Infra

2026-08-29CVE remediation at monorepo scale: a practical playbookA playbook for clearing CRITICAL and HIGH CVEs across a monorepo: severity-plus-reachability triage, per-service fix batching, transitive dependency overrides, a trivy CI gate, and an accepted-risk register with expiry dates.→2026-08-29Shipping a three-environment CI/CD pipeline from zeroBuilding dev, staging, and prod from an empty repo: per-env Terraform state, separate cloud accounts, deployable PR previews, trunk-based promotion, and expand-migrate-contract for database changes.→2026-05-01A $22/Year VPS Running Three Self-Hosted ServicesRunning Obsidian LiveSync, Matrix Synapse, and Calibre-Web on a $22/year VPS — nginx reverse proxy, Docker Compose, Cloudflare tunnels, and what actually fits in 2.9GB RAM.→2026-04-21Three Useful Services on a $22/Year VPSA minimal self-hosting stack on a budget VPS — three useful services (sync, chat, library) running on Docker Compose behind nginx, for under $22 a year.→2026-02-17From Manual Deploys to SHA-Tagged Containers: CI/CD for a K8s PlatformSHA-tagged Docker images replace mutable latest tags, eliminating silent overwrites in CI/CD pipelines. Docker Buildx, multi-arch builds, and dynamic workflow generation for a Kubernetes platform.→2026-02-16Hunting OOMKilled in Kubernetes: Four Memory Leaks That Almost Took Down Our PlatformFour memory leaks inside OOMKilled Kubernetes pods — slow async accumulation in Python services, unclosed client sessions, unbounded caches, and how to track each one down without a profiler.→2026-01-23SSE in FastAPI: The Tab Closed and My “Done” Code Never RanServer-Sent Events in FastAPI silently drop cleanup code when a browser tab closes. How to detect client disconnects and ensure generator cleanup runs reliably.→2025-12-26End-to-End HTTPS with Cloudflare Origin Certificates and NginxEnd-to-end HTTPS with Cloudflare Origin Certificates and Nginx — full-strict SSL mode, origin certificate installation, and Dockerfile configuration to eliminate 521 errors.→