A Deploy Script Was Silently Rolling Back Our Let's Encrypt Renewals
An unconditional S3 snapshot restore on every deploy rolled back Let's Encrypt renewals until an expired certificate wedged CertMagic at boot.
Development#caddy#lets-encrypt#devops
Seven ways to host a GitLab CI runner in 2026, priced and compared
A comparison of home hardware, GitLab.com, AWS, ARM64 cloud, local AMD hardware, and Hetzner for a monorepo running 2,000 CI jobs a month.
Development#gitlab#ci-cd#runnersAWS auth in a Gondolin VM: why SigV4 breaks the secrets bridge
The Gondolin bridge substitutes placeholders in request headers, but the AWS SDK signs the request over the placeholder value. The substitution happens too late and every call returns SignatureDoesNotMatch. The fix is to mount the host's ~/.aws/ read-only instead.
Development#gondolin#aws#sigv4Immutable release bundles and SSM deploys on EC2 without a container orchestrator
Running a production backend on EC2 without Kubernetes: the immutable-release and coherent-backup model I put in to make deploys reversible and restores internally consistent.
Development#aws#ec2#ssmA Cognito token-pair contract: API Gateway authorizer, Spring, Hono, and PowerSync
How one Cognito user pool serves four client surfaces through a shared token-pair contract, a REQUEST Lambda authorizer, and defense-in-depth re-validation that isolates a new mobile client without duplicating identity.
Development#aws#cognito#security