Add TLS proxy article, expand blog content, harden Grafana config

- Add new post/article: How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay, with matching OG/meta share page - Mark tls-proxy-legacy-rescue article as visible and expand lessons learned section - Add homelab and entertainment posts (Optiplex, survival sandboxes) to articles.js - Harden Grafana: memory limits, rotated admin password, secure cookies, brute-force protection Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-05 21:19:58 +00:00
parent 44d6c1e5a9
commit c9dc9617bd
4 changed files with 182 additions and 4 deletions
@@ -162,11 +162,15 @@ services:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    mem_limit: 512m
    mem_reservation: 256m
    environment:
      - GF_SECURITY_ADMIN_USER=carlos
-      - GF_SECURITY_ADMIN_PASSWORD=L1b3rty@1
+      - GF_SECURITY_ADMIN_PASSWORD=c233357b0cb8dbdd49e21ab032146e09
      - GF_USERS_ALLOW_SIGN_UP=false
      - GF_SECURITY_DISABLE_BRUTE_FORCE_LOGIN_PROTECTION=false
      - GF_SERVER_ROOT_URL=https://metrics.carloselugo.com
      - GF_SECURITY_COOKIE_SECURE=true
    volumes:
      - grafana_data:/var/lib/grafana
    networks:
@@ -0,0 +1,40 @@
 <!DOCTYPE html>
 <html lang="en">
  <head>
    <meta charset="UTF-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay — Carlos Lugo</title>
    <meta name="description" content="A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year." />
    <!-- Open Graph (LinkedIn, Facebook) -->
    <meta property="og:type" content="article" />
    <meta property="og:title" content="How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay" />
    <meta property="og:description" content="A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year." />
    <meta property="og:url" content="https://carloselugo.com/articles/tls-proxy-legacy-rescue.html" />
    <meta property="og:image" content="https://carloselugo.com/images/profile_rev2.png" />
    <meta property="og:site_name" content="Carlos Lugo" />
    <!-- Twitter/X card (harmless to include, some tools reuse it) -->
    <meta name="twitter:card" content="summary" />
    <meta name="twitter:title" content="How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay" />
    <meta name="twitter:description" content="A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year." />
    <meta name="twitter:image" content="https://carloselugo.com/images/profile_rev2.png" />
    <link rel="canonical" href="https://carloselugo.com/#article-tls-proxy-legacy-rescue" />
    <!-- Human visitors get redirected straight into the real article on the SPA. -->
    <meta http-equiv="refresh" content="0; url=/#article-tls-proxy-legacy-rescue" />
    <script>window.location.replace('/#article-tls-proxy-legacy-rescue');</script>
    <style>
      body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; background:#faf9f5; color:#201e1d;
             display:flex; align-items:center; justify-content:center; min-height:100vh; margin:0; }
      a { color:#ec3013; }
    </style>
  </head>
  <body>
    <noscript>
      <p>Redirecting… If nothing happens, <a href="/#article-tls-proxy-legacy-rescue">read the article here</a>.</p>
    </noscript>
  </body>
 </html>
@@ -52,7 +52,7 @@ const ARTICLES = [
  },
  {
    id: 'tls-proxy-legacy-rescue',
-    visible: false,
+    visible: true,
    category: 'Network Security',
    title: 'How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay',
    excerpt: "A legacy provisioning system could not speak modern TLS to a new security API. A lightweight proxy closed the gap in days, not a year — right as the industry's TLS legacy deadline closed in.",
@@ -84,7 +84,46 @@ const ARTICLES = [
        "Technical debt is now a balance-sheet problem, not just a systems one: McKinsey puts it at roughly 40% of large enterprises' IT balance sheets",
        'The sidecar/proxy pattern — terminating TLS in NGINX, HAProxy, or Envoy — is now the industry-standard way to absorb exactly this kind of compatibility gap without touching critical systems',
      ]},
-      { p: 'Technical debt always collects eventually — CAST Software put the global backlog at 61 billion person-days of remediation work in 2025 — but a well-isolated proxy bought the time to pay it down on our terms instead of the market\'s. It is also why terminating TLS at a dedicated proxy or sidecar became a standing pattern in every containerized deployment since.' },
+      { h4: 'Lessons learned' },
      { ul: [
        'Technical debt always collects eventually — CAST Software put the global backlog at 61 billion person-days of remediation work in 2025. Waiting for "someday" budget stops being a viable strategy',
        'Engineering pragmatism beats perfectionism — the purist fix was upgrading the provisioner; the pragmatic one was the proxy, and it delivered business value while managing risk safely',
        'The proxy/sidecar pattern became a standard — decoupled proxies are now a default part of every container architecture we design, not a one-off workaround',
        'AI as an accelerator, not a replacement for judgment — AI tools sped up troubleshooting the handshake failure and generating precise proxy configs, but the engineering call to make was still ours',
      ]},
      { p: "Have you run into a legacy-meets-modern-API collision in your own projects? What pattern did you use to bridge it? Let's talk in the comments." },
      { p: 'Sources: Cisco Meraki Documentation, The Register, Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta (2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey (via byteiota.com), HFS Research.' },
    ],
  },
  {
    id: 'rescued-optiplex-rabbit-hole',
    visible: true,
    category: 'Homelab',
    title: "Rescued a Dell Optiplex and Now I Can't Stop",
    excerpt: "A decommissioned Optiplex 3000, Docker, and a rabbit hole I didn't expect.",
    blocks: [
      { p: "It started with a Dell Optiplex 3000 that was about to get wiped and trashed. I grabbed it before it disappeared and figured I'd run a few things on it. That was a mistake — in the best way." },
      { p: "Docker opened a door I didn't know was there. The more I poked around, the more I realized how much is already solved. Need a game server? There's a container for that. Need to monitor your uptime, metrics, logs, and analytics? Container, container, container, container." },
      { p: "That's exactly what I ended up with: <strong>Uptime Kuma</strong> for service uptime, <strong>Netdata</strong> for system metrics, <strong>Umami</strong> for page analytics, and <strong>Dozzle</strong> for container logs. Simple stack, everything in one place, surprisingly complete." },
      { p: "The part that got me was publishing this site. I was genuinely a little nervous — I was exposing something to the internet, inside my own network. Old me would've stopped there. Instead I thought: <em>there's probably a container for the security piece too.</em> Turns out, yeah. Problem solved." },
      { p: "AI has a lot to do with this shift. Things that used to feel out of reach — self-hosting, networking, monitoring — feel a lot more approachable when you can just ask questions and get unstuck fast." },
      { p: "Next goal: more Optiplexes, a Kubernetes cluster, and seeing how far this rabbit hole actually goes. I'll keep you posted." },
    ],
  },
  {
    id: 'survival-sandbox-journey',
    visible: true,
    category: 'Entertainment',
    title: "Survival Sandboxes and the Itch I Can't Scratch",
    excerpt: "From Star Wars Galaxies to Enshrouded — apparently I've always been about building stuff and calling it home.",
    blocks: [
      { p: "I never connected the dots until recently, but there's a clear thread running through every game I've actually sunk time into: you build something, and it feels like yours." },
      { p: "It started with <strong>Star Wars Galaxies</strong> — one of the first MMOs I played. Yeah there was grinding, leveling, the full RPG loop. But what I kept coming back to was base building. There was something about someone walking into your place and saying <em>\"this is cool\"</em> that hit different. That little moment of validation from a stranger in a game. I get it now more than I did then." },
      { p: "Fast forward and I'm playing <strong>Minecraft</strong> with my kid. Graphics are what they are, but the crafting system is genuinely deep. And watching a kid figure out resource chains and basic survival logic — that's actually pretty solid for a young brain. It holds up." },
      { p: "A coworker told me he basically lived on Steam sales, buying whatever looked interesting at a discount. I did the same and landed on <strong>No Man's Sky</strong>. That game broke my brain a little. Procedurally generated solar systems, planets, flora, fauna — 18 quintillion planets. The number is absurd. But strip that away and it's basically Minecraft in space: gather everything or die trying. I put a lot of hours in, but a game that massive is hard to maintain intensity on. Eventually I dialed back." },
      { p: "Steam does this thing where it watches what you play and suggests similar titles. That's how I found <strong>Enshrouded</strong>. Fantasy RPG setting, traditional classes, fluid real-time combat — no turn-based stuff, not my thing — with that same loop of crafting, foraging, and figuring things out. The quest line actually guides you through different biomes in a way that feels structured without being hand-holdy. Only complaint: I wish it was on Nintendo Switch so I could play it in traffic. Half joking." },
      { p: "A coworker mentioned he ran a Minecraft server and something clicked — <em>I wonder if there's a container for Enshrouded.</em> There was. Threw it on the Dell Optiplex that was headed to decommission and it runs without breaking a sweat. A simple Docker Compose file and done. Sometimes working in networking and infrastructure has its perks: you see how the sausage is made and suddenly self-hosting a game server feels less like a project and more like a Tuesday." },
      { p: "How long will the Enshrouded phase last? No idea. But here's the takeaway: if something looks interesting, Google it. There's probably a server image, a mod, a community, or at minimum a Reddit thread that tells you if it's worth your time." },
    ],
  },
 ]
@@ -255,4 +294,4 @@ export function renderArticles() {
      .diagram-edge-label { font-size: 0.7rem; color: var(--muted); }
    </style>
  `
-}
+}
@@ -83,4 +83,99 @@ export const posts = [
      thread that tells you if it's worth your time.</p>
    `,
  },
  {
    id: 'tls-proxy-saved-mobile-security-launch',
    date: '2026-08-05',
    category: 'professional',
    title: "How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay",
    excerpt: "A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year.",
    content: `
      <p>A new mobile security service — phishing and malware filtering through a dedicated APN —
      was ready to launch. Integration testing hit a wall: the legacy provisioning system could not
      complete a TLS handshake with the security platform's API.</p>
      <h3>The Setup</h3>
      <p>Launching a new value-added service in a mobile network means coordinating multiple technology
      layers — from radio and packet core (EPC/5GC) to provisioning platforms and third-party security
      systems. The architecture called for a dedicated APN routing subscriber traffic through filtering
      engines, and integration with the provisioning platform so every subscription change triggered a
      call to the security platform's REST API. Everything was ready on paper. Then, during integration
      testing against the production API, communication failed outright.</p>
      <h3>The Root Cause</h3>
      <p>The logs showed a classic cipher negotiation failure:
      <code>javax.net.ssl.SSLException: Received fatal alert: handshake_failure</code>.</p>
      <ul>
        <li>The legacy provisioning system ran an old Java stack, capped at outdated TLS 1.0/1.1 cipher suites.</li>
        <li>The security API required modern TLS 1.2/1.3 ciphers, no exceptions.</li>
      </ul>
      <p>This wasn't a vendor being difficult. TLS 1.0/1.1 have been formally deprecated by the IETF
      (RFC 8996) since 2021, blocked by every major browser since 2020, and banned under PCI DSS,
      NIST SP 800-52 Rev. 2, and HIPAA. Any provisioning backend still speaking TLS 1.0/1.1 isn't an
      isolated exception — it's part of an entire category of telco infrastructure hitting its
      expiration date at roughly the same time.</p>
      <h3>The Operational Crossroads</h3>
      <p>The official answer — upgrading the provisioning engine's Java version — required upgrading
      the entire platform core: massive regression testing across dozens of other critical services,
      an estimated 12-18 month planning window, and no budget allocated for the current year. Accepting
      that path meant freezing the security project indefinitely and losing the commercial launch window.</p>
      <p>Accumulated technical debt grew by an estimated $6 trillion globally between 2012 and 2023
      (Oliver Wyman), with the U.S. alone accounting for $2.2 trillion of that increase. At the
      enterprise level, the average company loses over $370M a year from its inability to modernize
      legacy systems efficiently.</p>
      <h3>The Fix: A Reverse Proxy in the Middle</h3>
      <p>Instead of forcing a structural change onto the provisioning platform, we applied a core
      systems-design principle: decouple application logic from the transport layer.</p>
      <pre>Legacy Provisioner --TLS 1.0/1.1--> Reverse Proxy --TLS 1.2/1.3--> Security API (Allot)
    (old Java)               (container / NGINX)          (filter engine)
                              [ Handshake translation ]</pre>
      <p>The provisioning system sent its request to the proxy's internal address using the only
      cipher suites its old Java stack supported. The proxy terminated that legacy TLS session
      internally, then immediately opened a fresh handshake to the external Allot API using modern
      TLS 1.2/1.3. The response traveled back the same path, in reverse. Deployed as an ultralight,
      isolated container — designed, tested, and live in a matter of days.</p>
      <h3>The Business Result</h3>
      <ul>
        <li><strong>Zero delay to go-to-market.</strong> The service launched on schedule.</li>
        <li><strong>Breathing room for the real upgrade.</strong> The infrastructure team got over a
        year to plan, budget, and execute the major provisioning upgrade properly.</li>
        <li><strong>Zero risk introduced.</strong> Not a single parameter on the core provisioning
        platform was touched.</li>
      </ul>
      <h3>Why This Pattern Is Standard Now</h3>
      <p>What we solved with a few lines of proxy config is, in hindsight, a tactical answer to a
      structural industry trend. The TLS-legacy grace period is closing in cascade — Meraki, Azure
      Storage, Office 365, and Exchange Online are all running their own TLS 1.0/1.1 shutdowns through
      2026. Tech debt now represents roughly 40% of large enterprises' IT balance sheets (McKinsey),
      and the sidecar/proxy pattern — terminating TLS and decoupling transport with NGINX, HAProxy, or
      Envoy — is already standard practice in container architectures precisely because it absorbs this
      kind of compatibility gap without touching critical systems.</p>
      <h3>Lessons Learned</h3>
      <ol>
        <li><strong>Technical debt always collects eventually.</strong> Global technical debt sits at
        61 billion person-days of remediation work (CAST Software, 2025) — waiting for "someday"
        budget stops being a viable strategy.</li>
        <li><strong>Engineering pragmatism beats perfectionism.</strong> The pragmatic solution beat
        the purist one, and delivered business value while managing risk safely.</li>
        <li><strong>The proxy/sidecar pattern became a standard.</strong> Decoupled proxies became a
        default part of our container architectures going forward.</li>
        <li><strong>AI as an accelerator, not a replacement for judgment.</strong> AI tools sped up
        troubleshooting the handshake failure and generating precise proxy configs — they didn't
        replace the engineering call to make.</li>
      </ol>
      <p><em>Have you run into a legacy-meets-modern-API collision in your own projects? What pattern
      did you use to bridge it?</em></p>
      <p style="font-size:0.85em;opacity:0.7">Sources: Cisco Meraki Documentation, The Register,
      Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta
      (2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey
      (via byteiota.com), HFS Research.</p>
    `,
  },
 ]