Keeping a single-port ingress tidy

Notes from running one TLS endpoint for several services without losing the ability to reason about who is talking to what.

On observability you can afford

Logs nobody reads are a cost, not a feature. A short checklist for deciding what to keep, and for how long.

Automating the boring maintenance

Unattended upgrades, certificate renewal, and the one backup that actually gets restored during an incident.

Reading a TLS handshake for the first time

SNI, ALPN, session tickets: what actually shows up on the wire, and why it matters when debugging a proxy.