What the unpatched AhsayCBS zero-day changed about what my homelab exposes
An unpatched backup console RCE, and the reachability audit it triggered across my homelab.
Docker
Docker's CopyEscape: a docker cp destination escape and what I checked on my swarm
docker cp could write files outside the destination you pick and take over the host.
Infrastructure as Code: Architecting a Hardened Hugo Stack
Building a secure, performant, and automated web stack using Hugo, Nginx, and CrowdSec.
Securing My Stack with CrowdSec and Nginx Proxy Manager
I secured the web stack with CrowdSec, an open-source, collaborative Intrusion Prevention System (IPS)1. The integration with the existing Docker stack is tight: CrowdSec monitors the proxy logs in real time and blocks malicious traffic before it reaches the applications. Here’s an overview of my updated architecture and how the pieces fit together. My Website Architecture The site is built with Hugo, a fast static site generator. For performance and security, docker-compose splits the stack into distinct layers: ...