Articles in this category. Show all categories
The procedure that gives a new project its whole infrastructure from generators, in the order the stacks depend on each other: log first, then storage and broker, then the gateway, then the application — with the public steps kept manual.
Templates come from real stacks, and copies quietly carry their data, keys, open databases and root-owned paths. My database, object storage and application generators leave the old data, keys and access behind, and read each application's facts from the application itself.
Every project gets its own OpenTelemetry Collector, Elasticsearch and Kibana from one command, showing data on dashboards from the first start, by owning the data directory, starting services in the order they need, and keeping the official mappings on one node.
Opening a broker to browsers and devices on the internet is less about encryption than identity. Each entrance now accepts one kind of credential, every token is bound to its own name and addressed to this broker, and TLS ends in nginx.
Every new project needs a gateway, sign-in, and a first administrator before its backend exists. One generator command now builds that stack, working on first boot, by handling the values that fail silently when set by hand and a rerun that would keep the old database.
The digital signature platform of the City Government of South Tangerang: signers prove who they are, sign PDFs to PAdES B-LTA with certificates from the platform's own authorities, and anyone can verify the result — version 2, which I designed, built and operate.
Release Workflow: Development to Production is the procedure every change of mine follows from my laptop to production — which steps I automated, which I deliberately left to a person, why each step sits where it does, how I diagnose a failed release, and how I recover from it.
A small Rust service between applications and S3-compatible storage: it hands out presigned links so browsers talk to storage directly, gives each file a lifecycle, copies between buckets on the server, and keeps storage credentials out of every application.
A single Python script that proves S3-compatible storage is ready before an application depends on it, by using every bucket the way a real client does and catching the failures that return HTTP 200.
SMTP and IMAP credentials fail late and far from their cause: a reset email that never arrives. A small check proves both directions first, with a tokenised test message, a read-only inbox check, and broken config kept distinct from a broken server.
Get an email when a new article is published.