Divyam Azad — notes

Self-hosted NetBird with the embedded IdP (and the bcrypt gotcha)

Sat, 22 Aug 2026 09:00:00 +0530

I wanted a private network between my devices and the server: the box reachable over the mesh instead of the public internet, admin interfaces that do not need to be public, and a control plane I own. NetBird is WireGuard underneath, which is what I run elsewhere anyway, and its self-hosted server has become small enough to sit next to a portfolio site on a 4 GB VPS.

CrowdSec on a 4 GB VPS in an afternoon

Sat, 22 Aug 2026 08:55:00 +0530

The server behind this site has exactly one thing listening on the internet: Caddy, on ports 80 and 443. Everything else is reachable only on the compose network. That is a small surface, but it is a surface, and the access log filled with vulnerability scanners within an hour of the first certificate being issued. This is how I put CrowdSec in front of it, in a way that fits the rest of the repository: declared in git, bootstrapped by the deploy script, visible on a public page.

Moving a Telegram bot between hosts without losing a message

Sat, 22 Aug 2026 08:50:00 +0530

A small Telegram bot I wrote — a household assistant that lives entirely on button taps — used to run as a native binary on an old laptop under launchd. When I set up a proper server, I wanted to move it there. Moving it is not hard; moving it without two copies running at once takes a little care.

The bind mount that pinned an inode

Sat, 22 Aug 2026 08:45:00 +0530

A small one, but it bit hard enough to be worth writing down.

The setup

Caddy runs as a container with its configuration bind-mounted from the repository:

volumes:
 - ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro

The deploy script pulls the repository and, because Compose cannot see the contents of a bind mount changing, follows docker compose up -d with a graceful caddy reload. I added a respond /healthz 200 line, pushed, watched the deploy succeed and the reload report no errors — and /healthz still returned 404.

Docker 29 made my bot restart on every deploy

Sat, 22 Aug 2026 08:40:00 +0530

My deploy loop is deliberately boring: a systemd timer pulls a repository every five minutes, computes a fingerprint, and runs docker compose up -d --build only when something changed. Compose, in turn, is supposed to recreate only the containers whose configuration or image changed. So when I pushed a README-only commit and watched the Telegram bot restart, something was wrong.

How this site is hosted

Sat, 22 Aug 2026 08:30:00 +0530

Everything that runs behind divyam.top lives on one small virtual server — two vCPUs, four gigabytes of memory — and is described by a single private git repository. The server pulls that repository every five minutes and converges to it with Docker Compose. Nothing on the machine is edited by hand; to change production, I push.