Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Security at the Edge: WAF, DDoS Protection, Rate Limiting, Bot Management and Locking Down the Origin
The WAF, DDoS protection, rate limits and bot rules at the edge only see traffic that goes through the edge; if the origin's IP leaks they are all bypassed, so the origin must accept connections only from the CDN. On an Nginx edge we see a login rate limit stop an attack before it reaches the origin, how forwarded header order in the ASP.NET Core rate limiter protects customers, and why an IP allowlist must be completed with Authenticated Origin Pulls, a tunnel or X-Azure-FDID.
Putting Bookstore Behind Cloudflare: Proxying, SSL/TLS Modes, Cache Rules and the Real Client IP
Moving to Cloudflare means moving the nameservers, keeping web records proxied and mail records DNS-only, choosing Full (strict) as the SSL/TLS mode, writing Cache and Redirect Rules instead of Page Rules, and trusting CF-Connecting-IP at the origin only for connections from Cloudflare's IP ranges. In a lab we see the redirect loop Flexible mode produces, tests that reject spoofed headers with KnownIPNetworks in ASP.NET Core, and the Azure Front Door equivalents.
How Does a CDN Work? Edge, Origin, Cache Keys, s-maxage and the Right Cache Strategy for Angular + an API
A CDN stores answers at the edge by cache key and follows the origin's headers, so hashed Angular files get immutable, index.html gets no-cache, the catalog API gets s-maxage and CDN-Cache-Control, and personalised answers get private, no-store. On an Nginx edge we see with real requests how a public header shows Ada's orders to Grace, how a cache key without the query string mixes up pages, and how stale directives keep the site up while the origin is down.
Changing DNS Without Downtime: TTL Strategy, Moving Nameservers, DNSSEC and DNS as Code
DNS doesn't propagate, resolvers cache: to change a record without downtime you lower the TTL at least one old TTL in advance, make the change and keep the old target running until its logs go quiet. In a lab we watch a resolver cache and negative caching second by second, switch providers with DNSSEC on and get SERVFAIL from the stale DS, compare going insecure with a multi-signer move, and manage the zone as code with DNSControl.
DNS for Email: Keeping Bookstore's Mail Out of Spam with MX, SPF, DKIM and DMARC
Passing SPF or DKIM is not enough to keep mail out of spam; DMARC requires the passing domain to align with the From: domain the user sees, and Gmail, Yahoo and Outlook require this of bulk senders. In a lab we set up Bookstore's MX, SPF, DKIM and DMARC records, sign and verify an order mail with real libraries, and see that the 10-lookup limit breaks only for some IPs and why a provider's default DKIM fails DMARC.
Setting Up DNS Records for a Web App: Apex, www, api, CNAME Flattening, CAA and Verification TXT Records
You can't put a CNAME at the apex because a name with a CNAME can have no other records and the apex must have SOA and NS; the fix is your provider's ALIAS, CNAME flattening or Azure DNS alias feature. We build Bookstore's apex, www, api and staging records in BIND, watch ALIAS's TTL behaviour in PowerDNS, and look at App Service and Front Door verification TXT records, how CAA lookup climbs to parent names, and a script that finds dangling CNAMEs, all with real runs.
Buying and Owning a Domain: Registry, Registrar, Nameserver Delegation and Not Losing Your Domain
A registry runs the TLD, a registrar sells the domain and you own it as the registrant; where its DNS lives is decided by the nameservers you enter at the registrar, after which the registrar's own DNS screen has no effect. In a two-container BIND lab we look at referrals, glue records and lame delegation, write a script that tracks expiry via RDAP, and build a checklist of lock, MFA and auto-renew so you don't lose the domain.