The EuroVPS blog
Field notes.
From the engine room.
Decisions, investigations and lessons from running production infrastructure. Written by the people who look after it.
The archive
More from the team.
A migration is a project, not a ticket.
A major publisher's group of high-traffic news properties had to change datacenters, re-architected for scale on the way onto our bare metal. We designed the platform, load-tested it, and cut over in a two-hour operation with a roughly five-minute visible window and a rollback path on every phase.
Read-after-write consistency on a Galera cluster
A Galera or Percona XtraDB cluster certifies a write at commit and applies it on the other nodes a moment later, and a read routed into that gap sees the past.
They stopped calling us when things break.
Clients stopped calling us when things break, and started calling us to build what is next: release engineering, staging environments, secure access and migrations run as projects now fill our engineering queue. The proof is not a testimonial. It is the work itself.
NFS exports and mounts that fail safely
The NFS defaults that bite shared content: open exports, root access, soft mounts and boot hangs, plus the settings and checks that fix them.
A GitLab backup you cannot restore is just a large file
The GitLab backup archive leaves out the files that make it restorable. What to copy alongside it, how to pull it safely, and how to prove a restore works.
Instant 503 or 403: check above the app first
An error page that arrives with no latency was served before your application ran, so the checklist starts at the edge and works down to the code last.
How sites actually get compromised, and how not to be the easy one.
In security the customer's assumed cause is usually 'nothing is wrong.' Here's how sites actually get compromised, why the top of that list is preventable, and how we prove a door is shut before we call it closed.
A switch can die and your storage keeps serving
What multipath over two independent Fibre Channel fabrics buys you, why RAID inside one server protects far less than it sounds, and why maintenance on one fabric is a non-event for the workload.
Your host should open the ticket first.
On our desk, many tickets are opened by us, off monitoring and security detection, before the customer files anything. Here are the four moves of a forward-deployed team, and the boundary that makes fully managed a described model instead of an adjective.
Two circuits, one router: dual-cloud DMVPN that uses both links
Build a second DMVPN cloud with tunnel keys, run BGP multipath across both WAN circuits, and size encrypted capacity from the crypto engine, not the licence.
Why we standardized on all-flash HPE 3PAR
One array family, chosen and mastered, beats a vendor menu of storage tiers. The standardization argument for storage, with the architecture, on the public record, as the receipt.
Searching decades of email: keywords first, meaning second
AI search over email fails on dirty data. How to clean, thread and index a mail archive so keyword and semantic search work together, with sources.
Maintenance windows: what gets done under load instead
Most planned work on redundant infrastructure happens while it serves; the changes that need a window are designed, bounded and agreed with you first.
State table arithmetic: sizing a firewall for floods, not averages
Why a stateful firewall runs out of state before bandwidth, how to size the table and timeouts, when to go stateless for UDP, and how HA pairs keep sessions.
ERR_TOO_MANY_REDIRECTS behind a CDN: the two settings that loop together.
The redirect loop that leaves nothing in the access log: a CDN SSL mode that fetches the origin over HTTP, and an origin redirect that is not proxy-aware. Reproduce it with one request and fix both ends.
How to test a restore, not just a backup
A green backup job proves the job ran. A restore test proves you can recover: coverage checks, three levels of restore, an isolated lab, timing.
Rate limit the expensive path, not the crawler
Find the URLs that cost your site real work, then rate limit crawlers there with HAProxy stick tables and a 429, without hurting search or visitors.
Why a compromised root account means rebuilding the server, not cleaning it.
On Unix, root is a number, not a name. A UID-0 account with no creation log wasn't made with any tool, it was written into the user file by hand. How to find it, why a single passing check is not proof, and why root for any window means rebuild, not scrub.
Our price doesn't change when your traffic does.
Egress per gigabyte, support by tier, burst priced only after it happens. Here is what your bill reads like once you own the machine underneath it.
Don't stop at the first fault.
The failure mode this post kills: your site collapses, someone finds a plausible fault, fixes it, declares victory, and the site stays down. On the worst days there are four more faults behind the first. Here is the untangling method, one rule at a time, with the tell that exposes each kind of fault.
Every ticket integration delivers twice. Build it for that.
Webhooks retry, partners resend, networks drop replies. How to build a ticket bridge that is signed, idempotent, loop free and scoped, with code you can reuse.
Most read
The guides readers come back to- 01Top 10 Reasons Your Site Loads Slowly (And How to Fix Them)
- 02Important Linux Log Files You Must Be Monitoring on RHEL 9 and 10
- 03Configuring WordPress Multisite with Nginx and PHP-FPM on RHEL 9 and 10
- 04Archimedes and the compound pulley: how one man moved a ship
- 05Ultimate Guide to Understanding HTTP Status Codes: 300 Series
- 06Ultimate Guide to Understanding HTTP Status Codes: 400 Series
- 07How much RAM, CPU, Storage, and IOPS resources does your VPS really need?
Put the reading to work
Have a workload in mind?
Start with the numbers.
The sizing desks turn your requirements into a proposed configuration and an indicative price range. An engineer can help you review what fits.
