From c9dc9617bde1581837b7814aeafc84551091b613 Mon Sep 17 00:00:00 2001 From: carlitosbond Date: Wed, 5 Aug 2026 21:19:58 +0000 Subject: [PATCH] Add TLS proxy article, expand blog content, harden Grafana config - Add new post/article: How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay, with matching OG/meta share page - Mark tls-proxy-legacy-rescue article as visible and expand lessons learned section - Add homelab and entertainment posts (Optiplex, survival sandboxes) to articles.js - Harden Grafana: memory limits, rotated admin password, secure cookies, brute-force protection Co-Authored-By: Claude Sonnet 5 --- docker-compose.yml | 6 +- .../articles/tls-proxy-legacy-rescue.html | 40 ++++++++ frontend/src/components/articles.js | 45 ++++++++- frontend/src/components/post.js | 95 +++++++++++++++++++ 4 files changed, 182 insertions(+), 4 deletions(-) create mode 100644 frontend/public/articles/tls-proxy-legacy-rescue.html diff --git a/docker-compose.yml b/docker-compose.yml index b0d8c05..baddedd 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -162,11 +162,15 @@ services: image: grafana/grafana:latest container_name: grafana restart: unless-stopped + mem_limit: 512m + mem_reservation: 256m environment: - GF_SECURITY_ADMIN_USER=carlos - - GF_SECURITY_ADMIN_PASSWORD=L1b3rty@1 + - GF_SECURITY_ADMIN_PASSWORD=c233357b0cb8dbdd49e21ab032146e09 - GF_USERS_ALLOW_SIGN_UP=false + - GF_SECURITY_DISABLE_BRUTE_FORCE_LOGIN_PROTECTION=false - GF_SERVER_ROOT_URL=https://metrics.carloselugo.com + - GF_SECURITY_COOKIE_SECURE=true volumes: - grafana_data:/var/lib/grafana networks: diff --git a/frontend/public/articles/tls-proxy-legacy-rescue.html b/frontend/public/articles/tls-proxy-legacy-rescue.html new file mode 100644 index 0000000..cc289b0 --- /dev/null +++ b/frontend/public/articles/tls-proxy-legacy-rescue.html @@ -0,0 +1,40 @@ + + + + + + How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay — Carlos Lugo + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/frontend/src/components/articles.js b/frontend/src/components/articles.js index dd492e8..ed9c8d7 100644 --- a/frontend/src/components/articles.js +++ b/frontend/src/components/articles.js @@ -52,7 +52,7 @@ const ARTICLES = [ }, { id: 'tls-proxy-legacy-rescue', - visible: false, + visible: true, category: 'Network Security', title: 'How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay', excerpt: "A legacy provisioning system could not speak modern TLS to a new security API. A lightweight proxy closed the gap in days, not a year — right as the industry's TLS legacy deadline closed in.", @@ -84,7 +84,46 @@ const ARTICLES = [ "Technical debt is now a balance-sheet problem, not just a systems one: McKinsey puts it at roughly 40% of large enterprises' IT balance sheets", 'The sidecar/proxy pattern — terminating TLS in NGINX, HAProxy, or Envoy — is now the industry-standard way to absorb exactly this kind of compatibility gap without touching critical systems', ]}, - { p: 'Technical debt always collects eventually — CAST Software put the global backlog at 61 billion person-days of remediation work in 2025 — but a well-isolated proxy bought the time to pay it down on our terms instead of the market\'s. It is also why terminating TLS at a dedicated proxy or sidecar became a standing pattern in every containerized deployment since.' }, + { h4: 'Lessons learned' }, + { ul: [ + 'Technical debt always collects eventually — CAST Software put the global backlog at 61 billion person-days of remediation work in 2025. Waiting for "someday" budget stops being a viable strategy', + 'Engineering pragmatism beats perfectionism — the purist fix was upgrading the provisioner; the pragmatic one was the proxy, and it delivered business value while managing risk safely', + 'The proxy/sidecar pattern became a standard — decoupled proxies are now a default part of every container architecture we design, not a one-off workaround', + 'AI as an accelerator, not a replacement for judgment — AI tools sped up troubleshooting the handshake failure and generating precise proxy configs, but the engineering call to make was still ours', + ]}, + { p: "Have you run into a legacy-meets-modern-API collision in your own projects? What pattern did you use to bridge it? Let's talk in the comments." }, + { p: 'Sources: Cisco Meraki Documentation, The Register, Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta (2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey (via byteiota.com), HFS Research.' }, + ], + }, + { + id: 'rescued-optiplex-rabbit-hole', + visible: true, + category: 'Homelab', + title: "Rescued a Dell Optiplex and Now I Can't Stop", + excerpt: "A decommissioned Optiplex 3000, Docker, and a rabbit hole I didn't expect.", + blocks: [ + { p: "It started with a Dell Optiplex 3000 that was about to get wiped and trashed. I grabbed it before it disappeared and figured I'd run a few things on it. That was a mistake — in the best way." }, + { p: "Docker opened a door I didn't know was there. The more I poked around, the more I realized how much is already solved. Need a game server? There's a container for that. Need to monitor your uptime, metrics, logs, and analytics? Container, container, container, container." }, + { p: "That's exactly what I ended up with: Uptime Kuma for service uptime, Netdata for system metrics, Umami for page analytics, and Dozzle for container logs. Simple stack, everything in one place, surprisingly complete." }, + { p: "The part that got me was publishing this site. I was genuinely a little nervous — I was exposing something to the internet, inside my own network. Old me would've stopped there. Instead I thought: there's probably a container for the security piece too. Turns out, yeah. Problem solved." }, + { p: "AI has a lot to do with this shift. Things that used to feel out of reach — self-hosting, networking, monitoring — feel a lot more approachable when you can just ask questions and get unstuck fast." }, + { p: "Next goal: more Optiplexes, a Kubernetes cluster, and seeing how far this rabbit hole actually goes. I'll keep you posted." }, + ], + }, + { + id: 'survival-sandbox-journey', + visible: true, + category: 'Entertainment', + title: "Survival Sandboxes and the Itch I Can't Scratch", + excerpt: "From Star Wars Galaxies to Enshrouded — apparently I've always been about building stuff and calling it home.", + blocks: [ + { p: "I never connected the dots until recently, but there's a clear thread running through every game I've actually sunk time into: you build something, and it feels like yours." }, + { p: "It started with Star Wars Galaxies — one of the first MMOs I played. Yeah there was grinding, leveling, the full RPG loop. But what I kept coming back to was base building. There was something about someone walking into your place and saying \"this is cool\" that hit different. That little moment of validation from a stranger in a game. I get it now more than I did then." }, + { p: "Fast forward and I'm playing Minecraft with my kid. Graphics are what they are, but the crafting system is genuinely deep. And watching a kid figure out resource chains and basic survival logic — that's actually pretty solid for a young brain. It holds up." }, + { p: "A coworker told me he basically lived on Steam sales, buying whatever looked interesting at a discount. I did the same and landed on No Man's Sky. That game broke my brain a little. Procedurally generated solar systems, planets, flora, fauna — 18 quintillion planets. The number is absurd. But strip that away and it's basically Minecraft in space: gather everything or die trying. I put a lot of hours in, but a game that massive is hard to maintain intensity on. Eventually I dialed back." }, + { p: "Steam does this thing where it watches what you play and suggests similar titles. That's how I found Enshrouded. Fantasy RPG setting, traditional classes, fluid real-time combat — no turn-based stuff, not my thing — with that same loop of crafting, foraging, and figuring things out. The quest line actually guides you through different biomes in a way that feels structured without being hand-holdy. Only complaint: I wish it was on Nintendo Switch so I could play it in traffic. Half joking." }, + { p: "A coworker mentioned he ran a Minecraft server and something clicked — I wonder if there's a container for Enshrouded. There was. Threw it on the Dell Optiplex that was headed to decommission and it runs without breaking a sweat. A simple Docker Compose file and done. Sometimes working in networking and infrastructure has its perks: you see how the sausage is made and suddenly self-hosting a game server feels less like a project and more like a Tuesday." }, + { p: "How long will the Enshrouded phase last? No idea. But here's the takeaway: if something looks interesting, Google it. There's probably a server image, a mod, a community, or at minimum a Reddit thread that tells you if it's worth your time." }, ], }, ] @@ -255,4 +294,4 @@ export function renderArticles() { .diagram-edge-label { font-size: 0.7rem; color: var(--muted); } ` -} +} \ No newline at end of file diff --git a/frontend/src/components/post.js b/frontend/src/components/post.js index b912768..1d1c75c 100644 --- a/frontend/src/components/post.js +++ b/frontend/src/components/post.js @@ -83,4 +83,99 @@ export const posts = [ thread that tells you if it's worth your time.

`, }, + { + id: 'tls-proxy-saved-mobile-security-launch', + date: '2026-08-05', + category: 'professional', + title: "How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay", + excerpt: "A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year.", + content: ` +

A new mobile security service — phishing and malware filtering through a dedicated APN — + was ready to launch. Integration testing hit a wall: the legacy provisioning system could not + complete a TLS handshake with the security platform's API.

+ +

The Setup

+

Launching a new value-added service in a mobile network means coordinating multiple technology + layers — from radio and packet core (EPC/5GC) to provisioning platforms and third-party security + systems. The architecture called for a dedicated APN routing subscriber traffic through filtering + engines, and integration with the provisioning platform so every subscription change triggered a + call to the security platform's REST API. Everything was ready on paper. Then, during integration + testing against the production API, communication failed outright.

+ +

The Root Cause

+

The logs showed a classic cipher negotiation failure: + javax.net.ssl.SSLException: Received fatal alert: handshake_failure.

+ +

This wasn't a vendor being difficult. TLS 1.0/1.1 have been formally deprecated by the IETF + (RFC 8996) since 2021, blocked by every major browser since 2020, and banned under PCI DSS, + NIST SP 800-52 Rev. 2, and HIPAA. Any provisioning backend still speaking TLS 1.0/1.1 isn't an + isolated exception — it's part of an entire category of telco infrastructure hitting its + expiration date at roughly the same time.

+ +

The Operational Crossroads

+

The official answer — upgrading the provisioning engine's Java version — required upgrading + the entire platform core: massive regression testing across dozens of other critical services, + an estimated 12-18 month planning window, and no budget allocated for the current year. Accepting + that path meant freezing the security project indefinitely and losing the commercial launch window.

+

Accumulated technical debt grew by an estimated $6 trillion globally between 2012 and 2023 + (Oliver Wyman), with the U.S. alone accounting for $2.2 trillion of that increase. At the + enterprise level, the average company loses over $370M a year from its inability to modernize + legacy systems efficiently.

+ +

The Fix: A Reverse Proxy in the Middle

+

Instead of forcing a structural change onto the provisioning platform, we applied a core + systems-design principle: decouple application logic from the transport layer.

+ 
Legacy Provisioner --TLS 1.0/1.1--> Reverse Proxy --TLS 1.2/1.3--> Security API (Allot)
+    (old Java)               (container / NGINX)          (filter engine)
+                              [ Handshake translation ]
+

The provisioning system sent its request to the proxy's internal address using the only + cipher suites its old Java stack supported. The proxy terminated that legacy TLS session + internally, then immediately opened a fresh handshake to the external Allot API using modern + TLS 1.2/1.3. The response traveled back the same path, in reverse. Deployed as an ultralight, + isolated container — designed, tested, and live in a matter of days.

+ +

The Business Result

+ + +

Why This Pattern Is Standard Now

+

What we solved with a few lines of proxy config is, in hindsight, a tactical answer to a + structural industry trend. The TLS-legacy grace period is closing in cascade — Meraki, Azure + Storage, Office 365, and Exchange Online are all running their own TLS 1.0/1.1 shutdowns through + 2026. Tech debt now represents roughly 40% of large enterprises' IT balance sheets (McKinsey), + and the sidecar/proxy pattern — terminating TLS and decoupling transport with NGINX, HAProxy, or + Envoy — is already standard practice in container architectures precisely because it absorbs this + kind of compatibility gap without touching critical systems.

+ +

Lessons Learned

+
    +
  1. Technical debt always collects eventually. Global technical debt sits at + 61 billion person-days of remediation work (CAST Software, 2025) — waiting for "someday" + budget stops being a viable strategy.
    2. +
  2. Engineering pragmatism beats perfectionism. The pragmatic solution beat + the purist one, and delivered business value while managing risk safely.
    3. +
  3. The proxy/sidecar pattern became a standard. Decoupled proxies became a + default part of our container architectures going forward.
    4. +
  4. AI as an accelerator, not a replacement for judgment. AI tools sped up + troubleshooting the handshake failure and generating precise proxy configs — they didn't + replace the engineering call to make.
    5. +
+ +

Have you run into a legacy-meets-modern-API collision in your own projects? What pattern + did you use to bridge it?

+ +

Sources: Cisco Meraki Documentation, The Register, + Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta + (2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey + (via byteiota.com), HFS Research.

+ `, + }, ] \ No newline at end of file