Topics
The knowledge base is organized by operational domain, with product and technology tags kept secondary.
Domains
Applications & Services
1C:Enterprise 8 + Postgres Pro 1C + Apache on AlmaLinux
A production-backed deployment baseline for 1C:Enterprise 8.3.27, Postgres Pro 1C 17 and Apache 2.4 on AlmaLinux 9, including service layout, web publication, monitoring and rollback boundaries.
PostgreSQL 17 Maintenance for 1C: XID Age, VACUUM, and Autovacuum
Production case study: Postgres Pro 1C 17.10, XID age warnings, targeted maintenance of 18 databases, and database-level freeze statistics.
Automation & Configuration
Linux
Mail & Services
Diagnosing deferred Mailcow delivery: local firewall or remote MX refusal?
A short evidence-driven workflow for distinguishing local SMTP connectivity problems from selective refusal by a remote mail server.
Mailcow: safely finding and removing a malicious message from all mailboxes
An incident-response runbook for identifying a suspicious message across Mailcow/Dovecot mailboxes, validating the exact match, expunging it safely and verifying the result.
Monitoring & Security
1C:Enterprise monitoring with node_exporter textfile collector, Prometheus and Grafana
A production-backed 1C:Enterprise 8 monitoring pattern using a systemd timer, a custom shell collector, node_exporter textfile metrics, Prometheus and Grafana.
Asterisk 13 monitoring with node_exporter textfile metrics, Prometheus and Grafana
A production-backed legacy Asterisk 13 monitoring pattern using a systemd timer, a custom CLI collector, node_exporter textfile metrics, Prometheus and Grafana.
Blackbox monitoring with HTTP, TCP, ICMP and TLS probes
A production-backed Blackbox Exporter pattern for endpoint readiness, TCP reachability, ICMP canaries, TLS verification and certificate-expiry alerting.
Infrastructure observability architecture: Prometheus, Grafana, Loki, Zabbix and Wazuh
A production-backed operating model for combining metrics, availability checks, logs and security telemetry across Linux, Windows, virtualization, storage, databases, telephony and network infrastructure.
Linux host monitoring with node_exporter, Prometheus file_sd and alert rules
A production-backed Linux monitoring pattern using node_exporter 1.12.1, Prometheus file-based service discovery, recording rules and layered host alerts.
PostgreSQL / Postgres Pro monitoring with Prometheus and postgres_exporter
A production-backed monitoring pattern for PostgreSQL and Postgres Pro using postgres_exporter, Prometheus and Grafana, with database-native metrics separated from generic Linux monitoring.
Proxmox–NetBox drift detection with systemd, HTTPS API and Zabbix 7.0
A verified daily read-only audit of Proxmox hosts against NetBox 4.7 with a trusted CA, API v2 token, systemd timer, sanitized Zabbix metrics and four triggers.
Proxmox QEMU/LXC inventory in NetBox: vNIC import and daily drift monitoring
A production case study of QEMU/LXC discovery with Python, guarded NetBox 4.7 VMInterface/MAC import, systemd scheduling and Zabbix 7.0 guest drift monitoring.
Monitoring Proxmox VE with Prometheus using API tokens and a trusted CA
A production-oriented pattern for collecting Proxmox metrics without disabling TLS verification or using a full administrator account.
RouterOS and NetBox: read-only IPAM drift detection with SSH and API
A practical RouterOS 7 versus NetBox 4.7 IPAM audit: exact VLAN, prefix and interface/IP comparison, least-privilege SSH, read-only API access and reviewed IPsec exceptions.
Monitoring a RouterOS–NetBox IPAM audit with systemd and Prometheus
A production-focused pattern for IPAM drift monitoring: atomic Node Exporter textfile metrics, systemd timers, PromQL alerts and Alertmanager routing verification.
Safe production rollout of an IPAM auditor: pinned release, systemd rollback and next-day verification
A practical RouterOS–NetBox IPAM auditor migration without interrupting monitoring: pinned GitHub commit, 121 offline tests, shadow metrics, systemd drop-in and scheduled-run validation.
Network monitoring with SNMP Exporter and Prometheus
Production-backed SNMP monitoring architecture for MikroTik and Zyxel devices using snmp_exporter 0.30.1 and Prometheus file-based discovery.
Wazuh SCA: validating scans and rolling out custom hardening policies
A production-oriented workflow for verifying Wazuh Security Configuration Assessment, adding custom policies safely and validating results without broadening endpoint attack surface unnecessarily.
Correlating Windows DNS and MikroTik IPFIX: domains and traffic volume in Grafana
A practical monitoring architecture where Windows AD DNS provides domain context, MikroTik IPFIX provides traffic volume, Loki stores events, and Grafana brings the data together.
Windows Server monitoring with windows_exporter and Prometheus
A production-backed Windows Server monitoring pattern using windows_exporter 0.31.8, Prometheus file-based discovery, recording rules and alerting.
SSH login alerts via XMPP with sendxmpp and verified TLS
A production-oriented pattern for sending SSH login notifications to a self-hosted XMPP server without Telegram, embedded credentials or disabled TLS verification.
Networking
MikroTik RouterOS 7: multi-WAN policy routing with per-VLAN failover
A production-oriented pattern for steering different VLANs through preferred uplinks while preserving controlled failover and verifiable egress behavior.
Migrating multi-site IPsec IKEv2 tunnels from pfSense to MikroTik RouterOS 7
A production case study for moving a four-site policy-based IPsec topology from pfSense to MikroTik with staged cutovers, FQDN peers, validation, and rollback.
Proxmox & Virtualization
Inventorying nine Proxmox VE nodes in NetBox 4.7: DMI, MAC addresses and network topology
Production case study: read-only collection of nine Proxmox hosts and 362 interfaces, safe enrichment of existing NetBox devices, and a verified idempotent dry-run.
Proxmox VE: rolling kernel maintenance with one-boot fallback
A production-oriented runbook for changing the kernel across a multi-node Proxmox VE cluster while preserving quorum, evacuating workloads and retaining a fast rollback path.
Proxmox VE: collecting evidence before rebooting a frozen Windows VM
A production incident-response runbook for preserving host, QEMU, task and storage evidence before resetting an unresponsive Windows guest.
Storage & Backup
Immich on TrueNAS SCALE: Android photo backup, HTTPS and ZFS
Production-style homelab deployment of Immich with TrueNAS SCALE 25.10, ZFS RAIDZ2, MikroTik split DNS, Nginx TLS and PostgreSQL backups.
Migrating Ceph authentication keys to aes256k without losing cluster access
A staged operational approach to rotating Ceph service and client keys while preserving quorum and administrative access.
Proxmox Backup Server: backup policy, exclusions, verification and restore testing
A production-oriented framework for defining PBS backup coverage, retention, prune and GC jobs, verification, restore drills and explicitly accepted exclusions.
Storage and Backup
Voice & Telephony
Windows
Renaming an Active Directory domain in production: a practical case
A production-oriented Active Directory domain rename case using rendom and gpfixup, covering DNS, SYSVOL, GPOs, SPNs, certificates, NAS integration and post-migration validation.
Automated software deployment and updates with GPO: PowerShell, MSI and SHA256 using 7-Zip
A production case study of rolling out 7-Zip 26.04 with Group Policy Preferences, scheduled tasks, SYSVOL, manifest.json, SHA256 verification and PowerShell.
VixWin Platinum 3.6.3 via GPO: preparing HKCU before the first launch
Active Directory case study: roaming user profiles, VixWin registry initialization, NAS-backed image database, logon scripts, PowerShell, and GPO filtering.
Safe Windows 10/11 Appx cleanup through GPO: user logon, Audit/Enforce and SystemApps guards
A user-GPO case study of exact-name Appx cleanup, PowerShell Audit/Enforce modes, protected packages, OneDrive safeguards and source evolution v1.0–v1.4.
Veyon and unstable RDP: troubleshooting Interception, UpperFilters and GPO deployment
A Windows Veyon 4.11.3–4.11.4 case study: intermittent RDP black screens, Interception filter drivers, UpperFilters, safe removal and a controlled GPO deployment pilot.
Veyon from Windows WORKGROUP to Active Directory clients: authentication, troubleshooting and GPO deployment
A Veyon 4.11.3 case study: a non-domain Windows Master, matching local credentials, Security 4625, access-control rules, DNS redirection and PowerShell/GPO deployment v1.3.
Windows Server 2025: two-DC Active Directory with DNS and restricted RDP
A production-oriented pattern for deploying two Active Directory domain controllers with AD-integrated DNS, secure dynamic updates and GPO-based RDP access boundaries.