Articles tagged: security

Implement self-hosted Single Sign-On (SSO) for Blazor Server using Authelia and OpenID Connect (OIDC).

Stop running as root. Build secure, minimal container images for .NET applications using multi-stage builds and distroless/alpine bases.

Elevating PKI security by moving the Root CA private key to a YubiKey hardware token, ensuring the most critical secret never creates a persistent footprint on disk.

Implement fine-grained access control with Kubernetes RBAC, service accounts, and least-privilege security patterns.

Safely exposing internal services to the internet without opening inbound ports using cloudflared and Zero Trust access policies.

Implement network segmentation and micro-segmentation in Kubernetes using Network Policies for defense in depth.

A step-by-step guide to bootstrapping a private PKI, from generating a Root CA to signing leaf certificates for internal microservices using OpenSSL.

A comprehensive guide to hardening your homelab environment using ufw, network segmentation with VLANs, and SSH key-based authentication.

Synchronize secrets from Infisical to Kubernetes using External Secrets Operator for GitOps-friendly secret management.

A comprehensive guide to securing PostgreSQL in a production environment, covering pg_hba.conf, enforced SSL/TLS, RBAC, Row-Level Security (RLS), and credential management with Infisical.

Implementing 'Never Trust, Always Verify' in Kubernetes using Linkerd for mTLS, OIDC for user identity propagation, and Workload Identity for secure service communication.

Stop manually renewing certificates. Set up Cert-Manager to automate Let's Encrypt DNS-01 challenges with Cloudflare.

Configure Traefik as your Kubernetes ingress controller with TLS termination, middleware chains, and IngressRoutes for routing traffic.

Host your own OIDC/OAuth2 Identity Provider with Authelia on Kubernetes. Secure your apps with 2FA, SSO, and fine-grained access control.

Securely exposing K8s services like API, MinIO, and databases using Tailscale sidecars and subnet routers for seamless access from anywhere.