Runbooks
Step-by-step operational procedures for common infrastructure tasks. Written to be followed under pressure, not studied at leisure. Each runbook includes prerequisites, numbered steps, verification, and rollback procedures.
Email Authentication: SPF, DKIM, DMARC Rollout
Step-by-step SPF/DKIM/DMARC rollout for a domain: pick the correct sender profile, publish the records, authorize cross-domain DMARC reporting, climb the policy ladder, and confirm pass results in a real Outlook inbox.
Cloudflare Zone Hardening
Step-by-step zone hardening for Cloudflare-fronted sites: TLS minimums, cipher suites, edge HTTPS redirect, CAA records, and why the HSTS toggle stays off when security headers live in Worker middleware.
New Client Site: Launch Checklist
End-to-end launch procedure for a SolidStart client site on Cloudflare Workers: repo scaffold, security-middleware port, env access, Resend and Turnstile wiring, image discipline, deploy, and post-deploy CSP verification.
Cloudflare Worker Bundle Size Triage
Step-by-step procedure for diagnosing and fixing a SolidStart Cloudflare Workers build that fails the 3 MB bundle limit: chunk inspection, the Nitro image-bundling root cause, the move-out/copy-back fix, and prevention rules.
Proxmox SSH Hardening
Step-by-step SSH hardening procedure for Proxmox LXC containers and VMs: disable root login, configure key-based auth, deploy fail2ban, and lock down the firewall.
K3s Cluster Maintenance
Step-by-step operational procedure for K3s cluster maintenance: pre-checks, backup, node drain, binary upgrade, health verification, and rollback.
Add a New Service Behind Authentik
Step-by-step procedure for adding a new web service to the Authentik identity provider with Traefik routing and Cloudflare Tunnel exposure.