# Thoughts & Stories: DevOps

> Sharing my experiences, learnings, and adventures in tech and beyond.

URL: https://www.matthewswong.com/en/blog/category/devops/

- [How to Secure a Docker Container: 7 Steps for Beginners](https://www.matthewswong.com/en/blog/cara-mengamankan-container-docker/)
- [How to Roll Back a Docker Deploy on a VPS (Beginner Guide)](https://www.matthewswong.com/en/blog/cara-rollback-deploy-docker-di-vps/)
- [Docker Swarm vs Kubernetes: A Small Team Load Test Verdict](https://www.matthewswong.com/en/blog/docker-swarm-vs-kubernetes-small-team-load-test/)
- [How to Deploy Docker Compose in Production for Beginners](https://www.matthewswong.com/en/blog/cara-deploy-docker-compose-production-vps/)
- [How to Turn a Plain Dockerfile into a Docker Multi-Stage Build](https://www.matthewswong.com/en/blog/cara-membuat-multi-stage-build-docker/)
- [How to View Docker Logs: Tail, Follow and Compose Guide](https://www.matthewswong.com/en/blog/cara-melihat-docker-logs-untuk-pemula/)
- [How to Create CI/CD with GitHub Actions: 7 Beginner Steps](https://www.matthewswong.com/en/blog/cara-membuat-ci-cd-github-actions-pemula/)
- [How to Fix Docker No Space Left on Device (7 Steps)](https://www.matthewswong.com/en/blog/cara-mengatasi-docker-no-space-left-on-device/)
- [How to Store Docker Secrets and Environment Variables Safely](https://www.matthewswong.com/en/blog/cara-simpan-secret-environment-variable-docker-aman/)
- [Learn Docker from Scratch: First Container in 6 Steps](https://www.matthewswong.com/en/blog/belajar-docker-dari-nol-panduan-pemula/)
- [How to Deploy Next.js to a VPS with Docker and GitHub Actions](https://www.matthewswong.com/en/blog/cara-deploy-nextjs-ke-vps-docker-github-actions/)
- [How to Log In to a VPS Over SSH and Secure It (Beginner Guide)](https://www.matthewswong.com/en/blog/cara-login-ssh-vps-aman-pemula/)
- [How to Set Up Nginx Reverse Proxy for Docker and Cloudflare](https://www.matthewswong.com/en/blog/cara-setting-nginx-reverse-proxy-docker-cloudflare/)
- [Autoscale vLLM on Kubernetes with KEDA: Queue Depth, Not GPU %](https://www.matthewswong.com/en/blog/autoscale-vllm-keda-queue-depth-gpu-eks/)
- [AI Code Review Bottleneck: What CMU and Stanford Measured](https://www.matthewswong.com/en/blog/ai-code-review-bottleneck-cmu-stanford-silent-approvals/)
- [npm Trusted Publishing: 48-Hour Expiry and issue_comment Ban](https://www.matthewswong.com/en/blog/npm-trusted-publishing-48-hour-expiry-issue-comment/)
- [kubectl-ai Guide: Confirmation Gate, Limits and MCP Server Risk](https://www.matthewswong.com/en/blog/kubectl-ai-google-human-in-loop-guide/)
- [Argo CD 3.5: mTLS, Source Integrity and Helm 4 Upgrade Guide](https://www.matthewswong.com/en/blog/argo-cd-3-5-whats-new-upgrade/)
- [Flux 2.9: CLI Plugins, SSA Ignore Rules and OIDC Webhooks](https://www.matthewswong.com/en/blog/flux-2-9-cli-plugins-gitops-features/)
- [Terraform 1.16: What's New and How to Upgrade Safely](https://www.matthewswong.com/en/blog/terraform-1-16-whats-new-upgrade-guide/)
- [OpenTofu 1.13: convert, assume and Upgrade Breaking Changes](https://www.matthewswong.com/en/blog/opentofu-1-13-whats-new-upgrade-notes/)
- [KubeCon North America 2026 Guide: AI Track, Co-located Days](https://www.matthewswong.com/en/blog/kubecon-na-2026-salt-lake-city-guide/)
- [OpenTofu Ephemeral Resources and Write-Only Attributes](https://www.matthewswong.com/en/blog/opentofu-ephemeral-resources-write-only-attributes/)
- [ingress-nginx Retirement: Contour or Gateway API Migration](https://www.matthewswong.com/en/blog/ingress-nginx-retirement-migration-paths/)
- [Ingress2Gateway 1.0: Migrate ingress-nginx to Gateway API](https://www.matthewswong.com/en/blog/ingress2gateway-1-0-migration-walkthrough/)
- [kube-proxy ipvs Deprecated: Migrate to nftables by v1.40](https://www.matthewswong.com/en/blog/kube-proxy-ipvs-deprecation-nftables-migration/)
- [Kubernetes MCP Server: read_only, Toolsets, Denied Resources](https://www.matthewswong.com/en/blog/kubernetes-mcp-server-go-read-only-toolsets/)
- [Kubernetes HPA Scale to Zero for GPU Queue Workers (1.37)](https://www.matthewswong.com/en/blog/kubernetes-hpa-scale-to-zero-gpu-queue-workers/)
- [Kubernetes 1.37 Release: What Breaks When Upgrading From 1.36](https://www.matthewswong.com/en/blog/kubernetes-1-37-garhwal-whats-new/)
- [KYAML in Kubernetes 1.37: Stable YAML Subset, kubectl -o kyaml](https://www.matthewswong.com/en/blog/kyaml-kubernetes-stable-yaml-format/)
- [DORA AI-Assisted Development: Throughput Up, Instability Up](https://www.matthewswong.com/en/blog/dora-2026-ai-throughput-instability-devops/)
- [PagerDuty SRE Agent: Virtual Responder Setup and Guardrails](https://www.matthewswong.com/en/blog/pagerduty-sre-agent-virtual-responder-guide/)
- [Copilot Fix Failing GitHub Actions: Setup and Review Rules](https://www.matthewswong.com/en/blog/copilot-cloud-agent-fix-failing-github-actions/)
- [HolmesGPT Kubernetes Alerts: Runbooks Beat the Model Choice](https://www.matthewswong.com/en/blog/holmesgpt-runbooks-prometheus-slack-investigations/)
- [Agentic Workflow CI Failure Triage with gh-aw CI Doctor](https://www.matthewswong.com/en/blog/gh-aw-ci-doctor-failing-workflow-triage/)
- [GitHub Agentic Workflows: Markdown Automation with gh aw](https://www.matthewswong.com/en/blog/github-agentic-workflows-markdown-gh-aw-guide/)
- [Terraform MCP Server GA: A Safe Agent Setup Since 1.1.0](https://www.matthewswong.com/en/blog/terraform-mcp-server-ga-safe-agent-setup/)
- [Grafana MCP Server: OAuth Scopes for Claude Code and Cursor](https://www.matthewswong.com/en/blog/grafana-cloud-mcp-server-oauth-read-query-write/)
- [Grafana Assistant Investigations: Alert-Triggered RCA Setup](https://www.matthewswong.com/en/blog/grafana-assistant-investigations-alert-triggered-rca/)
- [NVIDIA Run:ai Open Source: KAI Scheduler, GPU Fractioning](https://www.matthewswong.com/en/blog/nvidia-runai-open-source-kai-scheduler-gpu-fractioning/)
- [Volcano Scheduler GPU Gang Preemption: v1.15 DRA Queue Quota](https://www.matthewswong.com/en/blog/volcano-1-15-gang-preemption-dra-queue-quota/)
- [Kubernetes DRA GPU Fallback: Prioritized List in 1.36](https://www.matthewswong.com/en/blog/kubernetes-1-36-dra-prioritized-list-gpu-fallback/)
- [Kubernetes 1.37 DRA Extended Resources GA: Run example.com/gpu Without a Device Plugin](https://www.matthewswong.com/en/blog/kubernetes-1-37-dra-extended-resources-ga/)
- [Kubernetes Gang Scheduling Beta in 1.37: What Works, What Not](https://www.matthewswong.com/en/blog/kubernetes-1-37-gang-scheduling-beta-ai-training/)
- [Gateway API Inference Extension: EPP Moves to llm-d, What Now](https://www.matthewswong.com/en/blog/gateway-api-inference-extension-epp-moves-to-llm-d/)
- [llm-d on Kubernetes: Distributed Inference and v0.10 Hardening](https://www.matthewswong.com/en/blog/llm-d-kubernetes-native-distributed-inference/)
- [Anthropic Replaced Git With Scion: What Agent-Scale Source Control Changes](https://www.matthewswong.com/en/blog/anthropic-scion-replaced-git-monorepo/)
- [Design a Metrics and Monitoring System: A Prometheus Pipeline](https://www.matthewswong.com/en/blog/design-metrics-monitoring-system/)
- [SLI vs SLO vs SLA: Definitions, Error Budgets and Burn Rates](https://www.matthewswong.com/en/blog/slo-sli-sla-reliability-explained/)
- [Load Balancing Algorithms: Round Robin, Least Conn, IP Hash](https://www.matthewswong.com/en/blog/load-balancing-algorithms-explained/)
- [AWS Bedrock AgentCore Guide: Runtime, Gateway, Memory, Policy](https://www.matthewswong.com/en/blog/aws-bedrock-agentcore-guide/)
- [Codex SDK Tutorial: Automate Coding Tasks in TypeScript](https://www.matthewswong.com/en/blog/codex-sdk-typescript-automation/)
- [Easypanel vs Coolify vs Dokploy: Self-Hosted PaaS on a VPS](https://www.matthewswong.com/en/blog/easypanel-vs-coolify-vs-dokploy/)
- [OpenTelemetry GenAI Semantic Conventions: Agent Spans in Tempo](https://www.matthewswong.com/en/blog/opentelemetry-genai-agent-spans-tracing/)
- [Build Gates: Architecture Rules a README Cannot Enforce](https://www.matthewswong.com/en/blog/build-gates-architecture-rules-ci/)
- [Reading Production Logs Without SSH on a Managed PaaS](https://www.matthewswong.com/en/blog/reading-production-logs-without-ssh/)
- [Zero-Downtime Schema Migrations on a Rolling Deploy](https://www.matthewswong.com/en/blog/zero-downtime-migration-rolling-deploy/)
- [Docker Build Cache: Faster PaaS Deploys From a Cold Builder](https://www.matthewswong.com/en/blog/docker-build-cache-paas-deploy-speed/)
- [Claude Code Plugin Upgrades: Version Pinning and Rollback](https://www.matthewswong.com/en/blog/claude-code-plugin-rollback-version-pinning/)
- [Claude Code Plugin Release Automation in GitHub Actions](https://www.matthewswong.com/en/blog/claude-code-plugin-ci-release-automation/)
- [AI DevOps Assistants for Kubernetes Production Triage](https://www.matthewswong.com/en/blog/ai-devops-assistant-production-triage/)
- [How a PaaS Build Engine Auto-Writes Your Dockerfile](https://www.matthewswong.com/en/blog/helipack-auto-dockerfile-build-engine/)
- [Self-Hosting n8n and Flowise on an IDR-Billed Platform](https://www.matthewswong.com/en/blog/one-click-n8n-flowise-self-host-idr/)
- [Claude Code Environment Variables That Actually Matter](https://www.matthewswong.com/en/blog/claude-code-env-vars-reference-guide/)
- [Claude Code OpenTelemetry: Metrics, Events and Cost](https://www.matthewswong.com/en/blog/claude-code-analytics-otel-monitoring/)
- [Claude Code Network Config: Proxies, mTLS and Domains](https://www.matthewswong.com/en/blog/claude-code-network-config-proxy-firewall/)
- [Claude Code Dev Containers: Isolation That Holds](https://www.matthewswong.com/en/blog/claude-code-devcontainer-setup/)
- [Claude Code in GitLab CI/CD: Jobs, OIDC and MRs](https://www.matthewswong.com/en/blog/claude-code-gitlab-ci-cd-integration/)
- [Claude Code Scheduled Tasks: Loops, Cron and Routines](https://www.matthewswong.com/en/blog/claude-code-scheduled-tasks-routines/)
- [Claude Code Self-Hosted Runners: Cloud Sessions, Your Box](https://www.matthewswong.com/en/blog/claude-code-self-hosted-runners-guide/)
- [Running the Hermes Agent as an Autonomous Coder on a VPS](https://www.matthewswong.com/en/blog/hermes-agent-autonomous-coding-vps-setup/)
- [A Deterministic Merge Gate for a Self-Merging AI Agent](https://www.matthewswong.com/en/blog/autonomous-agent-merge-gate-hook/)
- [Debugging a Production VPS Incident With Claude Code](https://www.matthewswong.com/en/blog/claude-code-production-incident-debugging/)
- [Claude Code Headless Mode for CI/CD Pipelines](https://www.matthewswong.com/en/blog/claude-code-headless-mode-ci-guide/)
- [Claude Code GitHub Actions: Issue to Merged PR](https://www.matthewswong.com/en/blog/claude-code-github-actions-guide/)
- [Parallel Claude Code Agents With Git Worktrees](https://www.matthewswong.com/en/blog/claude-code-parallel-agents-git-worktrees/)
- [AI Code Review Tools Compared for 2026](https://www.matthewswong.com/en/blog/ai-code-review-tools-compared/)
- [Helm 4 Migration Guide: What's New and How to Upgrade](https://www.matthewswong.com/en/blog/helm-4-migration-guide/)
- [Load Testing Node.js APIs with k6 and Grafana Dashboards](https://www.matthewswong.com/en/blog/k6-load-testing-nodejs-grafana/)
- [Podman Quadlets: Replace Docker Compose with systemd](https://www.matthewswong.com/en/blog/podman-quadlets-replace-docker-compose/)
- [KEDA: Event-Driven Autoscaling & Scale-to-Zero on K8s](https://www.matthewswong.com/en/blog/keda-event-driven-autoscaling-kubernetes/)
- [Kubernetes In-Place Pod Resize: CPU & Memory No Restart](https://www.matthewswong.com/en/blog/kubernetes-in-place-pod-resize/)
- [kubectl debug: Fix CrashLoopBackOff & Distroless Pods](https://www.matthewswong.com/en/blog/kubectl-debug-crashloopbackoff-distroless/)
- [Prometheus 3.0: OTLP, Native Histograms, UTF-8 & New UI](https://www.matthewswong.com/en/blog/prometheus-3-0-whats-new/)
- [uv: The Fast Rust Python Package Manager Replacing pip](https://www.matthewswong.com/en/blog/uv-python-package-manager-rust/)
- [Kubernetes Native Sidecar Containers: A Practical Guide](https://www.matthewswong.com/en/blog/kubernetes-native-sidecar-containers/)
- [Progressive Delivery with Argo Rollouts: Canary & Blue-Green](https://www.matthewswong.com/en/blog/argo-rollouts-progressive-delivery-canary/)
- [Docker Buildx Bake: Declarative Multi-Platform Image Builds](https://www.matthewswong.com/en/blog/docker-bake-multi-platform-builds/)
- [Feature-Flag-Driven Trunk-Based Development](https://www.matthewswong.com/en/blog/feature-flag-driven-trunk-based-development/)
- [Reusable Workflows vs Composite Actions in GitHub Actions](https://www.matthewswong.com/en/blog/github-actions-reusable-workflows-composite-actions/)
- [Autoscaling GitHub Actions Runners on Kubernetes with ARC](https://www.matthewswong.com/en/blog/github-actions-runner-autoscaling-arc/)
- [Migrating to Grafana Alloy from Promtail and Agent](https://www.matthewswong.com/en/blog/grafana-alloy-opentelemetry-collector-migration/)
- [Incus/LXC System Containers vs Docker Application Containers](https://www.matthewswong.com/en/blog/incus-lxc-system-containers-vs-docker/)
- [Kubernetes Gateway API vs Ingress: Why It Replaces Annotations](https://www.matthewswong.com/en/blog/kubernetes-gateway-api-vs-ingress/)
- [OpenTofu vs Terraform: Migrating After the License Change](https://www.matthewswong.com/en/blog/opentofu-vs-terraform-migration/)
- [Scaling Prometheus Storage with Grafana Mimir](https://www.matthewswong.com/en/blog/prometheus-remote-write-mimir-scaling/)
- [restic vs BorgBackup: Encrypted, Deduplicated Backups](https://www.matthewswong.com/en/blog/restic-vs-borg-encrypted-backups/)
- [Import Existing Infrastructure into Terraform Without Hand-Writing HCL](https://www.matthewswong.com/en/blog/terraform-import-blocks-existing-infra/)
- [Controlling Docker From Your Backend: dockerode and the Socket](https://www.matthewswong.com/en/blog/docker-daemon-socket-backend-control/)
- [Docker BuildKit Cache Mounts: Cut CI Build Times in Half](https://www.matthewswong.com/en/blog/docker-buildkit-cache-mounts-faster-builds/)
- [Docker Swarm Load Testing: Why More Replicas Didn't Fix Throughput](https://www.matthewswong.com/en/blog/docker-swarm-load-testing-replicas-throughput/)
- [Building a Custom CPU Autoscaler for Docker Swarm](https://www.matthewswong.com/en/blog/docker-swarm-custom-autoscaler-cpu/)
- [Finding a Postgres Row-Lock Bottleneck with Prometheus + InfluxDB](https://www.matthewswong.com/en/blog/postgres-row-lock-bottleneck-prometheus-influxdb/)
- [k6 SLO Quality Gate for Bitbucket Pipelines CI/CD](https://www.matthewswong.com/en/blog/slo-quality-gate-bitbucket-pipeline/)
- [Dokploy: A Self-Hosted PaaS for Your Own VPS](https://www.matthewswong.com/en/blog/dokploy-self-hosted-paas-vps/)
- [Coolify vs Dokploy: Choosing a Self-Hosted PaaS](https://www.matthewswong.com/en/blog/coolify-vs-dokploy-self-hosted-paas/)
- [Kamal 2: Zero-Downtime Docker Deploys Without Kubernetes](https://www.matthewswong.com/en/blog/kamal-2-docker-deployment-guide/)
- [GitHub Actions OIDC: Keyless Cloud Auth for CI/CD](https://www.matthewswong.com/en/blog/github-actions-oidc-keyless-cloud-auth/)
- [Distroless Docker Images: Smaller, Safer Containers](https://www.matthewswong.com/en/blog/docker-distroless-image-optimization/)
- [Prometheus Cardinality: Recording Rules That Save Your TSDB](https://www.matthewswong.com/en/blog/prometheus-recording-rules-cardinality/)
- [VictoriaMetrics vs Prometheus for Long-Term Metrics](https://www.matthewswong.com/en/blog/victoriametrics-vs-prometheus-long-term/)
- [Renovate: Automated Dependency Updates Done Right](https://www.matthewswong.com/en/blog/renovate-automated-dependency-updates/)
- [Tailscale: A Mesh VPN for Your Servers and Homelab](https://www.matthewswong.com/en/blog/tailscale-mesh-vpn-self-hosted/)
- [OpenTelemetry Collector: Designing a Telemetry Pipeline](https://www.matthewswong.com/en/blog/opentelemetry-collector-pipeline-design/)
- [Docker Compose Watch: Instant Feedback for Local Container Dev](https://www.matthewswong.com/en/blog/docker-compose-watch-local-dev/)
- [Caddy vs Nginx for Automatic HTTPS: When Each One Wins](https://www.matthewswong.com/en/blog/caddy-vs-nginx-automatic-https/)
- [GitHub Actions Caching Strategies That Actually Cut CI Minutes](https://www.matthewswong.com/en/blog/github-actions-caching-strategies/)
- [Uptime Kuma: Self-Hosted Uptime Monitoring That Just Works](https://www.matthewswong.com/en/blog/self-hosted-uptime-kuma-monitoring/)
- [Blue-Green vs Canary Deployments on a Budget (No Kubernetes)](https://www.matthewswong.com/en/blog/blue-green-vs-canary-on-budget/)
- [What cgroups v2 Really Does When You Set Docker Memory Limits](https://www.matthewswong.com/en/blog/linux-cgroups-container-resource-limits/)
- [Practical 3-2-1 Backups for VPSs with Restic and Object Storage](https://www.matthewswong.com/en/blog/backup-3-2-1-strategy-vps/)
- [Mastering Observability: Loki and Prometheus Integration for Horizontally Scaled Environments](https://www.matthewswong.com/en/blog/loki-prometheus-observability/)
- [CI/CD with GitHub Actions: From Zero to Production](https://www.matthewswong.com/en/blog/ci-cd-pipeline-github-actions/)
- [Kubernetes Deployment Strategies Explained](https://www.matthewswong.com/en/blog/kubernetes-deployment-strategies/)
- [Docker Best Practices for Production Containers](https://www.matthewswong.com/en/blog/docker-containerization-best-practices/)
- [Docker Swarm: Container Orchestration for Smaller Teams](https://www.matthewswong.com/en/blog/docker-swarm-orchestration/)
- [Ansible Infrastructure Automation Guide](https://www.matthewswong.com/en/blog/ansible-automation-infrastructure/)
- [Infrastructure as Code with Terraform](https://www.matthewswong.com/en/blog/infrastructure-as-code-terraform/)
- [GitOps with ArgoCD and Flux CD Explained](https://www.matthewswong.com/en/blog/gitops-argocd-flux/)
- [SRE: SLOs, SLAs & Error Budgets Explained](https://www.matthewswong.com/en/blog/site-reliability-engineering-sre/)
- [DevSecOps: Integrating Security into CI/CD](https://www.matthewswong.com/en/blog/devsecops-security-pipeline/)
- [Cut GCS Egress Costs: Migrate to Cloudflare R2](https://www.matthewswong.com/en/blog/cloudflare-r2-gcs-egress/)
- [Free Custom Email: Cloudflare Routing + SMTP2Go](https://www.matthewswong.com/en/blog/cloudflare-email-inbound-smtp2go/)
- [Indonesia's PDN (Pusat Data Nasional): What Developers Need to Know About Government Cloud Migration](https://www.matthewswong.com/en/blog/pusat-data-nasional-pdn-cloud-developer-guide/)
- [FinOps for Indonesian Cloud Teams: A Practical Cost Optimization Guide](https://www.matthewswong.com/en/blog/finops-cloud-cost-optimization-indonesia/)
- [k3s Lightweight Kubernetes for Indonesian Startups: Production Setup on Budget VPS](https://www.matthewswong.com/en/blog/kubernetes-k3s-production-lightweight-indonesia/)
- [Platform Engineering and Internal Developer Platforms: Building the Paved Road for Your Team](https://www.matthewswong.com/en/blog/platform-engineering-internal-developer-platform/)
- [Google Cloud vs DigitalOcean: A Practical Guide for Side-Project Developers](https://www.matthewswong.com/en/blog/google-cloud-vs-digital-ocean/)
- [Grafana + Prometheus Monitoring Stack for Your VPS: Complete Setup Guide](https://www.matthewswong.com/en/blog/grafana-prometheus-monitoring-vps/)
- [Zero-Downtime Deployments with NGINX Blue-Green on a Single VPS](https://www.matthewswong.com/en/blog/zero-downtime-nginx-blue-green-deploy/)
- [Automate SSL Certificate Renewal with Certbot and NGINX](https://www.matthewswong.com/en/blog/automate-ssl-certbot-nginx/)
- [Self-Hosted Observability Stack on DigitalOcean: Metrics, Logs, and Alerts](https://www.matthewswong.com/en/blog/self-hosted-observability-digital-ocean/)
- [Kubernetes for the Solo Developer: A Practical GKE Guide Without the Overhead](https://www.matthewswong.com/en/blog/kubernetes-solo-developer-guide/)
- [The Docker Workflow I Use on Every Project](https://www.matthewswong.com/en/blog/docker-workflow-every-project/)
- [Google Cloud Managed Services vs Raw Compute: When to Use Which](https://www.matthewswong.com/en/blog/google-cloud-managed-services-vs-raw-compute/)
- [Event-Driven Architecture with Kafka and NestJS: A Production Guide](https://www.matthewswong.com/en/blog/event-driven-kafka-nestjs/)
- [gRPC vs REST for Internal Microservices APIs: A Practical Comparison](https://www.matthewswong.com/en/blog/microservices-grpc-vs-rest-internal/)
- [PostgreSQL Sharding Strategy: When and How to Scale Your Database](https://www.matthewswong.com/en/blog/postgresql-sharding-strategy/)
- [Message Queues in Node.js: RabbitMQ vs BullMQ — Which Should You Choose?](https://www.matthewswong.com/en/blog/message-queue-rabbitmq-bullmq/)
- [API Gateway Pattern with NestJS: Routing, Auth, and Rate Limiting in Production](https://www.matthewswong.com/en/blog/api-gateway-pattern-nestjs-guide/)
- [Distributed Tracing with OpenTelemetry: A Practical NestJS Implementation](https://www.matthewswong.com/en/blog/distributed-tracing-opentelemetry/)
- [Circuit Breaker Pattern in NestJS: Building Resilient Microservices](https://www.matthewswong.com/en/blog/circuit-breaker-nestjs-pattern/)
- [CQRS and Event Sourcing with NestJS: When Complexity is Worth It](https://www.matthewswong.com/en/blog/cqrs-event-sourcing-nestjs/)
- [Scaling WebSockets with Redis Pub/Sub: From One Server to Many](https://www.matthewswong.com/en/blog/websocket-scaling-redis-pubsub/)
- [OWASP Top 10 Developer Checklist: What I Actually Implement](https://www.matthewswong.com/en/blog/owasp-top-10-developer-checklist/)
- [JWT vs Session Authentication in Production: What I Actually Use](https://www.matthewswong.com/en/blog/jwt-vs-session-auth-production/)
- [SQL Injection Prevention with ORMs: Why Prisma and TypeORM Still Need Your Help](https://www.matthewswong.com/en/blog/sql-injection-orm-prevention/)
- [CORS Configuration for Next.js and NestJS: Getting It Right in Production](https://www.matthewswong.com/en/blog/cors-configuration-nextjs-nestjs/)
- [HTTPS and TLS Beyond Certbot: Hardening Your SSL Configuration](https://www.matthewswong.com/en/blog/https-tls-beyond-certbot/)
- [API Security in NestJS Production: The Controls I Actually Deploy](https://www.matthewswong.com/en/blog/api-security-nestjs-production/)
- [Secret Scanning and Preventing Credentials Leaks in GitHub](https://www.matthewswong.com/en/blog/secret-scanning-github-prevention/)
- [Docker Container Security Scanning with Trivy: A Production Guide](https://www.matthewswong.com/en/blog/docker-container-security-scanning/)
- [Penetration Testing Basics for Developers: What I Learned from PwC CTF](https://www.matthewswong.com/en/blog/penetration-testing-developer-basics/)
- [Nginx vs Traefik: Choosing the Right Reverse Proxy for Your Stack](https://www.matthewswong.com/en/blog/nginx-vs-traefik/)
- [Linux Server Hardening Checklist: What I Do on Every Fresh VPS](https://www.matthewswong.com/en/blog/linux-server-hardening/)
- [GitHub Actions vs GitLab CI: Which CI/CD Platform Should You Choose?](https://www.matthewswong.com/en/blog/github-actions-vs-gitlab/)
- [PostgreSQL vs MySQL in Production: Which Database Should You Choose?](https://www.matthewswong.com/en/blog/postgresql-vs-mysql/)
- [Redis Caching Patterns for NestJS: From 450ms to 42ms API Response Times](https://www.matthewswong.com/en/blog/redis-caching-nestjs/)
- [Docker Compose vs Kubernetes for Small Teams: When to Use Each](https://www.matthewswong.com/en/blog/docker-compose-vs-k8s/)
- [Monitoring and Alerting for Solo DevOps: A Practical Stack That Works](https://www.matthewswong.com/en/blog/monitoring-alerting-solo/)
- [SSH Security Hardening for VPS: Stop the Brute Force Before It Starts](https://www.matthewswong.com/en/blog/ssh-security-hardening/)
- [PostgreSQL Backup Strategy for VPS: From pg_dump to WAL Archiving](https://www.matthewswong.com/en/blog/postgresql-backup-strategy/)
- [Nginx Performance Tuning: From Default Config to 50,000 Req/s](https://www.matthewswong.com/en/blog/nginx-performance-tuning/)
- [Fail2ban on VPS: Automate Brute Force Protection in 15 Minutes](https://www.matthewswong.com/en/blog/fail2ban-vps-security/)
- [Systemd Services for Background Jobs: The Right Way to Run Node.js in Production](https://www.matthewswong.com/en/blog/systemd-services-jobs/)
- [WireGuard VPN for Private Cloud Networking: Simple, Fast, Secure](https://www.matthewswong.com/en/blog/wireguard-vpn-cloud/)
- [Log Rotation in Linux: Managing Production Logs Before They Fill Your Disk](https://www.matthewswong.com/en/blog/log-rotation-linux/)
- [Docker Secrets in Production: Stop Putting API Keys in Environment Variables](https://www.matthewswong.com/en/blog/docker-secrets-production/)
- [Cloud Run vs Cloud Functions: Which Google Serverless Platform Should You Use?](https://www.matthewswong.com/en/blog/cloud-run-vs-functions/)
- [Building Reusable Terraform Modules: A Production IaC Guide](https://www.matthewswong.com/en/blog/terraform-modules-reusable/)
- [Ansible Playbooks in Production: Real Automation Patterns That Scale](https://www.matthewswong.com/en/blog/ansible-playbooks-production/)
- [How I Cut Cloud Costs by 40%: Real Optimization Strategies That Work](https://www.matthewswong.com/en/blog/cloud-cost-optimization/)
- [Multi-Cloud Strategy for Small Teams: Is It Worth the Complexity?](https://www.matthewswong.com/en/blog/multi-cloud-small-teams/)
- [CDN with Cloudflare: How to Properly Serve Static Assets at the Edge](https://www.matthewswong.com/en/blog/cdn-cloudflare-static/)
- [Nginx Load Balancer in Production: Configuration, Health Checks, and Failover](https://www.matthewswong.com/en/blog/load-balancer-production-config/)
- [Disaster Recovery Planning for VPS: Backups, RTO, and Actual Tested Recovery](https://www.matthewswong.com/en/blog/disaster-recovery-vps/)
- [Container Registry Strategy on GCP: From GCR to Artifact Registry](https://www.matthewswong.com/en/blog/container-registry-gcr/)
- [VPC Networking for Developers: A Practical Guide to Cloud Network Isolation](https://www.matthewswong.com/en/blog/vpc-networking-guide/)
- [Cloud Storage vs MinIO: Choosing Your Object Storage for Production](https://www.matthewswong.com/en/blog/cloud-storage-vs-minio/)
- [GitHub Actions Self-Hosted Runners: Complete Setup and Security Guide](https://www.matthewswong.com/en/blog/github-actions-runners/)
- [HashiCorp Vault for Production Secrets Management: Setup and Best Practices](https://www.matthewswong.com/en/blog/hashicorp-vault-secrets/)
- [Prometheus and AlertManager: Building an On-Call Alert System That Works](https://www.matthewswong.com/en/blog/prometheus-alertmanager/)
- [Elastic Stack (ELK) Self-Hosted: Production Setup and Operational Lessons](https://www.matthewswong.com/en/blog/elastic-stack-self-hosted/)

---

- HTML version: https://www.matthewswong.com/en/blog/category/devops/
- Bahasa Indonesia: https://www.matthewswong.com/id/blog/category/devops/
- Site index for agents: https://www.matthewswong.com/llms.txt
- Sitemap: https://www.matthewswong.com/sitemap.xml
- API description (OpenAPI): https://www.matthewswong.com/openapi.json