A running log of things learned while keeping a handful of servers alive: what broke, why, and what the fix looked like a week later.
With ACME renewal windows now suggested by the CA itself, the question shifts from "when do I renew" to "how do I know it worked". A two-line health check that reads the expiry date from disk beats any dashboard.
Reading the SNI field before terminating TLS lets a single listener hand connections to entirely different backends. Notes on keeping real client addresses intact with the PROXY protocol, and the reload gotcha that cost me a minute of downtime.
A monthly drill: pick a random database dump, restore it into a scratch container, run three queries. Twenty minutes, and the only reliable way to sleep well.
Default-deny inbound, an explicit allow list with comments, and the SSH rule added before anything is enabled. Boring, and exactly why it works.