What actually happened.
Decisions, trade-offs, and the occasional postmortem — filed close to when they happened, not smoothed over after the fact.
A Backup Gap We Haven't Closed Yet
Production data currently has no verified off-node restore path. This is a tracked, open risk, not a resolved incident: here's the honest risk model.
Back to Deploying Everything, Every Run
A path-detection optimization that only redeployed what changed produced silent false negatives on fresh checkouts. We reverted to deploying everything, every run.
Six Layers of Reachability
A mental model for network reachability on a segmented personal platform: six independent questions that must all resolve yes before a request reaches anything.
Disaster Recovery Before Real Backups
Runbooks vs. guides, a general failure-triage flow, and why documentation-as-source-of-truth is a compensating control, not a backup substitute.
Client Isolation Tiers
What changes when a mostly-personal platform starts hosting a workload for an external party, and why onboarding and offboarding are mirrors of each other.
Alert Fatigue by Design
Using inhibition rules so a critical alert silences its own warning-level echo instead of paging on-call twice for one root cause.
Disaster Recovery Before Real Backups
Runbooks vs. guides, a general failure-triage flow, and why documentation-as-source-of-truth is a compensating control, not a backup substitute.
Client Isolation Tiers
What changes when a mostly-personal platform starts hosting a workload for an external party, and why onboarding and offboarding are mirrors of each other.
Alert Fatigue by Design
Using inhibition rules so a critical alert silences its own warning-level echo instead of paging on-call twice for one root cause.
Treating Your Repo as if It Will Leak
A classification discipline for turning private operational notes into public writing without turning them into a target map.
Static-First for a Site That Never Needs to Be Fresh
Why this site builds to plain files instead of running a server, and the honest cases where that trade-off would flip.
Zone Transfers Instead of Manual DNS
One authoritative DNS source of truth, replicated to secondaries by authenticated zone transfer, instead of hand-syncing records across servers.
Hand-Rolled Lightbox
Why the image viewer on this site is built directly on the Pointer Events API instead of pulling in a lightbox library, and when that call is the wrong one.
Two Deploy Paths, Two Artifacts
A static site gets rsync'd straight to where it's served. A containerized app goes through build, push, pull. Keeping those pipelines different was the deliberate choice.
Default Deny, Real Cost
Every VLAN here denies inter-segment traffic by default. That buys real safety, but it is not free: an honest look at the friction it actually costs.