Notes on networking, self-hosting, and small software.
Spent the weekend moving my resolver setup to a small local instance with DNSSEC validation enabled everywhere. Notes on what broke, what the logs actually said, and the final configuration that survived a week of real use.
Short-lived certificates and automated renewal are the default now. A few operational lessons: monitor expiry like you monitor disk space, keep the renewal path boring, and test it before it matters.
One CPU and two gigabytes of RAM go a long way when every service has a reason to exist. My checklist for keeping a small server patched, backed up, and boring in the best possible way.