Insights on cloud infrastructure, security and operational resilience.
The OCI WAF blocked 13 requests in 24h — 11 were false positives. They were Next.js revalidation calls with ?slug=long-hyphenated-values, which the OWASP Core Rule Set read as SQL injection. The fix: exclude the slug parameter across all 141 capabilities.
Read articleA WordPress site went down twice a day under distributed scraping, and the 12 req/min limit held nothing back. The reason: nginx counted requests by the CDN's IP, not the attacker's. The fix was one line of set_real_ip_from — and a tighter pagination regex.
Read articleA commercial scanner generated 550× normal traffic and pinned CPU at 100% — and CrowdSec banned no one. The reason: the container, on a Docker bridge network, couldn't resolve DNS, crash-looped, and nobody got an alert. The IPS was "installed", but dead.
Read articleA legitimate 84 KB upload in wp-admin hit a 403. The culprit was AWS WAF's SizeRestrictions_BODY managed rule, which inspects only the first 8 KB of the body. And the fix required swapping regex for ByteMatch — because CloudFront's WAF doesn't support RegexMatchStatement.
Read articleIn the AWS→OCI migration of the WordPress tier, the c6g.2xlarge EC2 ran at 6.6% average CPU. Proving with CloudWatch that 4 OCPUs were enough was the easy part; what nearly blocked us was managed MySQL, over a policy that must live at the tenancy root, not the compartment.
Read articleBefore a single container goes up, the network has to be right. Migrating a transactional app to OCI in São Paulo, three VCN decisions defined the rest: the CIDR that mustn't overlap, the region with a single AD, and the Service Gateway that answers on an unexpected prefix.
Read articleAfter a rightsizing + Reserved Instances cycle, validating savings mid-month seems simple — and naive pro-rata fools you. A No-Upfront RI isn't spread across the month: it shows up as a single charge. Here's the formula that projected the real -57%.
Read articleA course platform with 540 GB of video needed to deliver paid content without leaking links — and without blowing the budget. The math between CloudFront (flat-rate + Signed URLs) and Bunny gets clear above ~2 TB/month, and transcoding carries a scary one-time cost.
Read articleThe weekly report flagged Route53 +687% and EC2 +34%, and we nearly pulled an all-nighter hunting it. There was nothing to hunt: monthly charges (RIs, Hosted Zones) landing on day 1 inside the window. The zones had actually DROPPED -8.9%. How to prove the false positive in two commands.
Read articleOn a US$5,682 bill, US$896 hid under the opaque "EC2-Other" label. Opened by USAGE_TYPE: US$343/month of snapshots from already-deleted instances, US$305 of egress, expensive gp2, and inter-AZ traffic. How to dissect and cut it.
Read articleAn EC2 fleet bled ~12.5 TB/month of direct internet egress (~US$1,124). The CloudFront flat-rate math ($15/50TB) is simple arithmetic — as long as you first measure per-instance egress, which Cost Explorer won't tell you straight.
Read articleThe Auto Scaling scale-up alarm was set to fire at CPU ≥ 5%. Any traffic noise — and every deploy — spun up a fresh fleet. In two days the EC2 bill jumped from US$23 to US$272. The fix was one line.
Read articleA daily logrotate exit code 1 was aborting rotation for EVERY file on the box — not just the broken one. Three independent traps stacked, hidden behind a ModuleNotFoundError swallowed by a `|| true` in postrotate. How each failure mode behaves, and how to test rotation before it blows up in an incident.
Read articleEvery CloudFront distribution can auto-attach a WebACL with a 300 req/5min rate limit and no scope-down. On a normal afternoon it produced 1,284 blocks against legitimate wp-admin requests — editors stuck mid-upload. The fix isn't raising the limit: it's a scope-down that exempts logged-in users.
Read articleProducts landed in the mini-cart, but /cart/ always came up empty and no order ever closed. The cause was two stacked bugs: a CloudFront Function dropping the WooCommerce session cookie because of a wrong prefix, and an origin that sent no Cache-Control. One line of fix on each layer.
Read article$639/month saved ($7,668/year) in 6 weeks on a transactional AWS application. The savings came from three sequential phases, each unlocking the next. This post is about why the sequence matters — and what would have happened if we had bought the Reserved Instance first.
Read articleWordPress publishes a post, fires a webhook, Pod A receives the call and invalidates cache. Pod B keeps serving 2-hour-old content. Next.js ISR cache is per-process, not shared. Here is the architecture that solves this without Redis and without rewriting Next.js.
Read articleThe Cloud Armor policy was correctly configured and attached to the Load Balancer backend. Over 30 days: 139 real blocks, zero false positives. But DNS pointed directly to the VM IP — and user traffic never touched the LB, let alone the WAF.
Read articleIn February, a single client on a multi-tenant WordPress platform was responsible for 31% of all infrastructure egress — $342 of $1,088 total. The domain was configured on GoCache CDN, but 3,803 GB left directly from EC2. The Security Group revealed why: the World SG (0.0.0.0/0) was attached alongside the CDN SG, keeping the origin directly accessible.
Read article928,219 ModSecurity blocks accumulated in an 839 MB error.log — no rotation since February 9. All false positives. The WAF was blocking Akamai's own edge nodes because no set_real_ip_from had been configured. Anomaly scores of 40 to 60 on legitimate CDN requests.
Read articleThe WAF was up, the container running, the dashboard green. The site had been returning 500 to all visitors since morning. The cause: the nginx backend vhost file had 0 bytes — without a listen 443 directive, the reverse proxy was trying to connect to a port with nobody listening.
Read articleThe most-queried table in the system had zero indexes. Every reseller report, every cron job, every export ran full scans. RDS CPU peaked at 94.1%. After indexes: 26%. After rightsizing: db.r6g.2xlarge → xlarge, with a 39.4% peak — well-behaved. Total savings: $566/month. The sequence matters.
Read articlePHP 7.4.34 to 8.4.12 in production, on a stack with ASG + ALB + Docker containers. The Instance Refresh took exactly 8 minutes. Zero downtime. Two bake cycles were required — each one revealing a mistake the previous one hadn't anticipated. Here is the complete process and what we learned from both mistakes.
Read articleThe worker was running, Redis was healthy, and jobs kept piling up. 1,480 jobs in the delivery tracking queue, no errors in the logs. The cause: a single-threaded worker processing 6 queues sequentially, with blocking I/O on a slow queue that held up all the others.
Read article`sed -i 's/2048mb/1024mb/' docker-compose.yml` changed the file. `docker inspect` showed the container still using `--maxmemory 2048mb`. The cause: `sed -i` creates a new inode. Docker's bind mount points to the original inode. nginx -s reload reads the old file. Fix: `docker compose up -d cache`.
Read articleHigh CPU alert. Load average 15.18 on an 8-vCPU server. Initial diagnosis: CPU attack. Real cause: a crawler from range <crawler-range>/24 took down 131 PHP-FPM workers in 10 minutes, leaving 4 GB of core dumps on disk — and systemd-coredump consuming 47% CPU compressing each one.
Read articleCloudflare 504 at 8:23 PM. Nginx logged 499 — client disconnected after 60 seconds. ASG CPU: 4%. PHP-FPM ListenQueue across all three pools: 0. RDS CPU: 1-11%. The infrastructure was completely green. The incident was invisible to every standard monitor.
Read articleThe site was redirecting users to a suspicious URL, but WordPress was 100% clean — no modified files, no suspicious plugins, no unauthorized admin. The DNS resolved to IPs that did not belong to the real server. The attack was a DNS record swap in the client's GoDaddy account.
Read articleThe WordPress dashboard opened in 2ms via localhost and took 1 minute via the browser. The cause was not the server, database, or any plugin. It was an acl.conf file with satisfy any and auth_basic that received the CDN IP instead of the real visitor IP — and returned 401 to everyone.
Read articleAt 00:11 BRT, a push to the main branch took a fintech offline for 2 minutes and generated 92 HTTP 5xx errors. The ASG had scaled down to 1 instance at 21:00. The CI/CD pipeline had no idea. This combination creates a guaranteed downtime window every time someone commits at night.
Read articleSix annotations commonly found online that the Cloud Controller Manager v1.34 silently ignores. And the 409 Token Collision that freezes Load Balancer provisioning whenever you edit the Service — with the only escape being delete and recreate.
Read articleSetting up a log collection DaemonSet on an ARM64 Kubernetes cluster on OCI seems straightforward — until the first error appears. Then the second. Then six more. Each fix revealed the next problem. This post documents all 8 errors in order, with the cause and solution for each.
Read articleAn x86 runner with --platform linux/arm64 silently activates QEMU and imposes a 5-10x build time penalty. Switching to ubuntu-24.04-arm in GitHub Actions eliminates emulation and reduces ~40 min to 8-12 min without touching the Dockerfile.
Read articleCPU at 4%, but 14% of requests took more than 2 seconds — and some reached 60 seconds. The cause was hidden in 6 PHP files: CURLOPT_TIMEOUT => 0, which in cURL doesn't mean 'no limit' but 'wait forever'.
Read articleFor 20 days, 905,000 legitimate requests were blocked with 429 errors for no apparent reason. The cause: $binary_remote_addr trusting the ALB node IP instead of the real client IP. The fix: 3 lines in nginx.conf.
Read articleA WordPress portal with a 36,508-page glossary was generating 168k API calls/day — every 60 seconds Next.js ISR revalidated everything and brought PHP-FPM down. The fix: nginx srcache (OpenResty) + OCI Cache (Valkey 7.2) via stunnel, achieving 93% cache hit rate on day one.
Read articleEnabling 141 OWASP rules in production without blocking legitimate users requires more than clicking 'Enable'. Here's the full map: the false positives we found, how we fixed each one, and the traps OCI WAF doesn't document well.
Read articleA high-volume e-commerce portal was spending $1,230/month on AWS. After migrating to Oracle Cloud Infrastructure, the bill dropped to $265/month — 78% savings, $11,580/year. Here's the full breakdown of decisions, service mappings, and lessons learned.
Read articleEvery technical obstacle I hit during a real AWS-to-OKE migration — from misconfigured NSGs to TLS conflicts in Redis cache. If you're evaluating OKE for production, read this first.
Read article
