#automation

A project copied from a template still carries the old name in its config, namespace, table prefix and comments. Replacing it everywhere takes one three-line command, and its value lies in the six decisions inside that line.

What did I work on last month? The answer is in the commit log, but commits are written for git and my future self. Forty-five lines of flags turn that log into notes for the person asking — a transformation of the audience, not of the data.

Commands I run four times a year are the expensive case: I remember their shape, not their syntax, and get something plausible but wrong. Three scripts hold the decisions, and their guards depend on whether there is a choice I could get wrong, not on danger.

Free converters stamp a watermark on web assets by design. Four small ffmpeg wrappers do the job locally, and the watermark was the least of it: the real work was choosing the quality, preset and GIF palette flags ffmpeg lets you get wrong.

Photos into one PDF, a PDF under two megabytes, a layout inspected page by page — usually done by uploading to a stranger's website. Three small tools do it locally with Pillow and Ghostscript; the only real decisions were which defaults to bake in.

cp -r drops owner, permissions and timestamps, producing copies that look right and fail in use. A 58-line rsync wrapper makes the destination truly equal to the source — and most of its lines are refusals, because making it equal means agreeing to delete.

Retyping long Docker commands costs seconds, invites typos and taxes working memory. Ten short executables on PATH removed that cost; the interesting decisions were why not aliases, how to keep names guessable, and why one of them is 260 lines long.

Staging and production shared 136 keys, but 21 had to stay different, including the one that decrypts years of data. Promoting a release's structure, not a file's contents, keeps that key in place and stops a schema migration from silently never running.

One rotation reaches seven services, and a value elsewhere can look exactly like one of their credentials, so search-and-replace could break an integration nobody watches. Working from an explicit list keeps the rotation inside its blast radius and away from the keys that only decrypt.

Point one environment's volumes at another's data and the restore succeeds, every health check passes, and the database is empty. Separating networks, state and runtime identity is what keeps three environments on one host from quietly erasing each other.

A Business Continuity Plan stated as two numbers — an RPO of six hours and an RTO of seconds for the data — and the few small scripts behind them: full and incremental backups, one technique per data store, restore as the only test that counts, and config treated as data.

Build output, not my own code, was filling the disk: five projects shrank from 21 GB to 749 MB once the rebuildable folders were gone. I automated that cleanup instead of buying a bigger SSD, without trusting folder names or confirming hundreds of folders by hand.