Today I learned
A Stale Socket File Makes a Make Target Lie
A start target that checks whether a socket path exists will skip starting the daemon after a crash, then report success. Test for a live listener, not for a file.
TIL · Today I Learned
Today I Learned
Short technical notes, commands, fixes and behaviours learned while building and operating real systems.
Latest notes
Small discoveries worth retaining
Showing all 32 notes.
Today I learned
AppArmor Blocks a vTPM Socket Outside Home
A lab VM with a virtual TPM works from the home directory and fails from a second data volume. The profile permits socket creation under one path pattern only, and the denial is not in the tool's output.
Today I learned
The Default localnet ACL Is Wider Than Your Lab
Uncommenting the stock localnet ACL so a lab network can reach a proxy also admits every other private range, including the wifi the laptop happens to be sitting on.
Today I learned
Headless RDP Needs an Unlocked Keyring First
Remote desktop credentials go into the login keyring, and the keyring stays locked until someone logs in at the console. Setting them on a headless machine appears to succeed and produces a connect-then-drop fault.
Today I learned
OpenSSL 3 Writes PKCS#8, FreeRDP Wants PKCS#1
A self-signed key generated the usual way is rejected with no useful error. The certificate is fine and the key is fine; the private key container format is not.
Today I learned
OSC 52 Gets You Copy, Not Paste
The terminal escape sequence that lets a remote editor write to your local clipboard has no reliable read half. Configure copy through it and leave paste to the terminal.
Today I learned
SSH Agent Starts at the Console, Not Over SSH
Agent start-up logic in ~/.profile works when you log in at the machine and silently does nothing when you connect over SSH. Which startup file runs depends on how the shell was invoked.
Today I learned
VRF-Sourced Traffic Needs tcp_l3mdev_accept
A service bound to 0.0.0.0 will not accept connections arriving inside a VRF unless the kernel is told to allow it. The listener looks correct, the route is correct, and the connection is refused.
Today I learned
Cloudflare Access Checks Must Fail Closed
For a training-compliance Access evaluator, I treat missing users, invalid requests and database errors as deny conditions instead of accidental allows.
Today I learned
Bounded Retries for Cloudflare API Calls
Short-lived Cloudflare API failures can justify a retry, but diagnostic Workers still need a bounded attempt count and a useful fallback value.
Today I learned
Resolve Gateway Rule IDs Before Showing Them
Cloudflare Gateway can provide a rule ID to a custom block page, but resolving that UUID to the rule name makes support diagnostics much more useful.
Today I learned
Device Registrations Assign Virtual IPs
When a Zero Trust diagnostic page needs the virtual IPv4/IPv6 assigned to a device, the active device registration is the useful object to query.
Today I learned
CSP Nonces in Cloudflare Workers
For dynamically generated security pages, I use a per-response nonce so required inline script/style can run without falling back to a broad unsafe-inline CSP.
Today I learned
Gateway Block Pages Need Policy Context
A CF-Ray header alone does not prove a request came from Gateway, so my Worker requires Gateway-specific query context before rendering diagnostic output.
Today I learned
Separate Lifecycle for Terraform Backends
A rebuildable demo environment should not destroy the backend that stores its state, so I manage the S3/DynamoDB backend as a separate Terraform project.
Today I learned
Turning Remote Feeds into Terraform Policy Inputs
An HTTP data source can retrieve an external domain feed, but the useful pattern is to validate and normalize it before Terraform materializes enforcement objects.
Today I learned
Derive WARP Routes from Infrastructure
When Terraform already knows the cloud subnets, those values can become inputs to WARP routing instead of being copied into a second manually maintained list.
Today I learned
Workers KV Is Backup, Not Source of Truth
In my Gateway allow-list Worker, Cloudflare lists remain the enforcement state while Workers KV stores backup and synchronization metadata.
Today I learned
Why I Tag Container Images With the Commit SHA
Using the Git commit SHA as a container image tag creates a direct, immutable link between source code, pipeline and deployed artifact.
Today I learned
Deploy Manually Before Automating CI/CD
When learning a new platform, proving the deployment manually first turns CI/CD into automation of a known-good process.
Today I learned
NXDOMAIN Caching Beyond the Windows DNS Cache
A hostname can continue returning NXDOMAIN after its DNS record exists if another resolver layer has cached the earlier negative response.
Today I learned
Windows and WSL CLI Credential Sharing
A CLI working in PowerShell does not mean the same authentication or configuration will automatically exist inside WSL.
Today I learned
AD lastLogon vs lastLogonTimestamp
Why Active Directory exposes multiple logon attributes and why choosing the wrong one can give misleading results.
Today I learned
Show Astro Drafts Only in Development
A small Astro content-filtering pattern that makes draft posts visible during local development without publishing them.
Today I learned
Astro: GitHub to Cloudflare Workers
The small deployment workflow behind this site: test Astro locally, push to GitHub and let Cloudflare build the production site.
Today I learned
Cloudflare www-to-Apex Redirect
The simple 301 redirect pattern I use to keep one canonical hostname for a site.
Today I learned
DNS Names vs IPs for Egress Policy
Cloud and SaaS services move between addresses. Policy often expresses intent more accurately when it follows the application hostname.
Today I learned
Three Git Commands I Run Before Publishing
A simple pre-push check for seeing changed, unstaged and staged content before it reaches a public repository.
Today I learned
PowerShell Process-Scope Execution Policy
When a local script is blocked by execution policy, Process scope can be useful for a temporary session without changing the machine-wide setting.
Today I learned
Testing HTTP Redirects with curl.exe
Use a HEAD request to see the HTTP status and Location header without downloading the complete page.
Today I learned
WARP Fallback Domains vs Split Tunnels
DNS resolution and packet routing are related, but a WARP configuration often needs you to reason about them separately.
Today I learned
Zero Trust: Find the Failed Control Plane
Before creating an emergency bypass, work out whether the failure is identity, posture, policy, DNS, tunnel or origin.