thesabear/public
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

README: fix vague section heading

Browse Source 
"The Decision That Shows The Most" never stated what it was claiming.
Renamed to state the actual decision directly.
This commit is contained in:
thesabear committed 2026-08-24 14:29:30 +03:00
1 parent c48e8c6cbb
commit 454437fa4e
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -33,7 +33,7 @@ What started as a hobby project has grown into a full-on journey into DevOps, au
This repo is a sanitized showcase of the systems behind that platform — the actual engineering decisions and tradeoffs, not just a list of installed apps. Every real IP, hostname, and internal domain has been stripped or genericized throughout. This repo is a sanitized showcase of the systems behind that platform — the actual engineering decisions and tradeoffs, not just a list of installed apps. Every real IP, hostname, and internal domain has been stripped or genericized throughout.
## The Decision That Shows The Most ## Why Four Trust Boundaries, Not One
Most self-hosted setups have one trust boundary: "you're on the LAN, you're trusted." That's the easy answer, and it's wrong — a single compromised container can reach everything else with no further resistance. The other easy answer, mutual TLS on every single connection with no exceptions, is also wrong: real overhead, real certificate-lifecycle burden, on traffic that doesn't need it — exactly the kind of complexity that gets quietly disabled under pressure, which is worse than never building it. Most self-hosted setups have one trust boundary: "you're on the LAN, you're trusted." That's the easy answer, and it's wrong — a single compromised container can reach everything else with no further resistance. The other easy answer, mutual TLS on every single connection with no exceptions, is also wrong: real overhead, real certificate-lifecycle burden, on traffic that doesn't need it — exactly the kind of complexity that gets quietly disabled under pressure, which is worse than never building it.