC2 and Troubleshoot
A guide to enabling IPv6 on AWS EC2 instances, covering VPC and subnet configuration, instance-level setup, security groups, NACLs, troubleshooting, and testing IPv6 connectivity.
Read articleThe Ultimate Guide to Linux Server Management in 2025
A comprehensive guide to modern Linux server management covering automation, containerization, cloud integration, AI-driven operations, security best practices, and essential tooling for 2025.
Read articleHow to Troubleshoot and Fix Cloudflare Error 521 on Ubuntu
A practical Ubuntu-focused guide to diagnosing and resolving Cloudflare Error 521, covering origin server checks, web service restarts, firewall rules, resource monitoring, and prevention strategies.
Read articleHow to Troubleshoot and Fix the "Error Establishing a Database Connection" in WordPress
An in-depth troubleshooting guide for the WordPress database connection error, covering wp-config.php verification, password resets, database repair, MySQL service management, and preventive measures.
Read articleAutomating Reverse Charge VAT Notes in WHMCS Invoices
A hands-on guide to automating reverse charge VAT notes on WHMCS invoices, including prerequisite checks, a WHMCS hook for new invoices, and a bulk-update script for existing records.
Read articleHow to Set Up GlusterFS on Ubuntu
A complete guide to setting up a distributed, replicated GlusterFS filesystem across multiple Ubuntu 22.04 nodes, including installation, volume creation, client mounting, maintenance, and troubleshooting.
Read articleUpgrading Magento 2 to the Latest Version: A 10 Step-by-Step Guide
A structured 10-step process for upgrading Magento 2 from v2.4.3 to v2.4.7-p3 on Ubuntu, covering system preparation, backups, staging setup, Composer updates, custom module handling, and post-upgrade optimization.
Read articleHow to Set Up OpenSearch for Magento 2.4.7 on Ubuntu 22.04/24.04
Step-by-step instructions for installing and configuring OpenSearch for Magento 2.4.7 on Ubuntu, including single-node setup, optional cluster configuration, security certificates, and Magento integration.
Read article