Add TLS proxy article, expand blog content, harden Grafana config
- Add new post/article: How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay, with matching OG/meta share page - Mark tls-proxy-legacy-rescue article as visible and expand lessons learned section - Add homelab and entertainment posts (Optiplex, survival sandboxes) to articles.js - Harden Grafana: memory limits, rotated admin password, secure cookies, brute-force protection Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
+5
-1
@@ -162,11 +162,15 @@ services:
|
||||
image: grafana/grafana:latest
|
||||
container_name: grafana
|
||||
restart: unless-stopped
|
||||
mem_limit: 512m
|
||||
mem_reservation: 256m
|
||||
environment:
|
||||
- GF_SECURITY_ADMIN_USER=carlos
|
||||
- GF_SECURITY_ADMIN_PASSWORD=L1b3rty@1
|
||||
- GF_SECURITY_ADMIN_PASSWORD=c233357b0cb8dbdd49e21ab032146e09
|
||||
- GF_USERS_ALLOW_SIGN_UP=false
|
||||
- GF_SECURITY_DISABLE_BRUTE_FORCE_LOGIN_PROTECTION=false
|
||||
- GF_SERVER_ROOT_URL=https://metrics.carloselugo.com
|
||||
- GF_SECURITY_COOKIE_SECURE=true
|
||||
volumes:
|
||||
- grafana_data:/var/lib/grafana
|
||||
networks:
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8" />
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<title>How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay — Carlos Lugo</title>
|
||||
<meta name="description" content="A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year." />
|
||||
|
||||
<!-- Open Graph (LinkedIn, Facebook) -->
|
||||
<meta property="og:type" content="article" />
|
||||
<meta property="og:title" content="How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay" />
|
||||
<meta property="og:description" content="A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year." />
|
||||
<meta property="og:url" content="https://carloselugo.com/articles/tls-proxy-legacy-rescue.html" />
|
||||
<meta property="og:image" content="https://carloselugo.com/images/profile_rev2.png" />
|
||||
<meta property="og:site_name" content="Carlos Lugo" />
|
||||
|
||||
<!-- Twitter/X card (harmless to include, some tools reuse it) -->
|
||||
<meta name="twitter:card" content="summary" />
|
||||
<meta name="twitter:title" content="How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay" />
|
||||
<meta name="twitter:description" content="A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year." />
|
||||
<meta name="twitter:image" content="https://carloselugo.com/images/profile_rev2.png" />
|
||||
|
||||
<link rel="canonical" href="https://carloselugo.com/#article-tls-proxy-legacy-rescue" />
|
||||
|
||||
<!-- Human visitors get redirected straight into the real article on the SPA. -->
|
||||
<meta http-equiv="refresh" content="0; url=/#article-tls-proxy-legacy-rescue" />
|
||||
<script>window.location.replace('/#article-tls-proxy-legacy-rescue');</script>
|
||||
|
||||
<style>
|
||||
body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; background:#faf9f5; color:#201e1d;
|
||||
display:flex; align-items:center; justify-content:center; min-height:100vh; margin:0; }
|
||||
a { color:#ec3013; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<noscript>
|
||||
<p>Redirecting… If nothing happens, <a href="/#article-tls-proxy-legacy-rescue">read the article here</a>.</p>
|
||||
</noscript>
|
||||
</body>
|
||||
</html>
|
||||
@@ -52,7 +52,7 @@ const ARTICLES = [
|
||||
},
|
||||
{
|
||||
id: 'tls-proxy-legacy-rescue',
|
||||
visible: false,
|
||||
visible: true,
|
||||
category: 'Network Security',
|
||||
title: 'How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay',
|
||||
excerpt: "A legacy provisioning system could not speak modern TLS to a new security API. A lightweight proxy closed the gap in days, not a year — right as the industry's TLS legacy deadline closed in.",
|
||||
@@ -84,7 +84,46 @@ const ARTICLES = [
|
||||
"Technical debt is now a balance-sheet problem, not just a systems one: McKinsey puts it at roughly 40% of large enterprises' IT balance sheets",
|
||||
'The sidecar/proxy pattern — terminating TLS in NGINX, HAProxy, or Envoy — is now the industry-standard way to absorb exactly this kind of compatibility gap without touching critical systems',
|
||||
]},
|
||||
{ p: 'Technical debt always collects eventually — CAST Software put the global backlog at 61 billion person-days of remediation work in 2025 — but a well-isolated proxy bought the time to pay it down on our terms instead of the market\'s. It is also why terminating TLS at a dedicated proxy or sidecar became a standing pattern in every containerized deployment since.' },
|
||||
{ h4: 'Lessons learned' },
|
||||
{ ul: [
|
||||
'Technical debt always collects eventually — CAST Software put the global backlog at 61 billion person-days of remediation work in 2025. Waiting for "someday" budget stops being a viable strategy',
|
||||
'Engineering pragmatism beats perfectionism — the purist fix was upgrading the provisioner; the pragmatic one was the proxy, and it delivered business value while managing risk safely',
|
||||
'The proxy/sidecar pattern became a standard — decoupled proxies are now a default part of every container architecture we design, not a one-off workaround',
|
||||
'AI as an accelerator, not a replacement for judgment — AI tools sped up troubleshooting the handshake failure and generating precise proxy configs, but the engineering call to make was still ours',
|
||||
]},
|
||||
{ p: "Have you run into a legacy-meets-modern-API collision in your own projects? What pattern did you use to bridge it? Let's talk in the comments." },
|
||||
{ p: 'Sources: Cisco Meraki Documentation, The Register, Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta (2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey (via byteiota.com), HFS Research.' },
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'rescued-optiplex-rabbit-hole',
|
||||
visible: true,
|
||||
category: 'Homelab',
|
||||
title: "Rescued a Dell Optiplex and Now I Can't Stop",
|
||||
excerpt: "A decommissioned Optiplex 3000, Docker, and a rabbit hole I didn't expect.",
|
||||
blocks: [
|
||||
{ p: "It started with a Dell Optiplex 3000 that was about to get wiped and trashed. I grabbed it before it disappeared and figured I'd run a few things on it. That was a mistake — in the best way." },
|
||||
{ p: "Docker opened a door I didn't know was there. The more I poked around, the more I realized how much is already solved. Need a game server? There's a container for that. Need to monitor your uptime, metrics, logs, and analytics? Container, container, container, container." },
|
||||
{ p: "That's exactly what I ended up with: <strong>Uptime Kuma</strong> for service uptime, <strong>Netdata</strong> for system metrics, <strong>Umami</strong> for page analytics, and <strong>Dozzle</strong> for container logs. Simple stack, everything in one place, surprisingly complete." },
|
||||
{ p: "The part that got me was publishing this site. I was genuinely a little nervous — I was exposing something to the internet, inside my own network. Old me would've stopped there. Instead I thought: <em>there's probably a container for the security piece too.</em> Turns out, yeah. Problem solved." },
|
||||
{ p: "AI has a lot to do with this shift. Things that used to feel out of reach — self-hosting, networking, monitoring — feel a lot more approachable when you can just ask questions and get unstuck fast." },
|
||||
{ p: "Next goal: more Optiplexes, a Kubernetes cluster, and seeing how far this rabbit hole actually goes. I'll keep you posted." },
|
||||
],
|
||||
},
|
||||
{
|
||||
id: 'survival-sandbox-journey',
|
||||
visible: true,
|
||||
category: 'Entertainment',
|
||||
title: "Survival Sandboxes and the Itch I Can't Scratch",
|
||||
excerpt: "From Star Wars Galaxies to Enshrouded — apparently I've always been about building stuff and calling it home.",
|
||||
blocks: [
|
||||
{ p: "I never connected the dots until recently, but there's a clear thread running through every game I've actually sunk time into: you build something, and it feels like yours." },
|
||||
{ p: "It started with <strong>Star Wars Galaxies</strong> — one of the first MMOs I played. Yeah there was grinding, leveling, the full RPG loop. But what I kept coming back to was base building. There was something about someone walking into your place and saying <em>\"this is cool\"</em> that hit different. That little moment of validation from a stranger in a game. I get it now more than I did then." },
|
||||
{ p: "Fast forward and I'm playing <strong>Minecraft</strong> with my kid. Graphics are what they are, but the crafting system is genuinely deep. And watching a kid figure out resource chains and basic survival logic — that's actually pretty solid for a young brain. It holds up." },
|
||||
{ p: "A coworker told me he basically lived on Steam sales, buying whatever looked interesting at a discount. I did the same and landed on <strong>No Man's Sky</strong>. That game broke my brain a little. Procedurally generated solar systems, planets, flora, fauna — 18 quintillion planets. The number is absurd. But strip that away and it's basically Minecraft in space: gather everything or die trying. I put a lot of hours in, but a game that massive is hard to maintain intensity on. Eventually I dialed back." },
|
||||
{ p: "Steam does this thing where it watches what you play and suggests similar titles. That's how I found <strong>Enshrouded</strong>. Fantasy RPG setting, traditional classes, fluid real-time combat — no turn-based stuff, not my thing — with that same loop of crafting, foraging, and figuring things out. The quest line actually guides you through different biomes in a way that feels structured without being hand-holdy. Only complaint: I wish it was on Nintendo Switch so I could play it in traffic. Half joking." },
|
||||
{ p: "A coworker mentioned he ran a Minecraft server and something clicked — <em>I wonder if there's a container for Enshrouded.</em> There was. Threw it on the Dell Optiplex that was headed to decommission and it runs without breaking a sweat. A simple Docker Compose file and done. Sometimes working in networking and infrastructure has its perks: you see how the sausage is made and suddenly self-hosting a game server feels less like a project and more like a Tuesday." },
|
||||
{ p: "How long will the Enshrouded phase last? No idea. But here's the takeaway: if something looks interesting, Google it. There's probably a server image, a mod, a community, or at minimum a Reddit thread that tells you if it's worth your time." },
|
||||
],
|
||||
},
|
||||
]
|
||||
|
||||
@@ -83,4 +83,99 @@ export const posts = [
|
||||
thread that tells you if it's worth your time.</p>
|
||||
`,
|
||||
},
|
||||
{
|
||||
id: 'tls-proxy-saved-mobile-security-launch',
|
||||
date: '2026-08-05',
|
||||
category: 'professional',
|
||||
title: "How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay",
|
||||
excerpt: "A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year.",
|
||||
content: `
|
||||
<p>A new mobile security service — phishing and malware filtering through a dedicated APN —
|
||||
was ready to launch. Integration testing hit a wall: the legacy provisioning system could not
|
||||
complete a TLS handshake with the security platform's API.</p>
|
||||
|
||||
<h3>The Setup</h3>
|
||||
<p>Launching a new value-added service in a mobile network means coordinating multiple technology
|
||||
layers — from radio and packet core (EPC/5GC) to provisioning platforms and third-party security
|
||||
systems. The architecture called for a dedicated APN routing subscriber traffic through filtering
|
||||
engines, and integration with the provisioning platform so every subscription change triggered a
|
||||
call to the security platform's REST API. Everything was ready on paper. Then, during integration
|
||||
testing against the production API, communication failed outright.</p>
|
||||
|
||||
<h3>The Root Cause</h3>
|
||||
<p>The logs showed a classic cipher negotiation failure:
|
||||
<code>javax.net.ssl.SSLException: Received fatal alert: handshake_failure</code>.</p>
|
||||
<ul>
|
||||
<li>The legacy provisioning system ran an old Java stack, capped at outdated TLS 1.0/1.1 cipher suites.</li>
|
||||
<li>The security API required modern TLS 1.2/1.3 ciphers, no exceptions.</li>
|
||||
</ul>
|
||||
<p>This wasn't a vendor being difficult. TLS 1.0/1.1 have been formally deprecated by the IETF
|
||||
(RFC 8996) since 2021, blocked by every major browser since 2020, and banned under PCI DSS,
|
||||
NIST SP 800-52 Rev. 2, and HIPAA. Any provisioning backend still speaking TLS 1.0/1.1 isn't an
|
||||
isolated exception — it's part of an entire category of telco infrastructure hitting its
|
||||
expiration date at roughly the same time.</p>
|
||||
|
||||
<h3>The Operational Crossroads</h3>
|
||||
<p>The official answer — upgrading the provisioning engine's Java version — required upgrading
|
||||
the entire platform core: massive regression testing across dozens of other critical services,
|
||||
an estimated 12-18 month planning window, and no budget allocated for the current year. Accepting
|
||||
that path meant freezing the security project indefinitely and losing the commercial launch window.</p>
|
||||
<p>Accumulated technical debt grew by an estimated $6 trillion globally between 2012 and 2023
|
||||
(Oliver Wyman), with the U.S. alone accounting for $2.2 trillion of that increase. At the
|
||||
enterprise level, the average company loses over $370M a year from its inability to modernize
|
||||
legacy systems efficiently.</p>
|
||||
|
||||
<h3>The Fix: A Reverse Proxy in the Middle</h3>
|
||||
<p>Instead of forcing a structural change onto the provisioning platform, we applied a core
|
||||
systems-design principle: decouple application logic from the transport layer.</p>
|
||||
<pre>Legacy Provisioner --TLS 1.0/1.1--> Reverse Proxy --TLS 1.2/1.3--> Security API (Allot)
|
||||
(old Java) (container / NGINX) (filter engine)
|
||||
[ Handshake translation ]</pre>
|
||||
<p>The provisioning system sent its request to the proxy's internal address using the only
|
||||
cipher suites its old Java stack supported. The proxy terminated that legacy TLS session
|
||||
internally, then immediately opened a fresh handshake to the external Allot API using modern
|
||||
TLS 1.2/1.3. The response traveled back the same path, in reverse. Deployed as an ultralight,
|
||||
isolated container — designed, tested, and live in a matter of days.</p>
|
||||
|
||||
<h3>The Business Result</h3>
|
||||
<ul>
|
||||
<li><strong>Zero delay to go-to-market.</strong> The service launched on schedule.</li>
|
||||
<li><strong>Breathing room for the real upgrade.</strong> The infrastructure team got over a
|
||||
year to plan, budget, and execute the major provisioning upgrade properly.</li>
|
||||
<li><strong>Zero risk introduced.</strong> Not a single parameter on the core provisioning
|
||||
platform was touched.</li>
|
||||
</ul>
|
||||
|
||||
<h3>Why This Pattern Is Standard Now</h3>
|
||||
<p>What we solved with a few lines of proxy config is, in hindsight, a tactical answer to a
|
||||
structural industry trend. The TLS-legacy grace period is closing in cascade — Meraki, Azure
|
||||
Storage, Office 365, and Exchange Online are all running their own TLS 1.0/1.1 shutdowns through
|
||||
2026. Tech debt now represents roughly 40% of large enterprises' IT balance sheets (McKinsey),
|
||||
and the sidecar/proxy pattern — terminating TLS and decoupling transport with NGINX, HAProxy, or
|
||||
Envoy — is already standard practice in container architectures precisely because it absorbs this
|
||||
kind of compatibility gap without touching critical systems.</p>
|
||||
|
||||
<h3>Lessons Learned</h3>
|
||||
<ol>
|
||||
<li><strong>Technical debt always collects eventually.</strong> Global technical debt sits at
|
||||
61 billion person-days of remediation work (CAST Software, 2025) — waiting for "someday"
|
||||
budget stops being a viable strategy.</li>
|
||||
<li><strong>Engineering pragmatism beats perfectionism.</strong> The pragmatic solution beat
|
||||
the purist one, and delivered business value while managing risk safely.</li>
|
||||
<li><strong>The proxy/sidecar pattern became a standard.</strong> Decoupled proxies became a
|
||||
default part of our container architectures going forward.</li>
|
||||
<li><strong>AI as an accelerator, not a replacement for judgment.</strong> AI tools sped up
|
||||
troubleshooting the handshake failure and generating precise proxy configs — they didn't
|
||||
replace the engineering call to make.</li>
|
||||
</ol>
|
||||
|
||||
<p><em>Have you run into a legacy-meets-modern-API collision in your own projects? What pattern
|
||||
did you use to bridge it?</em></p>
|
||||
|
||||
<p style="font-size:0.85em;opacity:0.7">Sources: Cisco Meraki Documentation, The Register,
|
||||
Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta
|
||||
(2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey
|
||||
(via byteiota.com), HFS Research.</p>
|
||||
`,
|
||||
},
|
||||
]
|
||||
Reference in New Issue
Block a user