Technical deep dives, project write-ups, and lessons learned from building systems. I write about infrastructure, backend development, and the engineering process.
Planning and operating production Kubernetes: cluster architecture decisions and declarative GitOps delivery with ArgoCD.
Designing a centralized logging architecture with the ELK stack: what to collect, where it lands, and what it costs to keep.
Patterns I use for CI/CD pipeline design and Terraform at scale.
Five times a green signal meant nothing: a backup that restored an empty file, a failover test that proved the opposite of what it claimed, a runbook that had never once worked, a monitor that said the API was fine through a VIP it never used, and a renewal timer that ran 40 times while the certificate sat expired.
Why I run a homelab, and how the network is segmented.
Grafana's TLS certificate expired on 22 September. The renewal timer fired twice a day for 20 days, every run logged success, and the certificate on disk never changed. The script ended in || exit 0, the timer was too slow for the renewal window, and the watchdog had never heard of the host.
The production Kubernetes API was unreachable through its virtual IP for 9 days 8 hours 43 minutes. The signal named 'API via VIP' stayed green the whole time, because it ran on a control plane and talked to localhost.
An automated restart action passed its guardrail suite for weeks. It had never successfully restarted anything, on any host, because ssh does not preserve argument boundaries.
A nightly Kubernetes backup reported success for weeks. Every restore produced a zero-byte cluster token, because tar archived a symlink instead of following it.
Stopping the API server on the node holding the virtual IP produced a clean pass in zero seconds. The address never moved, which is exactly why the result was worthless.
How to design a Kubernetes cluster that can handle real workloads. Covering node sizing, control plane HA, networking decisions, and capacity planning.
Architecture decisions for building a logging system that can handle millions of events per day while remaining queryable and cost-effective.
Organizing Terraform code for real-world projects. Modules, workspaces, state management, and team collaboration patterns.
Building robust CI/CD pipelines with proper testing stages, security scanning, and deployment strategies.
A nightly Kubernetes backup reported success for weeks. Every restore produced a zero-byte cluster token, because tar archived a symlink instead of following it.
Stopping the API server on the node holding the virtual IP produced a clean pass in zero seconds. The address never moved, which is exactly why the result was worthless.
An automated restart action passed its guardrail suite for weeks. It had never successfully restarted anything, on any host, because ssh does not preserve argument boundaries.
The production Kubernetes API was unreachable through its virtual IP for 9 days 8 hours 43 minutes. The signal named 'API via VIP' stayed green the whole time, because it ran on a control plane and talked to localhost.
Grafana's TLS certificate expired on 22 September. The renewal timer fired twice a day for 20 days, every run logged success, and the certificate on disk never changed. The script ended in || exit 0, the timer was too slow for the renewal window, and the watchdog had never heard of the host.
The case for running your own infrastructure at home. Learning opportunities, cost analysis, and getting started.
Implementing VLANs, firewall rules, and zero-trust principles to secure a home network with multiple trust zones.
Implementing token bucket, sliding window, and distributed rate limiting in Go with Redis backing.
Real-world PostgreSQL optimization: query analysis, index strategies, connection pooling, and configuration tuning.
Every post here is a finished write-up of something I actually ran. New posts go up when the work behind them is done, not before.