Short technical notes, commands, fixes and behaviours learned while building and operating real systems.https://newcombe.dev/https://newcombe.dev/til/write-memory-makes-a-second-source-of-truth/https://newcombe.dev/til/write-memory-makes-a-second-source-of-truth/On FRR, a change made in vtysh is gone after a restart unless you save it. Save it on a router whose config file Ansible manages, and the next playbook run quietly puts the old file back.Thu, 05 Nov 2026 00:00:00 GMThttps://newcombe.dev/til/pyinstaller-cannot-see-a-streamlit-apps-imports/https://newcombe.dev/til/pyinstaller-cannot-see-a-streamlit-apps-imports/A Streamlit app is launched by file path, so PyInstaller never analyses it, and every module it imports is missing from the frozen build. Declare them — then derive the list, or test it against the filesystem, so a new module cannot be forgotten.Tue, 27 Oct 2026 00:00:00 GMThttps://newcombe.dev/til/reasoning-tokens-are-not-counted-the-same-way/https://newcombe.dev/til/reasoning-tokens-are-not-counted-the-same-way/Through the same Chat Completions endpoint, GPT models counted their hidden reasoning inside completion tokens, and Grok reported it on top. Adding up completion tokens across models adds up different things.Thu, 22 Oct 2026 00:00:00 GMThttps://newcombe.dev/til/format-table-in-a-loop-captures-formatting-not-data/https://newcombe.dev/til/format-table-in-a-loop-captures-formatting-not-data/Pipe each iteration of a loop into Format-Table and assign the loop to a variable, and you collect PowerShell's internal formatting instructions instead of your objects. The export afterwards succeeds and contains nothing useful.Tue, 13 Oct 2026 00:00:00 GMThttps://newcombe.dev/til/promtool-1x5-means-six-samples/https://newcombe.dev/til/promtool-1x5-means-six-samples/Prometheus's rule-test series notation a+bxn expands to n+1 values, not n. Off by one, every alert's timing in a test shifts by a scrape interval.Thu, 08 Oct 2026 00:00:00 GMThttps://newcombe.dev/til/google-cloud-renewal-by-learning-buys-one-year/https://newcombe.dev/til/google-cloud-renewal-by-learning-buys-one-year/Renewing a Google Cloud certification through Google Skills activities extends it by one year. The shorter renewal exam extends it by two, but its window opens far later.Tue, 29 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/a-stale-socket-file-makes-a-make-target-lie/https://newcombe.dev/til/a-stale-socket-file-makes-a-make-target-lie/A start target that checks whether a socket path exists will skip starting the daemon after a crash, then report success. Test for a live listener, not for a file.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/apparmor-blocks-a-vtpm-socket-outside-home/https://newcombe.dev/til/apparmor-blocks-a-vtpm-socket-outside-home/A lab VM with a virtual TPM works from the home directory and fails from a second data volume. The profile permits socket creation under one path pattern only, and the denial is not in the tool's output.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/default-proxy-acl-is-wider-than-your-lab/https://newcombe.dev/til/default-proxy-acl-is-wider-than-your-lab/Uncommenting the stock localnet ACL so a lab network can reach a proxy also admits every other private range, including the wifi the laptop happens to be sitting on.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/headless-remote-desktop-needs-an-unlocked-keyring/https://newcombe.dev/til/headless-remote-desktop-needs-an-unlocked-keyring/Remote desktop credentials go into the login keyring, and the keyring stays locked until someone logs in at the console. Setting them on a headless machine appears to succeed and produces a connect-then-drop fault.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/openssl-3-writes-pkcs8-freerdp-wants-pkcs1/https://newcombe.dev/til/openssl-3-writes-pkcs8-freerdp-wants-pkcs1/A self-signed key generated the usual way is rejected with no useful error. The certificate is fine and the key is fine; the private key container format is not.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/osc-52-clipboard-is-copy-only/https://newcombe.dev/til/osc-52-clipboard-is-copy-only/The terminal escape sequence that lets a remote editor write to your local clipboard has no reliable read half. Configure copy through it and leave paste to the terminal.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/profile-does-not-run-on-ssh-logins/https://newcombe.dev/til/profile-does-not-run-on-ssh-logins/Agent start-up logic in ~/.profile works when you log in at the machine and silently does nothing when you connect over SSH. Which startup file runs depends on how the shell was invoked.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/vrf-traffic-needs-tcp-l3mdev-accept/https://newcombe.dev/til/vrf-traffic-needs-tcp-l3mdev-accept/A service bound to 0.0.0.0 will not accept connections arriving inside a VRF unless the kernel is told to allow it. The listener looks correct, the route is correct, and the connection is refused.Sat, 19 Sep 2026 00:00:00 GMThttps://newcombe.dev/til/access-external-evaluation-fail-closed/https://newcombe.dev/til/access-external-evaluation-fail-closed/For a training-compliance Access evaluator, I treat missing users, invalid requests and database errors as deny conditions instead of accidental allows.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/bounded-retries-cloudflare-api-lookups/https://newcombe.dev/til/bounded-retries-cloudflare-api-lookups/Short-lived Cloudflare API failures can justify a retry, but diagnostic Workers still need a bounded attempt count and a useful fallback value.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/cloudflare-gateway-rule-id-to-name/https://newcombe.dev/til/cloudflare-gateway-rule-id-to-name/Cloudflare Gateway can provide a rule ID to a custom block page, but resolving that UUID to the rule name makes support diagnostics much more useful.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/cloudflare-one-client-virtual-ips-from-device-registrations/https://newcombe.dev/til/cloudflare-one-client-virtual-ips-from-device-registrations/When a Zero Trust diagnostic page needs the virtual IPv4/IPv6 assigned to a device, the active device registration is the useful object to query.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/csp-nonces-cloudflare-workers/https://newcombe.dev/til/csp-nonces-cloudflare-workers/For dynamically generated security pages, I use a per-response nonce so required inline script/style can run without falling back to a broad unsafe-inline CSP.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/gateway-block-page-require-context/https://newcombe.dev/til/gateway-block-page-require-context/A CF-Ray header alone does not prove a request came from Gateway, so my Worker requires Gateway-specific query context before rendering diagnostic output.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/terraform-backend-separate-lifecycle/https://newcombe.dev/til/terraform-backend-separate-lifecycle/A rebuildable demo environment should not destroy the backend that stores its state, so I manage the S3/DynamoDB backend as a separate Terraform project.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/terraform-http-data-sources-policy-inputs/https://newcombe.dev/til/terraform-http-data-sources-policy-inputs/An HTTP data source can retrieve an external domain feed, but the useful pattern is to validate and normalize it before Terraform materializes enforcement objects.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/warp-routing-subnets-derived-from-infrastructure/https://newcombe.dev/til/warp-routing-subnets-derived-from-infrastructure/When Terraform already knows the cloud subnets, those values can become inputs to WARP routing instead of being copied into a second manually maintained list.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/workers-kv-backup-not-source-of-truth/https://newcombe.dev/til/workers-kv-backup-not-source-of-truth/In my Gateway allow-list Worker, Cloudflare lists remain the enforcement state while Workers KV stores backup and synchronization metadata.Wed, 19 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/container-image-tags-git-commit-sha/https://newcombe.dev/til/container-image-tags-git-commit-sha/Using the Git commit SHA as a container image tag creates a direct, immutable link between source code, pipeline and deployed artifact.Wed, 12 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/manual-deployment-before-ci-cd/https://newcombe.dev/til/manual-deployment-before-ci-cd/When learning a new platform, proving the deployment manually first turns CI/CD into automation of a known-good process.Wed, 12 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/negative-dns-caching-beyond-windows/https://newcombe.dev/til/negative-dns-caching-beyond-windows/A hostname can continue returning NXDOMAIN after its DNS record exists if another resolver layer has cached the earlier negative response.Wed, 12 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/windows-wsl-cli-credentials/https://newcombe.dev/til/windows-wsl-cli-credentials/A CLI working in PowerShell does not mean the same authentication or configuration will automatically exist inside WSL.Wed, 12 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/ad-lastlogon-vs-lastlogontimestamp/https://newcombe.dev/til/ad-lastlogon-vs-lastlogontimestamp/Why Active Directory exposes multiple logon attributes and why choosing the wrong one can give misleading results.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/astro-drafts-local-development/https://newcombe.dev/til/astro-drafts-local-development/A small Astro content-filtering pattern that makes draft posts visible during local development without publishing them.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/cloudflare-workers-github-deployment/https://newcombe.dev/til/cloudflare-workers-github-deployment/The small deployment workflow behind this site: test Astro locally, push to GitHub and let Cloudflare build the production site.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/cloudflare-www-to-apex-redirect/https://newcombe.dev/til/cloudflare-www-to-apex-redirect/The simple 301 redirect pattern I use to keep one canonical hostname for a site.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/domain-aware-egress-policy/https://newcombe.dev/til/domain-aware-egress-policy/Cloud and SaaS services move between addresses. Policy often expresses intent more accurately when it follows the application hostname.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/git-check-before-publish/https://newcombe.dev/til/git-check-before-publish/A simple pre-push check for seeing changed, unstaged and staged content before it reaches a public repository.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/powershell-execution-policy-process-scope/https://newcombe.dev/til/powershell-execution-policy-process-scope/When a local script is blocked by execution policy, Process scope can be useful for a temporary session without changing the machine-wide setting.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/testing-http-redirects-curl/https://newcombe.dev/til/testing-http-redirects-curl/Use a HEAD request to see the HTTP status and Location header without downloading the complete page.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/warp-fallback-domains-vs-split-tunnels/https://newcombe.dev/til/warp-fallback-domains-vs-split-tunnels/DNS resolution and packet routing are related, but a WARP configuration often needs you to reason about them separately.Sat, 08 Aug 2026 00:00:00 GMThttps://newcombe.dev/til/zero-trust-troubleshoot-control-plane/https://newcombe.dev/til/zero-trust-troubleshoot-control-plane/Before creating an emergency bypass, work out whether the failure is identity, posture, policy, DNS, tunnel or origin.Sat, 08 Aug 2026 00:00:00 GMT