hello world my friends

Journald quietly ate 3 GB again

On a 30 GB VPS the systemd journal is the first thing to outgrow its welcome. The default SystemMaxUse is 10% of the filesystem, which sounds modest until you remember that 10% of a small disk is still most of your headroom.

journalctl --disk-usage
journalctl --vacuum-size=200M

Making it stick means editing /etc/systemd/journald.conf rather than vacuuming by hand every few months. Set SystemMaxUse=200M, restart the service, and forget about it.

A gigabyte of swap is not cheating

There is a persistent idea that swap on an SSD-backed VPS is a mistake. In practice, a 1 GB swapfile on a 1 GB box is the difference between a slow minute during an apt full-upgrade and the OOM killer taking out the thing you actually care about.

fallocate -l 1G /swapfile
chmod 600 /swapfile
mkswap /swapfile && swapon /swapfile

Add it to /etc/fstab so it survives a reboot. Lower vm.swappiness if you want it used only as a safety net.

Webroot renewals beat the nginx plugin

The nginx authenticator rewrites your config during renewal, which is fine until the day it isn't. The webroot method touches nothing: certbot drops a file under /.well-known/acme-challenge/ and nginx serves it like any other static asset.

One location block, no surprises at 4 a.m. when the timer fires.

Unattended upgrades, with the reboot left to me

Security updates should install themselves. Reboots should not. The default Debian setup gets this right out of the box — Unattended-Upgrade::Automatic-Reboot is false — and the only thing left is to actually read /var/run/reboot-required once in a while.