21 posts in category open-source

A Rust CLI that scales or restarts a single Kubernetes Deployment from a CronJob — with cosign-signed images, SPDX SBOM attestation, and SLSA build provenance.

A verified, sourced comparison of regctl, oras, skopeo, Zot, Harbor, and cosign copy for mirroring a Cosign-signed container image into a private registry.

Deploying the haproxy-spoe-rs SPOA agent in production — container image, podman-compose, Kubernetes, HAProxy configuration, health checking, logging, and systemd.

How to configure PowerDNS Recursor 5.4 to resolve directly against TLD name servers without depending on the root name servers at runtime, using a local root.zone file loaded via zonetocaches — including DNSSEC validation, trust anchor setup, and the race condition that prevents it from working without a hint file.

How to run Hickory DNS as a full recursive resolver starting from the root zone, with DNSSEC validation, TLS-encrypted upstream connections, Happy Eyeballs, and Prometheus metrics — including all configuration options added in the recurser-from-root-zone branch.

vigil-log-relay streams logs from Kubernetes pods, HTTP endpoints, or Unix sockets and forwards them as ndjson to any TCP-capable log collector. No DaemonSet, no node-level access, no filesystem mounts — just a single binary with a namespace-scoped ServiceAccount.

vigil-rs is a PID 1 / container init daemon written in Rust. It supervises multiple processes, runs health checks, fires HTTP(S) alerts on state transitions, and exposes a REST API over a Unix socket with native zombie-reaping and per-service stop signals.

A Rust rewrite of mergelog 4.5, a C tool from 2000 that merges Apache log files chronologically. Six optimizations — a k-way heap merge, a hand-rolled CLF parser, String buffer reuse, mimalloc, 4 MiB read buffers with SIMD newline search, and zstd support — took the Rust binary from slower than the original to 2.26× faster.

AWFFull 4.0.0 brings a long-overdue overhaul to a C-based web server log analyser forked from Webalizer: PCRE2 replaces EOL libpcre, libmaxminddb replaces the deprecated GeoIP .dat format, new ASN statistics show traffic by network operator, and optional Intel Hyperscan, mimalloc, and XXH3 deliver measurable performance gains on large logs. The release also adds a full GitLab CI/CD pipeline, .deb/.rpm packages, a multi-stage container image, updated browser and bot detection lists, and 100%-complete translations for 6 languages.

A practical guide to shipping web server access logs to AWS S3 or Azure Blob Storage using Fluent Bit, Vector, or Filebeat/Logstash — including persistent buffering, retry configuration, concurrent write safety, and log loss prevention. Covers running AWFFull as a stateless container against object storage logs and serving the generated reports as a static website.