Journal · page 2
Writing
Field notes on full-stack engineering, DevSecOps, self-hosted AI and real-time browser graphics. Written from the work, not about it.
21 entries7 categoriespage 2 of 3
Trivy and Snyk Gates in GitLab CI: What Should Block?
A Trivy and Snyk security gate in a GitLab CI pipeline earns its place by blocking the right merge: fixable critical and high findings stop, the rest report, and every ignore expires.
Qdrant and BGE-M3: Hybrid Search Without a Second Model
BGE-M3 produces dense and sparse vectors from one pass, so Qdrant can run hybrid search for production RAG without a second embedding model: prefetch both, fuse with RRF, filter early.
The Payload Migrate Hang: a Flag That Did Nothing
payload migrate hangs in CI when a dev-mode marker row waits on a y/N prompt no runner can answer. The documented flag does not reach that command. Deleting one row does.
face-api.js Privacy: Verify It in the Network Tab
A privacy claim worth trusting is one you can check. The Network tab on a live face-api.js app shows the model weights load once, then zero requests while the camera runs.
AWS to Self-Hosted Migration Cost Starts With Paperwork
An AWS to self-hosted migration for sensitive data moves stateless services first and databases last, after procurement and KYC. The real cost is the operations you take back in house.
Web MIDI Permission, statechange and the Stuck Note
A Web MIDI app has three states to track: permission, device and connection. When an input disconnects, release every note it started, or the note sticks after the device returns.
Self-Hosting Next.js and Payload on One VPS: What Broke
How one VPS runs Next.js and Payload behind Cloudflare and nginx: the request path, why the build needs a self-hosted runner, migrations on deploy, scheduled publishing, and what is not covered.
AGENTS.md vs CLAUDE.md: Read by Five Tools, Enforced by None
A shared AGENTS.md file gets five AI coding tools reading the same rules. It does not make them follow the rules: that still needs review guidelines and a CI gate that actually checks.
Green Deploy, Stale Page: Docker's Layer Cache, Not Next.js
A Next.js deploy passed build, migrate, health check and smoke test, yet the live site kept serving the old content. The cause was Docker's layer cache.