2026-08-15• 3 min read
GeneralRelocating to Munich on Germany's Opportunity Card
Relocating to Munich on Germany's Opportunity Card: the bureaucracy, the programs that helped, and what's next.
Personal Munich Chancenkarte+2
Thoughts, tutorials, and insights from the trenches.
Relocating to Munich on Germany's Opportunity Card: the bureaucracy, the programs that helped, and what's next.
There is no single 'best' VPS provider. But there is a short list of questions that narrows down the options extremely fast, and almost none of them are on the specs page.
Nextcloud's default install technically works. But a handful of specific settings around cron, caching, and upload limits separate 'it runs' from 'it runs well enough that people actually use it.'
ModSecurity paired with the OWASP Core Rule Set knows absolutely nothing about the specific application running behind it. That is exactly why it is so useful. It brutally catches the generic exploit attempts that hit every single server, regardless of what is actually running.
Redis usually gets introduced as 'just a cache.' A year later it is holding session data, rate-limit counters, and critical queues. The instance never changed, but its job did. Its configuration absolutely must change with it.
Adding a TOTP code on top of key-only SSH sounds like great defense in depth. But before you break your automation, let's be honest about what it actually protects against.
Galera's pitch of synchronous multi-master replication where every node has the exact same data is genuinely true. It just comes with a handful of operational realities that aren't obvious from the pitch, and that I learned the slow, painful way.
An ELK stack is massive overkill for one server, but 'grep through /var/log and hope' isn't a strategy either. There is a useful middle ground.
Prometheus and Grafana sound like enterprise tools for a dedicated ops team. But the setup for a single VPS is small enough to be worth it, and it scales perfectly when a second server shows up.
Let's Encrypt's 90-day certificates are designed to force automation. But I constantly find servers where the renewal cron job runs, but nobody told the web server to reload the new certificate.