Security and Hardening Guides

A 15-step VPS security checklist for Ubuntu 24.04 and Debian 12: SSH keys, a firewall Docker can't bypass, auto-updates, fail2ban, TLS, tested backups.

Encrypt environment variables at rest with AES-256-GCM: master keys vs envelope encryption, key storage, and how Vercel, Coolify and Temps store secrets.

SSH is the most attacked service on an exposed server. Install Tailscale, close port 22 and expose only 80 and 443 — with Hetzner and Vultr costs compared.

What self-hosting your deployment platform changes for GDPR, HIPAA, SOC 2 and PCI DSS: secrets, audit trails, data residency, and what is still on you.

Scan Docker images for CVEs with Trivy after every deploy and daily: severity triage, a SHA-pinned GitHub Actions setup, and alerts for critical findings.

Temps issues TLS certificates on demand at the first handshake for sslip.io and wildcard-DNS subdomains — no pre-provisioning and no DNS control required.

The 6 best self-hosted session replay tools in 2026: Temps, OpenReplay, rrweb, PostHog, Matomo and Highlight's open-source repo, compared on licence.

Privacy-first analytics and session replay platforms in 2026: Temps, Plausible + OpenReplay, Matomo, Umami and PostHog, compared on cookies and hosting.

Set up custom domains with automatic SSL on a self-hosted platform in three steps — no Nginx config and no Certbot.

Self-hosted Plausible alternatives for 2026: Temps, Umami, Matomo, PostHog, Rybbit, GoatCounter and Ackee compared on cost, cookies, scope and setup.

Encrypted server-to-server networking between Hetzner, DigitalOcean, or any mix of providers: a manual WireGuard setup tutorial for 3+ node meshes.

Add web analytics without third-party scripts: serve tracking from your own domain so fewer blockers hide your traffic. DIY, Umami and Temps compared.

reCAPTCHA fails accessibility standards and leaks data. Proof-of-work CAPTCHA with challenge-response stops bots without tracking users or showing puzzles.

One bad UPDATE without a WHERE clause takes down production. Read-only roles, query sandboxing, row limits, and audit trails for safe database access.

Most platforms have no audit log until compliance demands one. Event schemas, immutable storage, retention policies and the query patterns SOC 2 needs.