GitLab fine-grained personal access tokens, one action at a time
A GitLab fine-grained token holds a grant, not scopes: REST refuses outside it, GraphQL answers null. I derive what each API action needs, ahead of time.
Notes
#security
Hardening notes from real production deployments — mutual TLS, Content Security Policy, and deception techniques like tarpits and honeypots that slow down or trap malicious traffic before it reaches anything that matters.
11 posts about this topic
Your 4-Digit PIN Is Fine: Device-Bound Keys on ESP32-S3
Why PBKDF2 iterations can't protect a 4-digit PIN on a microcontroller, and how an eFuse-HMAC device secret plus HKDF stops offline brute force.
A Vault File That Fails Closed: Encrypt-then-MAC on an MCU
How a hardware password manager authenticates every vault file before it decrypts: encrypt-then-MAC, verify-before-decrypt, and fail-closed reads.
Running a Tor Bridge on Linux: obfs4 and WebTunnel Guide
Guide to running obfs4 and WebTunnel Tor bridges on Linux with Nginx camouflage, firewall hardening, Prometheus monitoring, and CrowdSec.
MikroTik WireGuard VPN: Dual-Stack IPv4/IPv6 Configuration
Configure WireGuard VPN on MikroTik RouterOS with full IPv4/IPv6 dual-stack. Access your home network with native IPv6 from any connection.
MikroTik Honeypot: Trap & Auto-Block Port Scanners
Configure a MikroTik honeypot to detect port scanners, log malicious activity, and auto-block attackers using firewall address lists and the RAW table.
Implementing a Tarpit in Nginx: Trap Malicious Scanners
Implement an Nginx tarpit to slow down and trap malicious bots, vulnerability scanners, and brute-force attackers. Includes CrowdSec integration.
Mastering QUIC and HTTP/3 with Nginx: The Complete Guide
Deep dive into QUIC and HTTP/3 — technical architecture, security features, and step-by-step Nginx configuration for production deployment.
Content Security Policy (CSP) with Nginx: The Complete Guide
Master Content Security Policy from zero to A+ — nonces, hashes, strict-dynamic, Trusted Types, bypass prevention, and production Nginx configs.
Mastering Virtual Files in Nginx: A Complete Guide
Serve virtual files in Nginx without disk I/O. Covers root vs alias vs try_files, named locations, Kubernetes health endpoints, and containers.
Mastering Mutual TLS (mTLS) with Nginx: A Deep Dive
Implement Mutual TLS (mTLS) with Nginx — create a CA, generate client certificates, configure CRL and OCSP revocation, and enable Zero Trust.
No posts match your filters.