Seven ways to host a GitLab CI runner in 2026, priced and compared
A comparison of home hardware, GitLab.com, AWS, ARM64 cloud, local AMD hardware, and Hetzner for a monorepo running 2,000 CI jobs a month.
Development#gitlab#ci-cd#runners
AWS auth in a Gondolin VM: why SigV4 breaks the secrets bridge
The Gondolin bridge substitutes placeholders in request headers, but the AWS SDK signs the request over the placeholder value. The substitution happens too late and every call returns SignatureDoesNotMatch. The fix is to mount the host's ~/.aws/ read-only instead.
Development#gondolin#aws#sigv4Immutable release bundles and SSM deploys on EC2 without a container orchestrator
Running a production backend on EC2 without Kubernetes: the immutable-release and coherent-backup model I put in to make deploys reversible and restores internally consistent.
Development#aws#ec2#ssmA Cognito token-pair contract: API Gateway authorizer, Spring, Hono, and PowerSync
How one Cognito user pool serves four client surfaces through a shared token-pair contract, a REQUEST Lambda authorizer, and defense-in-depth re-validation that isolates a new mobile client without duplicating identity.
Development#aws#cognito#security