// devops
Practical Linux, cloud, CI/CD, and infrastructure learning logs. Every post documents a real task — the commands, the mistakes, and the principle behind each decision.
Learn the command, then learn the system behind it.
Two small additions to the deploy workflow: skip npm ci when nothing changed, and automatically delete old workflow runs after a successful production deploy.
How this site ships: two branches, one workflow file, GitHub Actions as the source of truth, and Cloudflare Workers as the target. Now with a self-opening PR and a branch protection rule that blocks direct pushes to main. Includes the errors I hit getting there.
Cron syntax, crontab editing, and why reliable automation is about building systems that remember so you don't have to.
SELinux, runtime vs permanent state, and why only the config file survives a reboot.
Execute without read, the noexec mount flag, and why debugging permissions means testing one layer at a time.
Why root SSH access reduces blast radius when revoked — and why the file change means nothing until the daemon reloads it.
Silent failure, ISO 8601, and why automation over human memory is the right mental model for access control.
Why service accounts should not be able to log in — and how /sbin/nologin enforces the principle of least privilege at the OS level.
chmod and chown are easy to memorize. But the underlying model — who can do what, and why that matters — is the part worth understanding.