self-hosting The house rules for adding one more app to a crowded VPS One folder, one compose file, a .env.example, a setup.sh that writes the secrets, and nothing in git that the server owns. The conventions I add apps by, and where each one came from.
self-hosting The Bad Gateway that was really Gogs saying no Adding a GitHub mirror to Gogs kept failing with Bad Gateway. It took an hour, an SSH-key detour and a Traefik access log to find a plain 403 underneath.
devops No Exposed Database Ports: Routing Everything Through Traefik Labels The production docker-compose for Fishing Tracker Pro publishes zero ports except Traefik's own. Postgres, backend, and frontend are reachable only through label-based routing on a shared Docker network.
docker Three Docker Networks, Fixed Subnets, One Reason: Firewall Rules That Don't Move frontend, socket, and backend are declared with fixed CIDR blocks on vmi2633427 for a reason that has nothing to do with routing and everything to do with what a firewall rule can trust.
docker Don't Give Your Reverse Proxy Root on the Host Traefik needs to know which containers exist and what labels they carry — it does not need exec, write, or image management. tecnativa/docker-socket-proxy is the difference between those two things.
traefik The TLS Handshake Nobody at Home Sees: Full vs Full-Strict Behind Cloudflare Traefik on vmi2633427 issues no certificates and holds no ACME credentials — the browser's cert and the origin's cert are two entirely different documents, and closing the gap between them is one flag in Cloudflare's dashboard.
