31 posts in category infrastructure
SigNoz on OVH MKS: Access Log Reports with Vector and ClickHouse
Collect Envoy access logs with Vector into ClickHouse, generate monthly awffull reports, and serve them via Istio ExternalName route to S3. Part 3 of 3.
SigNoz on OVH MKS: The Complete Guide
A reading guide to the 3-part SigNoz on OVH MKS series: sovereign observability with Terraform, Ansible, Istio Ambient Mode, and ClickHouse S3 cold tiering.
SigNoz on OVH MKS: Infrastructure with Terraform + Ansible
Deploy SigNoz on OVH MKS with Terraform and Ansible: MKS cluster, ClickHouse hot-to-cold S3 tiering, Istio Ambient Mode, cert-manager DNS-01. Part 1 of 3.
SigNoz on OVH MKS: Metrics, Traces & Logs with Istio Ambient
Send Istio metrics, OTLP traces, and pod logs to SigNoz on OVH MKS. Verify ClickHouse S3 cold-tier and estimate 7-year storage costs. Part 2 of 3.
Running pdns_recursor as a root-independent validating resolver
How to configure PowerDNS Recursor 5.4 to resolve directly against TLD name servers without depending on the root name servers at runtime, using a local root.zone file loaded via zonetocaches — including DNSSEC validation, trust anchor setup, and the race condition that prevents it from working without a hint file.
Running a validating DNS recursor from the root zone with Hickory DNS
How to run Hickory DNS as a full recursive resolver starting from the root zone, with DNSSEC validation, TLS-encrypted upstream connections, Happy Eyeballs, and Prometheus metrics — including all configuration options added in the recurser-from-root-zone branch.
vigil-log-relay: Kubernetes Log Collection Without a DaemonSet
vigil-log-relay streams logs from Kubernetes pods, HTTP endpoints, or Unix sockets and forwards them as ndjson to any TCP-capable log collector. No DaemonSet, no node-level access, no filesystem mounts — just a single binary with a namespace-scoped ServiceAccount.
vigil-rs: A Rust Service Supervisor for Containers
vigil-rs is a PID 1 / container init daemon written in Rust. It supervises multiple processes, runs health checks, fires HTTP(S) alerts on state transitions, and exposes a REST API over a Unix socket with native zombie-reaping and per-service stop signals.
tls-proxy-tunnel: Transparent TLS Tunnelling Through Corporate HTTP Proxies
How tls-proxy-tunnel (tpt) uses SNI peeking to tunnel TLS connections through corporate HTTP CONNECT proxies without ever terminating TLS — layer 4, zero config on the client side.
Building a native file upload handler for Caddy v2
How I built caddyv2-upload, a native file upload handler for Caddy v2 written in Go — the problem it solves, and how it works.