Dionis Ceban

Founder building web, hosting and fintech products since 2015. Sharing practical tips on servers, dev tools and investing. Learning in public.

[Dionis Ceban @CebanDionis]

@catc0n Worth reminding people that default Docker installs often run as root with the whole webroot writable. Dropping caps and a read-only filesystem is cheap hardening for WordPress containers.

[Dionis Ceban @CebanDionis]

@BenjDicken the hard part with sharding was never the routing, it was picking a shard key you won't regret in two years. nice to see tooling that makes the topology visible.

[Dionis Ceban @CebanDionis]

@devnp355178 Jumping several releases in one go is brave. Did you do it as in-place do-release-upgrade hops or rebuild on a fresh box and migrate? Curious which one bites less.

[Dionis Ceban @CebanDionis]

@ldo_dev Shrinking the attack surface beats patching speed every time. Only thing I'd add is keeping a break-glass path in case the tailnet itself has an outage.

[Dionis Ceban @CebanDionis]

@davepl1968 systemd-cgtop is a nice way to spot a runaway service on Linux, shows CPU and memory per cgroup

[Dionis Ceban @CebanDionis]

@thdxr libadwaita on GTK4 looks decent when apps actually use it, the ugly ones are mostly stuck on old toolkits

[Dionis Ceban @CebanDionis]

@vspinmaster Proxmox Backup Server on a cheap spare box is worth it just for the dedup

[Dionis Ceban @CebanDionis]

@brankopetric00 a 3-node Proxmox cluster with Ceph in a colo rack covers more than most small teams expect

[Dionis Ceban @CebanDionis]

what's the one command you're scared to run on a friday

[Dionis Ceban @CebanDionis]

When a server says "disk full", the first thing I run is ncdu -x /
It sorts folders by size and lets me drill in with the arrow keys. -x keeps it on one filesystem, so it skips /proc and network mounts.
What's your go-to when a disk fills up?
#Linux #SysAdmin

[Dionis Ceban @CebanDionis]

@Shahbaztwt debian, boring in the best way
apt full-upgrade and forget about it lol

[Dionis Ceban @CebanDionis]

@RoundtableSpace runs fine as a single docker container, port 8080 and you are set

[Dionis Ceban @CebanDionis]

@tdinh_me @thsottiaux Yubikeys are great, just enroll a second one and keep it somewhere else as a backup

[Dionis Ceban @CebanDionis]

@marckohlbrugge rotate them on a schedule, 90 days is a decent default

[Dionis Ceban @CebanDionis]

@lhchavez @Replit Minimal config is underrated, fewer modules loaded means fewer places for a bug to hide
blacklisting modules you never use in /etc/modprobe.d takes two minutes

[Dionis Ceban @CebanDionis]

@chessMan786 you can see it in /proc/<pid>/task, every thread shows up there with its own tid

[Dionis Ceban @CebanDionis]

@piyushgarg_dev The bugs were always there, scanning just got cheap
unattended-upgrades on every box is a boring but solid first step

[Dionis Ceban @CebanDionis]

@lopp tbh a week like this is a good reminder to check what's actually exposed. Do you think most people patch within days?

[Dionis Ceban @CebanDionis]

@eevblog Handy trick: php-fpm -v checks the FPM binary, and phpinfo() from the web side shows what actually serves requests.

[Dionis Ceban @CebanDionis]

@timo_rf lol the "you are the devops team" moment hits different once you hold the pager