DevOps

BitTorrent and private-tracker clients benefit from accepting inbound connections, but CGNAT prevents that. Your ISP places multiple subscribers behind one public IPv4 address, so there is no inbound mapping for the home server. Port forwarding on the home router does not help because the relevant NAT is upstream at the ISP.

A VPS with a public address and a WireGuard tunnel can relay the traffic. It receives torrent connections on a port range and forwards them through the tunnel to the home server. To peers, the home server is then reachable at the VPS's public address.

The Linux OOM killer runs when the kernel can no longer reclaim memory. If anonymous memory exceeds RAM and has nowhere to go, the kernel scores processes and kills the one with the highest score. On a small VPS, that can be the application, database, or build job you meant to keep alive. A low-priority daemon with a large RSS can lose, but so can one large process when there is no swap.

Swap gives anonymous pages backing storage under memory pressure. The kernel can evict those pages instead of killing the owning process, at the cost of latency when it reads them back. On a VPS, that delay is often preferable to losing the process.

I run two inexpensive OranMe VPS instances: one has 0.1 CPU and 128MB RAM, the other 0.5 CPU and 512MB. They are only suitable for light self-hosted work, so I installed Debian without a desktop environment.

The 0.1 CPU box kept shutting down. In the OranMe control panel, its CPU usage hit the limit shortly before each crash. That looked like the provider's abuse protection killing the VM. /var/log/system.log showed that the spikes matched apt's periodic tasks.

Nginx is an event-driven web server. Its worker pool multiplexes I/O across many connections instead of assigning a thread to each one. It is commonly used for static sites, reverse proxies, and TLS termination.

Remote LAN access lets devices reach a private network from anywhere. ZeroTier uses a virtual L2 network with P2P paths. Tailscale builds on WireGuard with NAT traversal. Cloudflare Tunnel uses a reverse proxy model.

Default Linux kernel parameters target general-purpose workloads. Servers handling high traffic, many connections, or heavy I/O need tuning. This guide covers the sysctl parameters that matter and why.

Shadowsocks-libev is an encrypted SOCKS5 proxy. It does not tunnel a whole network stack the way a VPN does. The client exposes a local SOCKS5 port that applications point at, and the server relays each connection to its destination over an encrypted link. The stream carries no recognizable protocol handshake, which is why it appears as random bytes to an observer. The usual topology puts the client behind a censoring network and the server on an overseas VPS.

This post covers the libev implementation on Debian-family systems. The Chinese censor does more than watch traffic passively. It actively probes suspected servers, and a confirmed Shadowsocks server has its IP blocked in mainland China. Cipher choice determines how long a server lasts, not whether it is invulnerable.

ACME is the protocol for automated certificate management. Let's Encrypt speaks ACME. Certbot is the official ACME client from EFF. This guide covers Certbot with Cloudflare DNS validation.

Trojan, from the trojan-gfw project, is a proxy protocol that uses TLS with a valid certificate on a real domain. Its traffic resembles ordinary HTTPS browsing.

The server fronts a web server with ordinary content. A probe receives that website instead of a dead end.

A container is not a virtual machine. VMs emulate hardware and run a full OS kernel. Containers share the host kernel and isolate processes using namespaces (which partition what a process sees: filesystem, network, PIDs, users) and cgroups (which cap what it uses: CPU, memory, I/O).

Jekyll is a static site generator written in Ruby. It renders Markdown through Liquid templates into static HTML. The published site is a directory of files with no database and no server-side runtime at request time.

On Apple Silicon, the Ruby toolchain needs a little setup first: Homebrew, a Ruby version manager, and the gem path.