Orienteering

Step-by-step how-tos. Pick up the map and follow along.

A backup is only real once you have tested the restore. A self-hosting backup guide that deliberately refuses to bless a single tool.

Setting up an AWS billing alarm before you need one, with a KMS gotcha in the middle that stops the alert ever reaching you.

Choosing a CLI library in Go and Rust. Go is a ladder you climb from the standard library; Rust asks a different question much earlier.

Rotate a release signing key and recover from a bad one without locking users out. Why asymmetric KMS keys have no auto-rotate button.

Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.

Embed the trust anchor in your binary and require signature verification on update, without bricking anyone already running an old build.

Mint an OpenPGP public key from a KMS-held private key you cannot hold, and publish it somewhere the release platform cannot reach.

Let CI sign with a KMS key without storing any AWS credentials, using OIDC federation. Covers both the GitLab and the GitHub path.

Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.

The laptop-only quick start: make a signing key, mint the public key you publish, sign a file, and verify it with both gtb and plain gpg.