Blog

Notes from building and breaking infrastructure — mostly about the failures, because those are the parts worth writing down.

  • · 8 min read

    "All tables OK" — the backup check that verified nothing

    My restore verification printed a green result immediately after the binary it depends on failed to exist. Here is how a shell fallback turned a hard failure into a success message, and what it cost to find.

    • MySQL
    • Bash
    • Backups
    • Disaster Recovery
    • Docker
  • · 7 min read

    Your WAF is decorative if the origin still answers

    A WAF only inspects traffic that goes through it. If your load balancer's hostname accepts connections from anywhere, an attacker skips the WAF with one DNS lookup — and nothing in the dashboard will tell you.

    • Cloudflare
    • AWS
    • WAF
    • Security
    • ALB
  • · 9 min read

    Security groups have no deny rules — and that is the point

    You cannot block an IP with an AWS security group. That looks like a missing feature until you notice what it buys: no rule ordering, no shadowing, and the ability to authorise a role instead of an address.

    • AWS
    • Networking
    • Security
    • iptables
    • VPC
  • · 10 min read

    NAT, egress, and why your whole office has one IP address

    Forty people, one address on the allowlist, and a firewall rule that works. What NAT is actually doing, why egress is a direction rather than a technology, and the availability trap hiding in an IP allowlist.

    • Networking
    • NAT
    • AWS
    • Firewall
    • Fundamentals