Insights
Insights & Education
Practical knowledge for building, securing, and scaling your agency. These are the technical workflows and strategic insights I use daily as a technical partner.
-
Cybersecurity & Hardening
Docker Hardened Images Are Free: Near-Zero-CVE Containers for Self-Hosters
Docker Hardened Images are now free: near-zero-CVE, non-root, distroless-style containers. How to pull them and pair them with rootless Docker.
-
Agency Growth & Strategy
AI Workflows for Agencies: The Opportunity Behind Garry Tan's Keynote
Garry Tan is right about AI-native companies. From my hosting seat I see the wreckage of DIY AI. Here's the AI workflows for agencies opportunity most miss.
-
Operations & Automation
Why I Switched to Codex
My honest Codex vs Claude Code comparison: subscription value, banked resets, and why Codex is now my main agent while Claude Code still does the planning.
-
Cloud Infrastructure
Why You Still Need Dedicated Hosting in 2026 (Your SaaS Panel Doesn't Manage Your Server)
A SaaS panel on a rented VPS is not managed hosting. Here's the responsibility gap that leaves you owning the risk, and why dedicated hosting still wins in 2026.
-
Cybersecurity & Hardening
Rootless Docker Made Easy: My One-Shot Provisioning Script
Installing rootless Docker by hand is fiddly. My provisioning script sets up the user, subuid maps, lingering, and DOCKER_HOST in one command.
-
Cybersecurity & Hardening
AI Agent Prompt Injection: The Lethal Trifecta That Burned a Business Owner
A business owner wired an AI agent to his inbox and got robbed by one email. Here's the AI agent prompt injection pattern, and how to shut it down.
-
Cloud Infrastructure
Why People Complain About Contabo and OVHcloud (and When It's Fair)
Contabo and OVHcloud complaints are mostly real but predictable. Here's what's fair, what's overblown, and who each budget host actually suits.
-
Cloud Infrastructure
Hetzner Price Increase 2026: Why It's Fair and Where It Falls Short
Hetzner's 2026 price increase is a fair response to surging RAM and storage costs. The real miss is how Hetzner communicated it to its customers.
-
Operations & Automation
AI Workflow Optimization: Building a Zero-Trust, Multi-Model Moat
AI workflow optimization with a zero-trust mindset: how I reduce hallucinations and ship safer code with Gemini, Claude, and GPT.
-
Operations & Automation
WDM Docker Manager: A Safer Way to Install Self-Hosted Apps
WDM Docker Manager is my safer TUI and CLI for installing curated self-hosted Docker stacks with signed releases, backups, and sane defaults.
-
Cybersecurity & Hardening
Hermes Agent Deployment: Secure AI Agent Infrastructure for Private Automation
Hermes Agent: the secure AI agent infrastructure pattern I ship for companies. Gateway/sandbox split, rootless Docker, scoped tokens, monthly restore drills.
-
Open Source Solutions
Escaping Discord: How to Launch a Secure Self-Hosted Stoat Server
Discord's age-verification stack leaked 70,000 IDs. Here is how to migrate your community to a properly hardened, self-hosted Stoat server on Docker.
-
Cloud Infrastructure
xCloud Security Review: Pushing for Secure by Default Docker Hosting
I audited xCloud's Docker hosting. The isolation, AppArmor, and per-app users are solid. Here are the daemon and compose defaults they should ship next.
-
Cybersecurity & Hardening
Defense in Depth: A Secure Web Application Architecture Built on Boring Decisions
Defense in depth is what actually keeps a web application secure: seven concentric, independent layers from the perimeter to the database. Boring decisions that compound.
-
Cybersecurity & Hardening
Dirty Frag (CVE-2026-43284): How Webnestify Mitigated the Linux Kernel LPE Two Hours After Disclosure
Dirty Frag is a new Linux kernel LPE in the Dirty Pipe and Copy Fail family. Here is the bug, the CVE pair, and how we mitigated it in two hours.
-
Cybersecurity & Hardening
Copy Fail (CVE-2026-31431): How Webnestify Patched the Linux Kernel Zero-Day on Disclosure Day
Copy Fail (CVE-2026-31431) gave attackers root on nearly every Linux server. Here's what the bug does and how I patched our managed fleet on day zero.
-
Cloud Infrastructure
Serverless Hosting Hidden Costs: An Agency Owner's Guide
An honest take on the hidden costs of Vercel, Netlify, Cloudflare Pages, and Railway: surprise bills, lock-in, and outages an agency can't afford.
-
Agency Growth & Strategy
You Are the Brain, AI Is the Tool
26 hours and $200 building Webnestify Hub with AI tools. The 14-hour spec, the security gaps AI won't fix on its own, and the deployment war that 'build with AI in 60 minutes' demos never show.
-
Cybersecurity & Hardening
Cybersecurity as a Human Right: Why I'm Founding Webnestify Education
Cybersecurity is no longer a technical concern; it's tied to safety, privacy, and dignity. Why I'm founding Webnestify Education, a non-profit for accessible digital safety training.
-
Open Source Solutions
Can Open-Source Be a Valid Business Strategy? What n8n, Pangolin, and Netbird Show
n8n raised $180M at a $2.5B valuation. Pangolin closed a YC seed round. Netbird hit $5.4M. Open-source isn't a community hobby anymore; it's a business model that's beating closed-source incumbents.
-
Cloud Infrastructure
Would You Give a Stranger the Keys to Your House? Why I Moved Away from SaaS Cloud Control Panels
SaaS control panels need root access to your servers. After years of using them, I moved to Enhance, a self-hosted panel. The trade-offs, the migration story, and where SaaS still fits.
-
Cybersecurity & Hardening
The Day I Saved (and Scared) My Insurance Agent: A Lesson on Mixing Personal and Business Tech
How a routine insurance renewal turned into a real-world cybersecurity demonstration. The risks of mixing personal and business devices, and the practical fixes that actually work.
-
Operations & Automation
AI WordPress Automation With DeepSeek, n8n, and Baserow
How I run AI WordPress automation in production: a self-hosted n8n + Baserow + DeepSeek stack that drafts posts at 2% of GPT-4 cost without SEO penalty.
-
Cybersecurity & Hardening
2FAuth: The Self-Hosted 2FA Manager I Actually Trust
How I deploy 2FAuth as a self-hosted 2FA vault: the Docker stack, the proxy in front, the backup discipline, and why I keep it behind a VPN.
-
Cybersecurity & Hardening
Authentik: One Self-Hosted Login for All My Apps
How I deploy Authentik as a self-hosted identity provider: the Docker stack, the Postgres and Redis pieces, the SSO flows, and when SSO is overkill.
-
Open Source Solutions
BookStack: My Self-Hosted Wiki for Client Handovers
How I deploy BookStack as a self-hosted documentation wiki: the Docker stack, the proxy, the backup discipline, and why it beats Notion for agencies.
-
Operations & Automation
Code-server: Self-Hosted VS Code in Your Browser
How I deploy code-server for a portable VS Code in the browser: the Docker stack, the proxy in front, and the workspace-backup rule that saved a week of work.
-
Cybersecurity & Hardening
CrowdSec Installation and Server Protection on Ubuntu
How I install CrowdSec on every fresh Ubuntu server: package repo, firewall bouncer, the collections worth running, and the console wiring that closes the loop.
-
Cybersecurity & Hardening
CrowdSec for WordPress: Bouncing Bad IPs at the App Layer
How I wire CrowdSec's WordPress bouncer to the LAPI on the same server, what bouncing level to pick, and the failure modes I've watched it catch in production.
-
Cybersecurity & Hardening
Cryptgeon: Self-Hosted Secret Sharing vs PrivNote
How I deploy Cryptgeon as a self-hosted secret sharing service: the Compose file, the TTL defaults I trust for client onboarding, and the proxy in front.
-
Cloud Infrastructure
CyberPanel: My OpenLiteSpeed Stack for Agency WordPress
How I install CyberPanel on a fresh Ubuntu box, harden the LiteSpeed admin, enforce TLS 1.3, and turn on the LSCache crawler for agency WordPress hosting.
-
Open Source Solutions
DocuSeal Self-Hosted Document Signing: My Agency Setup
How I deploy DocuSeal as a self-hosted DocuSign alternative: the Compose file, eIDAS reality, audit-trail storage, and when paying DocuSign actually wins.
-
Cloud Infrastructure
Enhance Control Panel: My Agency-Grade cPanel Alternative
How I install Enhance control panel on Hetzner: the multi-server topology, the Cloudflare guardrails, and when the operational tax is worth paying.
-
Cybersecurity & Hardening
The Human Element in Cybersecurity: What No Firewall Fixes
Most breaches I see start with a person, not a packet. Here's the human-layer playbook for routers, DNS, passwords, and the social engineering no firewall stops.
-
Open Source Solutions
Immich Self-Hosted Photo Backup: My Production Setup
How I run Immich as a self-hosted Google Photos replacement: the Compose stack, Caddy in front, sizing reality, and when paying Google is still the right call.
-
Operations & Automation
IT Tools: Self-Hosted Dev Utilities, No Privacy Trade-Off
How I deploy IT Tools self-hosted as the JWT decoder, hash generator, and JSON formatter that never sees the public internet, plus the reasons I stopped pasting tokens into random websites.
-
Cybersecurity & Hardening
Kasm Workspaces: Self-Hosted Browser Isolation Done Right
How I deploy Kasm Workspaces for browser isolation on a single VPS, the Caddy proxy in front, and where remote browsers actually beat RDP and VDI.
-
Cybersecurity & Hardening
Linux Server Security in 2026: SSH Keys, Tailscale, Sudo Users, and Private Admin Access
My 2026 Linux server security baseline: SSH bound to the Tailscale IP, public SSH gone, Ed25519 keys, root and password login off, UFW where it still counts.
-
Operations & Automation
Listmonk Self-Hosted Newsletter: My Deployment Guide
How I ship Listmonk for clients who want a Mailchimp replacement they actually own, plus the SMTP relay choices that decide whether the campaigns land.
-
Cloud Infrastructure
Mailcow: My Self-Hosted Email Server vs Google Workspace
How I deploy Mailcow as a self-hosted email server: the Compose stack, the DNS records that decide deliverability, and when I tell clients to stay on Workspace.
-
Operations & Automation
Mautic Self-Hosted Marketing Automation: My Honest Guide
How I deploy Mautic for clients who refuse to ship lead data to HubSpot, plus the SMTP traps that make most self-hosted setups quietly fail.
-
Operations & Automation
MeshCentral Self-Hosted Remote Management for Agency Fleets
How I deploy MeshCentral self-hosted to replace TeamViewer for agency client SLAs: the Docker stack, the proxy, and the agent install rules I never break.
-
Cybersecurity & Hardening
Mistborn: Self-Hosted Wireguard + Pi-hole + Firewall VPN
How I deploy Mistborn as a self-hosted VPN platform: the one-line install, the Pi-hole adlists I trust, the DoH switch, and where it beats raw Wireguard.
-
Operations & Automation
n8n Self-Hosted Workflow Automation: Production Notes
How I deploy n8n self-hosted for agency clients: the Docker stack, the proxy in front, the credentials trap, and when it beats writing a Lambda.
-
Open Source Solutions
Nextcloud AIO Self-Hosted Installation: My Production Setup
How I deploy Nextcloud AIO as a self-hosted Google Workspace replacement: the Compose file, the proxy in front, sizing reality, and when to pay Google instead.
-
Open Source Solutions
Penpot Self-Hosted Design Platform: My Agency Setup
How I deploy Penpot as a self-hosted Figma alternative for design teams: the Compose stack, the Caddy proxy, sizing reality, and when Figma still wins.
-
Open Source Solutions
Perfex CRM Self-Hosted Installation: An Honest Agency Guide
How I deploy Perfex CRM self-hosted on a CyberPanel VPS: licensing reality, the PHP/MySQL stack, the operational tradeoffs, and when it beats SaaS on TCO.
-
Open Source Solutions
Plausible Analytics Self-Hosted: My Production Stack
How I deploy Plausible self-hosted analytics for agency clients: the Compose file, the Cloudflare Tunnel in front, SMTP that actually delivers, and the costs.
-
Cloud Infrastructure
Portainer + NPM + Vaultwarden: My Default Self-Hosted Stack
How I deploy Portainer, Nginx Proxy Manager, and Vaultwarden together: the Docker stack, the gotchas, and the operational rules I'd tattoo on a junior engineer.
-
Agency Growth & Strategy
Self-Hosted Agency Stack: FOSS-First Foundations
The opinionated entry point to my self-hosted agency stack: the philosophy, the phased build order, and a deep-dive link for every tool in the archive.
-
Open Source Solutions
Stirling PDF: Self-Hosted Replacement for ilovepdf.com
How I run Stirling PDF as a self-hosted alternative to ilovepdf.com and Adobe Acrobat for agency document work, with Compose file and Cloudflare Access.
-
Operations & Automation
Uptime Kuma: My Self-Hosted Monitoring Setup
How I deploy Uptime Kuma for client environments: the Docker stack, the proxy in front, and the notification traps I keep watching agencies fall into.
-
Open Source Solutions
Vikunja Self-Hosted Task Management: My Production Setup
How I deploy Vikunja as a self-hosted task manager for an agency: the Compose stack, the Nginx reverse proxy quirk, mail config, and when to skip Trello.
-
Cybersecurity & Hardening
WireGuard Easy: My Self-Hosted VPN Front Door
How I deploy WireGuard Easy as a self-hosted VPN: the Compose file, the config trade-offs, and why wg-easy is my default for client-scale tunnels.
-
Cybersecurity & Hardening
Wirehole: Wireguard + Pi-hole + Unbound on One Compose Stack
How I deploy Wirehole as a self-hosted VPN: Docker Compose on Ubuntu, the Unbound version pin that bites everyone, and where it beats raw Wireguard.
-
Cybersecurity & Hardening
WordPress Admin Recovery: Reset Password or Create Admin
How I recover a locked-out WordPress admin: a clean WP-CLI path when SSH still works, and a SQL-only fallback through phpMyAdmin when it doesn't.
-
Cybersecurity & Hardening
WordPress Server Security: A Comprehensive Hardening Guide
The full WordPress server security pass I run on every production site: server baseline, WordPress hardening, headers, 2FA, and the plugins worth their CPU.
-
Cybersecurity & Hardening
Netbird and Zero Trust: A Mesh VPN for Distributed Teams
How Netbird, an open-source mesh VPN built on WireGuard, fits a Zero Trust security posture for remote teams: peer-to-peer encryption, per-peer access control, and no central concentrator to bottleneck.
-
Open Source Solutions
Flarum: A Lightweight Self-Hosted Forum for Modern Communities
Flarum is an open-source PHP forum with a Mithril frontend and a 1,200+ extension ecosystem. Why I recommend it for small-to-mid-size communities over Discourse, Discord, and Reddit.
-
Open Source Solutions
PikaPods: Managed Hosting for Self-Hosted Open-Source Apps
PikaPods is a managed hosting service for self-hosted open-source apps from the BorgBase team. From $1/month, no sysadmin skills required. Where it fits and where it doesn't.
-
Cybersecurity & Hardening
Mistborn: A Zero Trust VPN Suite for Self-Hosted Cloud Services
Mistborn is an open-source Zero Trust VPN suite built on WireGuard, Pi-hole, Wazuh, and Suricata, with a CISSP/OSCP-led security model. How it fits, when to choose it, and what the Webnestify managed-Mistborn engagement covers.
-
Technical Blueprints
WP-CLI: The Command-Line Interface Every WordPress Admin Should Use
WP-CLI is the command-line tool for WordPress that turns 30-minute admin tasks into 30-second commands. Why I run it on every managed WordPress site and the commands worth memorizing.
-
Cybersecurity & Hardening
Secure Work Environments Using Virtual Machines
How virtual machines isolate business work from personal devices, what to harden inside them, and when a managed Zero-Trust workspace fits better.
-
Cybersecurity & Hardening
Borg Backups: Encrypted, Deduplicated Backups That Don't Break the Storage Budget
Borg is an open-source backup tool that combines deduplication, encryption, and compression so nightly backups of multi-terabyte servers don't fill the storage in a month. Why I run it on every managed server.
-
Cybersecurity & Hardening
Windows Server Hardening with DoD STIGs, SCAP, LGPO, and ESET
How to harden a Windows Server using DoD STIGs (Security Technical Implementation Guides), the SCAP scanner, Microsoft's LGPO tool, and ESET's endpoint suite. The actual playbook and the realistic scope.
-
Cybersecurity & Hardening
Zero Trust Security: A Plain-English Overview of the Model
Zero Trust security is a stance, not a product. The conceptual primer to the rest of my Zero Trust series: what it actually means, the three core principles, and how to implement it without buying a vendor's reference architecture.
-
Cybersecurity & Hardening
Self-Hosted WireGuard VPN with WG-Easy: A Practical Setup Guide
WireGuard plus WG-Easy gives you a self-hosted VPN with a clean web UI in under 30 minutes. Where it fits, where it doesn't, and the deployment patterns I run for managed clients.
-
Operations & Automation
MeshCentral: An Open-Source RMM Platform That Doesn't Sell You Out
MeshCentral is a free, self-hosted Remote Monitoring and Management platform. Why I default to it over commercial RMM vendors after the ConnectWise breach made the closed-source RMM model look very different.
-
Operations & Automation
Server Monitoring That Actually Catches Problems: Grafana, Prometheus, Loki, Netdata
What real server and web app monitoring looks like in practice. The Grafana + Prometheus + Loki + Promtail stack for full control, Netdata for instant deployment, and how to pick between them.
-
Cloud Infrastructure
LiteSpeed Enterprise: Why I Run It Instead of Apache or Nginx for WordPress
LiteSpeed Enterprise is the web server I default to for WordPress and high-traffic PHP workloads. The technical reasons (event-driven architecture, LSCache, HTTP/3, .htaccess compatibility) and the business reasons it earns its license fee.
-
Cloud Infrastructure
Web Server Performance Benchmarks: LiteSpeed Enterprise vs Apache vs Nginx
Real benchmarks on identical hardware: LiteSpeed Enterprise vs Apache vs Nginx for WordPress, with and without caching plugins. The numbers, the setup, and what they mean for your site.
-
Open Source Solutions
Ditch Google Analytics: Open-Source, Privacy-First Alternatives That Work
Matomo, Plausible, Umami, and Ackee compared as open-source alternatives to Google Analytics. GDPR-compliant by default, self-hostable, and immune to ad-blockers when run on your own domain.
-
Cybersecurity & Hardening
Cybersecurity Threats Modern Businesses Actually Face
A grounded look at the cybersecurity threats modern businesses face today, where the standard defenses fall short, and what the practical fixes look like.