Field notes
Field notes
Write-ups of real incidents and fixes from my own servers and projects — what broke, why, and the exact commands that fixed it.
A VS Code task turned my GitHub repos into malware droppers. Here is how the PolinRider campaign works and how I cleaned up.
A hidden folderOpen task, a "font" that is really JavaScript, and commits rewritten with their original timestamps. What the infection looks like from the inside, the grep that finds it, and the cleanup mistakes I made so you don't have to.
Read articleUFW says "deny incoming". Your Docker containers are on the internet anyway.
UFW was active, default deny, and a Postgres and a Redis container had still been reachable from the internet for six weeks. Why Docker's iptables rules win, how to check in 10 seconds, and the three ways to fix it.
Read articleGitHub Pages, custom domain: "Enforce HTTPS" greyed out, certificate stuck, and the www CNAME that causes it
The checkbox stays greyed out, the certificate never arrives, and http:// keeps serving your site without a redirect. The DNS mistake that causes the loop, how to read the real certificate state from the API, and the remove-and-re-add trick that works.
Read articleThe site went down because Let's Encrypt renewal had been failing for three months. Standalone vs. webroot behind nginx in Docker.
"Amazon disabled our server again." No — the certificate had expired. certbot.timer had been running twice a day for three months and failing every time, and nginx in Docker was reading a certificate store certbot never wrote to. The diagnosis, the fix, and the deploy hook that keeps it fixed.
Read article