Insights on cloud infrastructure, security and operational resilience.
$639/month saved ($7,668/year) in 6 weeks on a transactional AWS application. The savings came from three sequential phases, each unlocking the next. This post is about why the sequence matters — and what would have happened if we had bought the Reserved Instance first.
Read articleWordPress publishes a post, fires a webhook, Pod A receives the call and invalidates cache. Pod B keeps serving 2-hour-old content. Next.js ISR cache is per-process, not shared. Here is the architecture that solves this without Redis and without rewriting Next.js.
Read articleThe Cloud Armor policy was correctly configured and attached to the Load Balancer backend. Over 30 days: 139 real blocks, zero false positives. But DNS pointed directly to the VM IP — and user traffic never touched the LB, let alone the WAF.
Read articleIn February, a single client on a multi-tenant WordPress platform was responsible for 31% of all infrastructure egress — $342 of $1,088 total. The domain was configured on GoCache CDN, but 3,803 GB left directly from EC2. The Security Group revealed why: the World SG (0.0.0.0/0) was attached alongside the CDN SG, keeping the origin directly accessible.
Read article928,219 ModSecurity blocks accumulated in an 839 MB error.log — no rotation since February 9. All false positives. The WAF was blocking Akamai's own edge nodes because no set_real_ip_from had been configured. Anomaly scores of 40 to 60 on legitimate CDN requests.
Read articleThe WAF was up, the container running, the dashboard green. The site had been returning 500 to all visitors since morning. The cause: the nginx backend vhost file had 0 bytes — without a listen 443 directive, the reverse proxy was trying to connect to a port with nobody listening.
Read articleThe most-queried table in the system had zero indexes. Every reseller report, every cron job, every export ran full scans. RDS CPU peaked at 94.1%. After indexes: 26%. After rightsizing: db.r6g.2xlarge → xlarge, with a 39.4% peak — well-behaved. Total savings: $566/month. The sequence matters.
Read articlePHP 7.4.34 to 8.4.12 in production, on a stack with ASG + ALB + Docker containers. The Instance Refresh took exactly 8 minutes. Zero downtime. Two bake cycles were required — each one revealing a mistake the previous one hadn't anticipated. Here is the complete process and what we learned from both mistakes.
Read articleThe worker was running, Redis was healthy, and jobs kept piling up. 1,480 jobs in the delivery tracking queue, no errors in the logs. The cause: a single-threaded worker processing 6 queues sequentially, with blocking I/O on a slow queue that held up all the others.
Read article`sed -i 's/2048mb/1024mb/' docker-compose.yml` changed the file. `docker inspect` showed the container still using `--maxmemory 2048mb`. The cause: `sed -i` creates a new inode. Docker's bind mount points to the original inode. nginx -s reload reads the old file. Fix: `docker compose up -d cache`.
Read articleHigh CPU alert. Load average 15.18 on an 8-vCPU server. Initial diagnosis: CPU attack. Real cause: a crawler from range <crawler-range>/24 took down 131 PHP-FPM workers in 10 minutes, leaving 4 GB of core dumps on disk — and systemd-coredump consuming 47% CPU compressing each one.
Read articleCloudflare 504 at 8:23 PM. Nginx logged 499 — client disconnected after 60 seconds. ASG CPU: 4%. PHP-FPM ListenQueue across all three pools: 0. RDS CPU: 1-11%. The infrastructure was completely green. The incident was invisible to every standard monitor.
Read articleThe site was redirecting users to a suspicious URL, but WordPress was 100% clean — no modified files, no suspicious plugins, no unauthorized admin. The DNS resolved to IPs that did not belong to the real server. The attack was a DNS record swap in the client's GoDaddy account.
Read articleThe WordPress dashboard opened in 2ms via localhost and took 1 minute via the browser. The cause was not the server, database, or any plugin. It was an acl.conf file with satisfy any and auth_basic that received the CDN IP instead of the real visitor IP — and returned 401 to everyone.
Read articleAt 00:11 BRT, a push to the main branch took a fintech offline for 2 minutes and generated 92 HTTP 5xx errors. The ASG had scaled down to 1 instance at 21:00. The CI/CD pipeline had no idea. This combination creates a guaranteed downtime window every time someone commits at night.
Read articleSix annotations commonly found online that the Cloud Controller Manager v1.34 silently ignores. And the 409 Token Collision that freezes Load Balancer provisioning whenever you edit the Service — with the only escape being delete and recreate.
Read articleSetting up a log collection DaemonSet on an ARM64 Kubernetes cluster on OCI seems straightforward — until the first error appears. Then the second. Then six more. Each fix revealed the next problem. This post documents all 8 errors in order, with the cause and solution for each.
Read articleAn x86 runner with --platform linux/arm64 silently activates QEMU and imposes a 5-10x build time penalty. Switching to ubuntu-24.04-arm in GitHub Actions eliminates emulation and reduces ~40 min to 8-12 min without touching the Dockerfile.
Read articleCPU at 4%, but 14% of requests took more than 2 seconds — and some reached 60 seconds. The cause was hidden in 6 PHP files: CURLOPT_TIMEOUT => 0, which in cURL doesn't mean 'no limit' but 'wait forever'.
Read articleFor 20 days, 905,000 legitimate requests were blocked with 429 errors for no apparent reason. The cause: $binary_remote_addr trusting the ALB node IP instead of the real client IP. The fix: 3 lines in nginx.conf.
Read articleA WordPress portal with a 36,508-page glossary was generating 168k API calls/day — every 60 seconds Next.js ISR revalidated everything and brought PHP-FPM down. The fix: nginx srcache (OpenResty) + OCI Cache (Valkey 7.2) via stunnel, achieving 93% cache hit rate on day one.
Read articleEnabling 141 OWASP rules in production without blocking legitimate users requires more than clicking 'Enable'. Here's the full map: the false positives we found, how we fixed each one, and the traps OCI WAF doesn't document well.
Read articleA high-volume e-commerce portal was spending $1,230/month on AWS. After migrating to Oracle Cloud Infrastructure, the bill dropped to $265/month — 78% savings, $11,580/year. Here's the full breakdown of decisions, service mappings, and lessons learned.
Read articleEvery technical obstacle I hit during a real AWS-to-OKE migration — from misconfigured NSGs to TLS conflicts in Redis cache. If you're evaluating OKE for production, read this first.
Read article
