[email protected]:~$ cd ~/grimoire && cat README.md

The Programmer's Grimoire

Read it through. Open it mid-incident.

Most technical writing picks a side. A tutorial walks you through a subject and then leaves you stranded the first time production does something it never mentioned. A reference manual answers the question you already knew how to ask and teaches you nothing. The Programmer's Grimoire refuses the choice.

Each volume is two things at once. Read it front to back and it carries you from knowing nothing to building, hardening, and operating a system for real. Open it to a single page during an incident and that page stands on its own. Every claim is cited to primary sources, and where those sources disagree the guide shows you the disagreement instead of papering over it.

Volumes

~/grimoire$ ls volumes/ 5 volumes
The Programmer’s Grimoire, AppArmor volume cover

Profiling, Confining & Hardening with AppArmor

From zero to profile author: read the kernel’s denials, write a profile that confines a real service, satisfy an Ubuntu STIG audit, and run it all on the platform you actually deploy.

▸ in scope
the AppArmor architecture and path-based model, the profile language, generating and refining profiles, denial troubleshooting, the full mediation surface (file, capability, execution, network, DBus, Unix sockets, signals, ptrace, mount, mqueue, io_uring, user namespaces, and stacking), confining real services and containers, the Ubuntu standards crosswalk, the legacy and upgrade story, and a full end-to-end capstone build.
read online → PDF 5.1 MBEPUB 788 KBAZW3 867 KB
The Programmer’s Grimoire, Assembly volume cover

Writing, Hardening & Optimizing Assembly

From how the hardware actually talks to hand-tuned, hardened machine code on Linux: a ground-up path through x86-64 and AArch64 that also stays on the shelf as the reference you open mid-disassembly.

read online → PDF 5.1 MBEPUB 782 KBAZW3 857 KB
The Programmer’s Grimoire, Linux volume cover

Operating, Hardening & Recovering Linux

From your first shell to a hardened, audited host you can recover: learn each concept once, then see how Debian, the Red Hat family, and Arch implement it, and why. A front-to-back path that stays a field reference.

▸ in scope
the core every Linux administrator owns regardless of workload, taught comparatively where the families diverge and once where they do not: boot and init, the shell and filesystem, packages and patching, users and authentication, storage, systemd services, networking and the host firewall, logging and auditing, resource control, backup and recovery, containers as services, automation, hardening to a named standard with a cross-family crosswalk, and inheriting, migrating, and upgrading legacy and end-of-life systems. A full capstone builds one hardened host on two families in parallel.
read online → PDF 5.2 MBEPUB 806 KBAZW3 888 KB
The Programmer’s Grimoire, PHP volume cover

Creating, Hardening & Scaling PHP

From the first line of code to a fleet of hardened, autoscaled application servers: learn the language from zero, write it to the standards the ecosystem agreed on, secure it against the OWASP Top Ten, and run it under PHP-FPM, containers, and a load balancer that you understand end to end.

▸ in scope
the language from no prior knowledge, modern object-oriented PHP, the PSR and PER standards and the tools that enforce them, a transactional database and persistence layer, an OWASP-mapped threat model, safe input and output handling and cryptography, a fully explained hardened php.ini, Laravel and Symfony in depth, building HTTP APIs, PHP-FPM with per-site pools, nginx and Apache, Podman and Docker containerization, horizontal scaling, background processing, long-running and asynchronous runtimes, performance and observability, continuous integration and zero-downtime deployment, upgrading and maintaining legacy and end-of-life runtimes, a standards crosswalk, and an end-to-end capstone build.
read online → PDF 5.6 MBEPUB 877 KBAZW3 1001 KB
The Programmer’s Grimoire, SELinux volume cover

Enforcing, Confining & Hardening with SELinux

From zero to policy author: understand the kernel decision engine, confine real services, satisfy a STIG audit, and run it all on the target system you actually deploy.

▸ in scope
SELinux architecture, policy, operations, troubleshooting, module writing, service confinement (httpd, sshd, named, Podman containers), compliance mapping, and a full end-to-end capstone build.
read online → PDF 5.2 MBEPUB 790 KBAZW3 874 KB