GitLab fine-grained personal access tokens, one action at a time
A GitLab fine-grained token holds a grant, not scopes: REST refuses outside it, GraphQL answers null. I derive what each API action needs, ahead of time.
Notes
Blog
Thoughts, tutorials, and engineering notes.
Real projects, AI-assisted drafting. I document my actual experiments and code, using AI tools to structure and polish the final write-ups.
What building a GitLab MCP server taught me about GitLab's API
Building and checking an MCP server against GitLab found a 401 that meant 403 and writes answered as successes that saved nothing; each went upstream.
Your 4-Digit PIN Is Fine: Device-Bound Keys on ESP32-S3
Why PBKDF2 iterations can't protect a 4-digit PIN on a microcontroller, and how an eFuse-HMAC device secret plus HKDF stops offline brute force.
A Vault File That Fails Closed: Encrypt-then-MAC on an MCU
How a hardware password manager authenticates every vault file before it decrypts: encrypt-then-MAC, verify-before-decrypt, and fail-closed reads.
What the Linker Won't Do: Packing i18n Strings on an MCU
A build-time generator packs firmware UI translations into one string pool indexed by uint16 offsets, halving the index table on a 32-bit MCU.
Running a Tor Bridge on Linux: obfs4 and WebTunnel Guide
Guide to running obfs4 and WebTunnel Tor bridges on Linux with Nginx camouflage, firewall hardening, Prometheus monitoring, and CrowdSec.
MikroTik PPPoE + DHCPv6-PD: Dual-Stack for DIGI Spain
Configure PPPoE with DHCPv6 Prefix Delegation on MikroTik RouterOS for DIGI Spain. VLAN tagging, SLAAC, prefix change handling, and firewall rules.
MikroTik WireGuard VPN: Dual-Stack IPv4/IPv6 Configuration
Configure WireGuard VPN on MikroTik RouterOS with full IPv4/IPv6 dual-stack. Access your home network with native IPv6 from any connection.
MikroTik Honeypot: Trap & Auto-Block Port Scanners
Configure a MikroTik honeypot to detect port scanners, log malicious activity, and auto-block attackers using firewall address lists and the RAW table.
Implementing a Tarpit in Nginx: Trap Malicious Scanners
Implement an Nginx tarpit to slow down and trap malicious bots, vulnerability scanners, and brute-force attackers. Includes CrowdSec integration.
Mastering QUIC and HTTP/3 with Nginx: The Complete Guide
Deep dive into QUIC and HTTP/3 — technical architecture, security features, and step-by-step Nginx configuration for production deployment.
Content Security Policy (CSP) with Nginx: The Complete Guide
Master Content Security Policy from zero to A+ — nonces, hashes, strict-dynamic, Trusted Types, bypass prevention, and production Nginx configs.
Mastering Virtual Files in Nginx: A Complete Guide
Serve virtual files in Nginx without disk I/O. Covers root vs alias vs try_files, named locations, Kubernetes health endpoints, and containers.
Mastering Mutual TLS (mTLS) with Nginx: A Deep Dive
Implement Mutual TLS (mTLS) with Nginx — create a CA, generate client certificates, configure CRL and OCSP revocation, and enable Zero Trust.
No posts match your filters.