// blog
Writing
Thoughts on Elixir, backend systems, AI, and the craft of software engineering.
Designing Multi-Tenant Vector Storage on Cloudflare Vectorize: Per-Org Indexes vs. Shared Namespaces
A look at two architectural approaches to tenant isolation in Cloudflare Vectorize, from a hobby RAG project that had to change course mid-build.
JS-in-WASM vs. Compiled Go: What We Learned Running User Code at Scale
We benchmarked two WebAssembly execution strategies SpiderMonkey JS interpreted inside WASM versus code compiled directly with TinyGo inside our Elixir/Rust platform. The results were not subtle.
Building RAG with Turso: From Native Vector Search to a Split Architecture
How I explored Turso's built-in vector search for a RAG hobby project, where it fell short for multi-tenant use, and the split architecture I landed on.
Building a Web Crawler on Cloudflare Workers with Puppeteer: Lessons from the Edge
How I built a JavaScript-aware web crawler for a hobby RAG project using Cloudflare's Browser Rendering service, and the performance lessons that reshaped it.
Understanding Stacking Contexts
As web developers, we’re familiar with various tree structures in the browser the DOM tree, the layout tree, and the render tree. But did you know there’s another hidden tree that plays a crucial role in how elements are visually layered? It’s called the stacking context tree.
Event listeners
An event listener is a callback function invoked by the browser when certain events occurs in the browser such as a mouse click, keyboard press, or touch gesture.
Prisma Doesn't Support JSON Columns in Cloudflare D1
A short heads-up: if you're using Prisma with Cloudflare D1 and your schema has JSON or JSONB columns, Prisma will silently skip them.
Two CORS Gotchas in Gin That Wasted My Afternoon
Gin's trailing slash redirect silently bypasses CORS middleware, and assigning AllowHeaders wipes default headers. Here is what happened and how to fix both.
Firebase Auth Internals: Tokens, Sessions, and Forced Logout
What actually happens inside Firebase Authentication -- how tokens work, how the SDK refreshes them, and how to force-logout a user across all devices.
Service-to-Service Auth with Zitadel: Machine Users and JWT Client Assertions
How to authenticate a backend service against Zitadel without a human user, using RSA key pairs and the client_credentials grant with a JWT assertion.
Building an In-Memory TTL Store in Go (Inspired by Elixir's ETS)
Coming from Elixir, I missed ETS. Here's how I built a thread-safe in-memory key-value store with TTL, hooks, and a cleanup goroutine in Go.
ArgoCD Behind Traefik: Fixing the HTTPS Redirect Loop
Running ArgoCD behind a Traefik ingress with TLS termination causes an infinite redirect loop. Here is why it happens and the one-line fix.
Custom Local Domains on macOS: Why /etc/resolver Files Are Not Enough
Setting up a local .test domain during development led me down a rabbit hole involving Apple's scoped DNS implementation. Here is what actually works.
Wildcard TLS on Kubernetes with cert-manager and Cloudflare DNS-01
HTTP-01 challenges cannot prove ownership of wildcard domains. Here's the full setup for DNS-01 validation using Cloudflare and cert-manager on k3s.
Why I Settled on k3s After Trying minikube and microk8s
A short story of hitting walls with every popular Kubernetes option before finding the one that just works on a bare VPS.