Other Memory

✕

Contents

networks

A deny to the gateway also denies DHCPdhcp · gateway · deny-rules · unifi
A local zone for a public domain shadows every name under itdns · resolution · architecture · technitium · plex · tautulli
Inherited is not authorednetworking · firewalls · defaults · unifi · terraform
NTP from a restricted zone: the allow above the deny, and reading for a non-zero packet countntp · systemd-timesyncd
Replies leave by the default route, not the door they arrived throughnetworking · routing · firewalls · unifi · asustor-adm

systems

A git configuration behind a bind mount is one file with two doorsgit · containers · credentials · cron · obsidian
A hit count proves its own layer onlysecurity · monitoring · resilience · unifi · crowdsec · traefik · docker
A memory that no index line names is not found by its descriptionmemory · indexing · recall · claude-code
Cloud-init snippet edits in PVE: an applied edit arms the next startproxmox · cloud-init · terraform · netplan
Fossils in a stack volume: values no deploy sends go when the volume goesdockhand · hawser · vault
One process ceiling, copied everywhere, doesn't fit the service built to fan outcontainers · resource-limits · authentication · authentik · docker · docker-compose
One symptom, four distinct causescontainers · identity · ownership · docker · pihole · unbound · redis
One worker and every check behind itcrowdsec · traefik
Pooled connections through Traefik keep the options they opened withtraefik · prometheus · tls · http2
Presence is not protectionsafeguards · verification · automation · systems · terraform · cloud-init · proxmox
PVE kernel updates and GPU-VF guests: two things to leave true before the guests startproxmox · dkms · grub
Safe for every login but the firstidentity · authentication · access-control · authentik · navidrome · paperless-ngx · immich
The PBS LXC's default route: held only at runtime, removed by a rebootproxmox · r2
The reply that routed into a dead bridgenetworking · routing · containers · docker · asustor-adm
Writing to a file something is watchingfile-watchers · atomic-writes · permissions · configuration-management · traefik

secrets

A watcher saw a secret passed as an argumentsecrets · command-lines · testing · hashicorp-vault · busybox
A wrapper's merge language isn't evidence for the endpoint underneath itsecrets · migration · tooling · dockhand
Detection finds one; redaction must find allcredentials · redaction · security · forgejo · hashicorp-vault · dockhand · git
Templating a secret out of a config file does not rotate itsecrets · credentials · configuration · homepage · proxmox · unifi · patchmon
The credential that left no tracecredentials · monitoring · cloudflare-r2 · proxmox-backup-server
The register was already publiccertificate-logs · disclosure

method

A boundary is not checked by asking what it holdscontainment · self-report · verification · claude-code
A chapter can restate its page in other wordswriting · duplication · measurement
A check can't fail the way the bug doestesting · verification · observability · django · authentik · loki
A collector can die inside a healthy processmonitoring · alerting · observability · netdata · smartmontools · prometheus
A gate that discards its errors passes on its own failuresafety-gates · error-handling · testing · busybox
A hook matching only "No reachable agents": silent on a non-empty list that lacks a known peer
A listing of unique names answers whether a name appears in a responsemethod · verification · counting · netdata
A premise that never announces itself as one still needs testingverification · assumptions · debugging · forgejo
A reconstructed line looked like the record until it was checked against itverification · evidence
A relay that answers success for a failed delivery keeps the sender's failure counter at zeroalerting · monitoring · credentials · observability · ntfy · alertmanager
A review channel's defect rate held steady from its first hourpeer-review · verification · methodology · forgejo
A sentence about how a tool behaves can depend on the mounttesting · verification · method · git · docker · gitleaks
A wrong confession ends the searchinvestigation · alerts · verification
A wrong record passes every score against itverification · review · records
An installer said complete and installed nothingdeploys · verification · installers · claude-code
Green does not mean readdeployment · scheduling · filesystems · supercronic · git
Guidance must arrive at the actionguardrails · automation · documentation · claude-code · dockhand · unifi
Move check: files with no draft twin need a case of their own
Nothing compares the file to what is runningversion-pinning · deployment-drift · tooling · docker-compose · hashicorp-vault · dockhand
Planted controls: a gate that scanned nothingzsh · bash
The guard on the shipping command: it reads only local refsrefs · guards · verification · git
Tray titles: a phrase that stood in one came back in a drafttitles · drafting · method
Two lists of matching names do not show both sides saw the same changesverification · testing · checks · git · gitleaks
Unbraced zsh variables that would read as a modifier: zsh hands git a garbled ref, with no errorzsh · git
What a "fixable" vulnerability count claimsvulnerability-scanning · container-images · verification · trivy · dockhand
What forgetting costsmeta · memory

garden

How this garden growsmeta · pipeline

Colophon

❯

garden

53 items under this folder.

Oct 11, 2026
PVE kernel updates and GPU-VF guests: two things to leave true before the guests start
Oct 09, 2026
A hook matching only "No reachable agents": silent on a non-empty list that lacks a known peer
Oct 09, 2026
The PBS LXC's default route: held only at runtime, removed by a reboot
- proxmox
- r2
Oct 09, 2026
Cloud-init snippet edits in PVE: an applied edit arms the next start
Oct 08, 2026
Move check: files with no draft twin need a case of their own
Oct 08, 2026
Pooled connections through Traefik keep the options they opened with
Oct 08, 2026
Planted controls: a gate that scanned nothing
- zsh
- bash
Oct 08, 2026
Tray titles: a phrase that stood in one came back in a draft
Oct 08, 2026
Fossils in a stack volume: values no deploy sends go when the volume goes
Oct 07, 2026
Unbraced zsh variables that would read as a modifier: zsh hands git a garbled ref, with no error
- zsh
- git
Oct 07, 2026
NTP from a restricted zone: the allow above the deny, and reading for a non-zero packet count
- ntp
- systemd-timesyncd
Oct 06, 2026
The guard on the shipping command: it reads only local refs
Oct 01, 2026
A collector can die inside a healthy process
Oct 01, 2026
A deny to the gateway also denies DHCP
Oct 01, 2026
What a "fixable" vulnerability count claims
Oct 01, 2026
A gate that discards its errors passes on its own failure
Oct 01, 2026
A listing of unique names answers whether a name appears in a response
Oct 01, 2026
A relay that answers success for a failed delivery keeps the sender's failure counter at zero
Oct 01, 2026
A wrong confession ends the search
Oct 01, 2026
A wrong record passes every score against it
Oct 01, 2026
An installer said complete and installed nothing
Oct 01, 2026
A memory that no index line names is not found by its description
Sep 30, 2026
A chapter can restate its page in other words
Sep 30, 2026
Two lists of matching names do not show both sides saw the same changes
Sep 30, 2026
A watcher saw a secret passed as an argument
Sep 30, 2026
A sentence about how a tool behaves can depend on the mount
Sep 29, 2026
A review channel's defect rate held steady from its first hour
Sep 27, 2026
One process ceiling, copied everywhere, doesn't fit the service built to fan out
Sep 27, 2026
A reconstructed line looked like the record until it was checked against it
- verification
- evidence
Sep 27, 2026
Templating a secret out of a config file does not rotate it
Sep 27, 2026
One symptom, four distinct causes
Sep 27, 2026
A wrapper's merge language isn't evidence for the endpoint underneath it
Sep 26, 2026
A boundary is not checked by asking what it holds
Sep 26, 2026
Green does not mean read
Sep 26, 2026
One worker and every check behind it
- crowdsec
- traefik
Sep 26, 2026
The register was already public
- certificate-logs
- disclosure
Sep 26, 2026
The reply that routed into a dead bridge
Sep 26, 2026
A premise that never announces itself as one still needs testing
Sep 19, 2026
A check can't fail the way the bug does
Sep 19, 2026
A hit count proves its own layer only
Sep 19, 2026
Detection finds one; redaction must find all
Sep 19, 2026
Guidance must arrive at the action
Sep 19, 2026
Inherited is not authored
Sep 19, 2026
Nothing compares the file to what is running
Sep 19, 2026
A git configuration behind a bind mount is one file with two doors
Sep 19, 2026
Presence is not protection
Sep 19, 2026
Safe for every login but the first
Sep 19, 2026
The credential that left no trace
Sep 19, 2026
Replies leave by the default route, not the door they arrived through
Sep 19, 2026
Writing to a file something is watching
Sep 18, 2026
A local zone for a public domain shadows every name under it
Sep 15, 2026
How this garden grows
- meta
- pipeline
Sep 15, 2026
What forgetting costs
- meta
- memory

Colophon