Rich Gibbs
Practical, opinionated notes on Linux server security, AWS hygiene, and indie-founder operations from Rich Gibbs.
-
Cut a Docker VM from 8 GB after measuring RAM
I cut this Docker guest from 4 vCPU and 8 GB to 3 vCPU and 6 GB on 2026-08-21 after measuring RAM well under allocation, so another VM on the same host could use the unused memory.
-
SG300-10: one management interface, and other ways to lock yourself out
Notes on putting a used SG300-10 managed switch into the lab: why it beat a UPS on the shopping list, the single-management-interface trap, a deliberately weakened SSH config scoped to one host, and the order the rest of the work has to happen in.
-
The $172 mini PC that runs my whole homelab
A seven-year-old refurbished ThinkCentre M720q carries my entire lab. Notes on verifying the specs, a driver bug that looked like a bad cable for a week, and the upgrades I decided not to buy.
-
Why I started a homelab: cost, control, and a portfolio I can show
The three goals behind my homelab repo, how the documentation is organised, and why the runbooks record the mistakes as well as the fixes.
14,469 honeypot sessions in seven days. Only 250 requested a terminal.
Seven days of Cowrie logs separated commodity bot traffic from likely human-operated intrusion and a reused SSH campaign.
-
159 exploit probes hit my server in 24 hours. Here’s how I checked for signs that any succeeded.
A practical server-log triage playbook for separating routine WordPress, PHP, and login probes from evidence of successful access.
-
The $0 firewall audit: 6 commands that catch what UFW status misses
Your UFW says active. Your security groups say restricted. But what's actually listening? The read-only audit that finds the port you forgot about.
-
DKIM key rotation for indie founders: the 15-minute zero-downtime swap
You have DKIM set up. Now you need to rotate the keys before they expire or leak. The dual-selector trick that lets you swap without bouncing a single message.
-
Server monitoring & alerting for indie founders who self-host
You have the server running. Now you need to know when it is on fire before your users do. The minimal, working monitoring stack that actually gets used.
-
I ran a read-only server audit. Here's what I found that the scanners missed.
Found a world-readable archive with API keys sitting in /var/backups/. A read-only audit finds the quiet risks that scanners miss.