Technical notes, projects, modules, tools, workflows, and architecture on electronics, software engineering, and DevOps.
PoE32 Lite v3 is a small RISC-V board that takes its data and its power from one Ethernet cable, now with the whole PoE power path on the board. It failed out of the box: why, how it runs with jumper wires, and where v4 goes.
The Vue browser application of a document-signing platform: sessions held in memory and renewed by one queued refresh, PKCE sign-in, stamps placed precisely on PDF pages, identity checks with a face challenge, client consent, and role-based administration.
The Laravel core of a document-signing platform: it owns users, identities, organisations, client systems, documents and their signed versions, stamps, and certificates, and orchestrates the services that sign, timestamp, render, and store — without ever holding a file.
How I run Laravel as the core of a team-built platform: nodes that hold no state, slow work handed to queued jobs and specialised services, files kept off the server, one internal token for every login, and every request, job, and call observable.
A tiny publish-only service that keeps a root CA reachable without making it touchable: it serves the root certificate and its revocation list, while the root key and every signature stay on an offline host — reusable by any project with its own CA.
A Python service that asks a person on camera to face forward, turn right, and turn left, captures one sharp frame per pose, and keeps the three as private evidence for a human reviewer — proving a live person was present, not who they are.
A Python service that signs PDFs to PAdES B-LTA with a visible stamp — embedding the timestamp, certificates, and revocation proof, then an archive timestamp — so signatures stay verifiable long after their certificates expire, and verifies signed PDFs.
Each endpoint is one procedure that carries a request from start to finish, with its concerns in modules beside it — Fowler's Transaction Script as I shape small one-job Python services, bundled into one binary, until their rules outgrow it.
A stateless Rust service that renders the first page of a PDF into a sharp, uniformly sized WebP thumbnail, reading the PDF and writing the image through two presigned links, so no application streams files or holds storage credentials.
A Rust timestamp authority that stamps a document's hash with a signed, NTP-backed time per RFC 3161, so PDF signatures stay verifiable after their certificates expire — issuing and renewing its own signing certificate, with public OCSP and CRL.
Get an email when a new article is published.