Rich Gibbs
Practical, opinionated notes on Linux server security, AWS hygiene, and indie-founder operations from Rich Gibbs.
-
Docker Compose on one VPS: the production checklist before you outgrow it
A practical checklist for running Docker Compose on a single VPS: restart policy, health checks, log rotation, backups, deploy path, ports, secrets, rollback, and alerts.
-
Before an AI agent gets real tool access, map what it can actually do
A permission-map checklist for AI agents touching GitHub, Gmail, Slack, Stripe, AWS, or MCP: account, verbs, spend, approvals, logs, kill switches.
-
Redacted evidence beats account access: how to get a useful QuickCheck without handing over credentials
A practical guide for founders who need AI/API cost help, email DNS review, inbox cleanup, or server hygiene advice without sending passwords, API keys, SSH keys, mailbox access, or customer data.
-
AI/API bill jumped? Find the token burn before it eats the month
A practical checklist for founders running agents, internal AI tools, or automation hosts: stuck jobs, expensive model defaults, fallback loops, cache misses, and missing budget controls.
-
EC2 read-only hardening audit: what Inspector misses, and what to check by hand (2026)
AWS Inspector and IAM Access Analyzer are great at IAM-side and CVE-side findings, and they will quietly miss several of the EC2 instance-level problems most likely to get a small SaaS owned. Here is the read-only EC2 hardening audit a one-person ops team can actually run in an hour.
-
Encrypting Your EBS Root Volume Without Rebuilding the Server (AWS 2026)
A practical, indie-founder guide to migrating an unencrypted EC2 root volume to KMS-encrypted EBS — without rebuilding the instance, losing data, or fighting AZ mismatch and root device name traps.
-
Security audit vs penetration test: which one does an indie founder actually need?
A read-only security audit and a penetration test are not the same thing, and asking for the wrong one will either waste your money or leave the actual problem in place. Here is the boring, working distinction for a 1-5 person SaaS team in 2026.
-
DMARC aggregate reports without a SaaS: read your own rua XML in 30 minutes
You don't need Postmark, Valimail, or dmarcian to read DMARC aggregate reports. 120 lines of stdlib Python on the same VPS that runs your mail will tell you the truth — here is what those XML reports actually contain and how to parse them yourself.
-
I wouldn't give a SaaS my Gmail to clean it. Here's the 30-line read-only alternative.
The Survey-then-Delete method for cleaning a five-figure unread Gmail backlog using a read-only script that runs under your own Google account. No third-party OAuth scope creep, no mailbox handed to a SaaS, no tokens leaving your laptop.
-
I had 80,000 unread emails. Here's the cleanup playbook (no apps, no OAuth)
A working, non-SaaS playbook for clearing tens of thousands of old unread emails from a personal Gmail. Survey first, delete second. The 30-day Trash window is your safety net.