Designing an API gateway on a laptop
An allowlist and a token check in front of an API, built in Caddy on a laptop, and the problems that turned up long before production.
Articles
Everything published here, newest first.
2026
Which env wins depends on the app
Three apps in one stack and three different answers to where a config value really comes from, so the same env setup doesn't behave the same way twice.
Real HTTPS on *.localhost, and the Firefox catch
Cookies and Origin checks only behave like production if the hostnames do, so every local site gets real HTTPS from a local CA, except Firefox has its own idea about which CAs to trust.
Running a whole platform on a laptop from one binary
There was no way to run the whole platform locally, so I wrote a small Go CLI that renders plain docker compose projects from a service catalog, and most of what I learned had nothing to do with compose.
hidutil said it worked, the key disagreed
A key swap on the Magic Keyboard read back as applied and still did nothing when launchd ran it, and the fix was a permission I'd given to the wrong binary.
Wi-Fi off while the dock has a network
A small script and a LaunchAgent turn Wi-Fi off while the CalDigit TS5 has a working network, and back on when it doesn't.
Moving this site from Hugo to Astro with AI
The site had been stuck on an old Hugo for years. Splitting the move into eleven tasks and giving each one to an agent got it done in an afternoon.
Renaming a k3s node is not a cosmetic change
I renamed four nodes because the old domain annoyed me. The cluster stayed green for weeks while sitting one reboot away from losing every worker.
Overriding one name in a public domain without breaking the domain
A single internal zone for the domain makes the resolver authoritative for all of it, so mail and the public site start returning NXDOMAIN to everyone in the house.
A name should say what something is, not where it runs
I counted seven naming shapes on my own network for the same kind of thing, and one of the suffixes meant two different backends depending on which name you picked.
My Pi-hole had not been blocking ads for most of the network
An adlist with no group assignment applies to no client. Mine had 93,516 domains in it and had been doing nothing for as long as it had been there.
dnsmasq answers on the interface, not on the address
The gateway pings from inside the container and its DNS never answers. I got the diagnosis wrong twice, and the second time it was my own test that was lying.
A UniFi firmware update wipes everything except /data
My container had been dead since the last flash, because the flash took /usr and /var with it. The boot hook that puts it back cannot download anything.
Technitium DNS in a container on a UDM Pro Max
The UDM runs Debian and systemd, so it can run an nspawn container. What it cannot do is let that container talk to the router it is attached to.
Typed resources for every AWX credential type
A generic credential resource works, and it puts the whole burden of knowing what goes inside on whoever writes the terraform.
An empty AWX instance describes an incomplete API
AWX hides POST on endpoints you have nothing to create against, so an empty instance hands back a schema that looks fine and is missing half its fields.
Kubernetes registry credentials that expire on their own
A GitLab deploy token in an imagePullSecret is a long-lived credential sitting in a namespace, and it does not have to be.
What a GitLab token can be depends on which GitLab you ask
Access levels arrive in GitLab releases, so validating them without knowing the version gets you a plausible error at the wrong time.
Generics and hooks in a generated terraform provider
Every AWX quirk used to mean another branch in a template. Now it's a field on a config struct.
AWX returns $encrypted$ and terraform stops trusting you
The most reported bug in the AWX provider was never really a bug in the provider.