#Bash

One rotation reaches seven services, and a value elsewhere can look exactly like one of their credentials, so search-and-replace could break an integration nobody watches. Working from an explicit list keeps the rotation inside its blast radius and away from the keys that only decrypt.

Three environments sharing one fixed domain name, separated at the socket rather than by name, with a banner on every environment except production — and live proxy config rendered from a template, never linked into a repository where a branch switch could rewrite it.

Point one environment's volumes at another's data and the restore succeeds, every health check passes, and the database is empty. Separating networks, state and runtime identity is what keeps three environments on one host from quietly erasing each other.

A Business Continuity Plan stated as two numbers — an RPO of six hours and an RTO of seconds for the data — and the few small scripts behind them: full and incremental backups, one technique per data store, restore as the only test that counts, and config treated as data.

Build output, not my own code, was filling the disk: five projects shrank from 21 GB to 749 MB once the rebuildable folders were gone. I automated that cleanup instead of buying a bigger SSD, without trusting folder names or confirming hundreds of folders by hand.