Blog
Notes from building and breaking infrastructure — mostly about the failures, because those are the parts worth writing down.
-
"All tables OK" — the backup check that verified nothing
My restore verification printed a green result immediately after the binary it depends on failed to exist. Here is how a shell fallback turned a hard failure into a success message, and what it cost to find.
- MySQL
- Bash
- Backups
- Disaster Recovery
- Docker
-
Your WAF is decorative if the origin still answers
A WAF only inspects traffic that goes through it. If your load balancer's hostname accepts connections from anywhere, an attacker skips the WAF with one DNS lookup — and nothing in the dashboard will tell you.
- Cloudflare
- AWS
- WAF
- Security
- ALB
-
Security groups have no deny rules — and that is the point
You cannot block an IP with an AWS security group. That looks like a missing feature until you notice what it buys: no rule ordering, no shadowing, and the ability to authorise a role instead of an address.
- AWS
- Networking
- Security
- iptables
- VPC
-
NAT, egress, and why your whole office has one IP address
Forty people, one address on the allowlist, and a firewall rule that works. What NAT is actually doing, why egress is a direction rather than a technology, and the availability trap hiding in an IP allowlist.
- Networking
- NAT
- AWS
- Firewall
- Fundamentals