Journal
Writing
Field notes on full-stack engineering, DevSecOps, self-hosted AI and real-time browser graphics. Written from the work, not about it.
22 entries7 categoriespage 1 of 3
PHP2Shell in Docker: Two PHP Runtimes Nobody Listed
PHP2Shell is fixed in the PHP runtime, so a Docker image needs a newer PHP such as 8.3.36, not an app update. I found PHP inside mailcow and an LMS on my host, and patched both.
Prometheus, Grafana and Loki: What to Alert On First
What a small team should alert on first with Prometheus, Grafana and Loki: page-or-ticket alerts and a heartbeat, timed in a lab where one log alert failed silently.
Linux Kernel CVE Patching: Installed Is Not Patched
Linux kernel CVE patching splits at the hypervisor. A VPS provider patches the host kernel, sometimes with a restart; you patch and reboot every kernel you run yourself, as CVE-2026-99999 showed.
Fine-Tuning vs RAG for a Self-Hosted LLM: Facts or Behaviour
Retrieve for facts, fine-tune for behaviour. In a Qwen3 demo, retrieval took a changed fact in 0.014 s while LoRA missed 3 of 8 facts, yet LoRA got a JSON contract right 10 of 10.
Postgres Schemas Behind FastAPI: Nine Namespaces, Not Walls
Nine Postgres schemas in one database held 5 connections where nine databases held 45. Map with __table_args__, set Alembic include_schemas, and expect foreign keys to cross schemas.
Vault Secret Rotation Fails in the Application, Not Vault
HashiCorp Vault secret rotation causes application downtime when a worker reads its credential once. Static roles do not overlap, and three fixes have measured costs in a Vault 2.1.2 sandbox.
n8n MCP Agent Workflow in Production: Where the Agent Stops
In an n8n MCP agent workflow, the agent drafts and n8n holds publishing. Postiz's schedulePostTool takes a type of draft, schedule or now, so the limit is a parameter n8n must pin.
Web Audio Scheduling Drift: Right in Code, Late in the Room
A Web Audio metronome on setTimeout drifts because the JavaScript timer and the audio clock are two clocks. A lookahead scheduler on currentTime fixes it, measured before and after.
Claude API OCR on Financial-Aid Letters: Check the Math, Not the Reading
LLM OCR on financial-aid letters: a strict schema, deterministic normalising, sums that must reconcile, and flags for people. Reading the page is only the first check.