Backend & Infrastructure on Intent https://intent.me/en-us/blog/categories/backend-infra/ Recent content in Backend & Infrastructure on Intent Hugo -- 0.155.1 en-us Tue, 25 Aug 2026 12:00:00 +0800 Windows Docker Ghost Port Mapping: EMQX 1883 Silently Reserved by WinNAT Postmortem https://intent.me/en-us/blog/tech/docker-windows-port-ghost-mapping-postmortem/ Tue, 25 Aug 2026 12:00:00 +0800 https://intent.me/en-us/blog/tech/docker-windows-port-ghost-mapping-postmortem/ Docker Desktop on Windows with a full stack (backend + EMQX 5.8.9 + TimescaleDB + Valkey). Backend ping/pong works, but mosquitto_pub keeps returning Connection refused. Other ports in docker ps map fine; only 1883 lacks the 0.0.0.0:1883-&gt; prefix and Docker reports no error. Root cause: Hyper-V/WinNAT dynamic port reservation holds 1883 (in the 1802–1901 range). Four remediation options: swap port, temporary reclaim, admin allowlist, fix the dynamic port range. Rootless Container Inbound Source IP Preservation: Hybrid Host-Bridge Topology and Tradeoff Analysis https://intent.me/en-us/blog/tech/rootless-container-source-ip-preservation/ Sat, 11 Jul 2026 20:00:00 +0800 https://intent.me/en-us/blog/tech/rootless-container-source-ip-preservation/ Architecture analysis and implementation of inbound source IP preservation under Rootless Podman. Uses a Hybrid Host-Bridge topology to retain real client IPs at edge services while preserving network isolation for internal services, with tradeoff analysis, implementation details, and verification methodology. Troubleshooting H.265 HTTP-FLV Browser Streaming on an IIoT Platform https://intent.me/en-us/blog/tech/h265-http-flv-browser-stream-debugging/ Sun, 28 Jun 2026 21:30:00 +0800 https://intent.me/en-us/blog/tech/h265-http-flv-browser-stream-debugging/ This post documents an H.265 HTTP-FLV browser streaming issue on an IIoT platform, from playback URL validation and desktop player compatibility checks to local FLV baseline verification and correlating <code>fetchError</code>, <code>WinError 10053</code>, and a frontend <code>TypeError</code> into a reusable debugging SOP. IIoT Ingress Postmortem: Troubleshooting EMQX 5.8 Under Podman Rootless https://intent.me/en-us/blog/tech/iiot-emqx-rootless-deployment-postmortem/ Thu, 28 May 2026 18:59:25 +0800 https://intent.me/en-us/blog/tech/iiot-emqx-rootless-deployment-postmortem/ A postmortem of an IIoT ingress deployment failure: under Podman Rootless, EMQX 5.8 exposed unstable Erlang IPC, HOCON schema validation failures, a blocked security-group port, and M2M requests rejected by CSRF middleware. This post covers the confirmed causes, fixes, and validation path. Rootless Podman + Systemd Supervision Failure Postmortem: Diagnosing and Repairing a Broken Recovery Path https://intent.me/en-us/blog/tech/rootless-podman-systemd-watchdog-postmortem/ Fri, 03 Apr 2026 20:00:00 +0800 https://intent.me/en-us/blog/tech/rootless-podman-systemd-watchdog-postmortem/ A postmortem on a failed recovery path under Rootless Podman + Systemd user units, covering confirmed contributing factors, concrete remediation work, validation steps, and remaining risks. JWT Dual-Token Hardening Postmortem: From Stateless Refresh to Revocable Redis Sessions https://intent.me/en-us/blog/tech/jwt-at-rt-redis-hardening-postmortem/ Mon, 23 Mar 2026 10:00:00 +0800 https://intent.me/en-us/blog/tech/jwt-at-rt-redis-hardening-postmortem/ A security hardening postmortem for JWT AT/RT architecture: treating Redis reservation as completed and implementing RT rotation, replay detection, and revocable sessions. HTTPS Upgrade Triggered 403: A Deep Postmortem from Security Middleware to Container Isolation https://intent.me/en-us/blog/tech/https-upgrade-403-postmortem/ Tue, 17 Mar 2026 12:00:00 +0800 https://intent.me/en-us/blog/tech/https-upgrade-403-postmortem/ A postmortem on a persistent 403 after HTTPS migration, traced to both missing CSRF allowlist updates and Podman Rootless image namespace isolation.