Log — filtered by category
Security
Trust boundaries, access control, policy.
All posts
Treating Your Repo as if It Will Leak
A classification discipline for turning private operational notes into public writing without turning them into a target map.
Default Deny, Real Cost
Every VLAN here denies inter-segment traffic by default. That buys real safety, but it is not free: an honest look at the friction it actually costs.
One VPN Would Have Been Simpler, and Wrong
Why privileged admin access and general access run over two separate WireGuard-style tunnels, and why every peer is a device, not a person.
Six Layers of Reachability
A mental model for network reachability on a segmented personal platform: six independent questions that must all resolve yes before a request reaches anything.