// writing
Writing
15 posts, grouped by what they're about. Most start from something that broke.
AI & retrieval
Building RAG systems: where the vectors live, how tenants stay isolated, and getting real content in.
Designing Multi-Tenant Vector Storage on Cloudflare Vectorize: Per-Org Indexes vs. Shared Namespaces
Mar 2026A look at two architectural approaches to tenant isolation in Cloudflare Vectorize, from a hobby RAG project that had to change course mid-build.
Building RAG with Turso: From Native Vector Search to a Split Architecture
Nov 2025How I explored Turso's built-in vector search for a RAG hobby project, where it fell short for multi-tenant use, and the split architecture I landed on.
Building a Web Crawler on Cloudflare Workers with Puppeteer: Lessons from the Edge
Sep 2025How I built a JavaScript-aware web crawler for a hobby RAG project using Cloudflare's Browser Rendering service, and the performance lessons that reshaped it.
Backend & systems
Elixir, Go, concurrency, storage, and the things that break under load.
JS-in-WASM vs. Compiled Go: What We Learned Running User Code at Scale
Jan 2026We benchmarked two WebAssembly execution strategies SpiderMonkey JS interpreted inside WASM versus code compiled directly with TinyGo inside our Elixir/Rust platform. The results were not subtle.
Prisma Doesn't Support JSON Columns in Cloudflare D1
Jul 2025A short heads-up: if you're using Prisma with Cloudflare D1 and your schema has JSON or JSONB columns, Prisma will silently skip them.
Two CORS Gotchas in Gin That Wasted My Afternoon
May 2025Gin's trailing slash redirect silently bypasses CORS middleware, and assigning AllowHeaders wipes default headers. Here is what happened and how to fix both.
Service-to-Service Auth with Zitadel: Machine Users and JWT Client Assertions
Jan 2025How to authenticate a backend service against Zitadel without a human user, using RSA key pairs and the client_credentials grant with a JWT assertion.
Building an In-Memory TTL Store in Go (Inspired by Elixir's ETS)
Nov 2024Coming from Elixir, I missed ETS. Here's how I built a thread-safe in-memory key-value store with TTL, hooks, and a cleanup goroutine in Go.
Infrastructure & auth
Kubernetes, TLS, DNS, identity, and the long tail of making deployments behave.
Firebase Auth Internals: Tokens, Sessions, and Forced Logout
Mar 2025What actually happens inside Firebase Authentication -- how tokens work, how the SDK refreshes them, and how to force-logout a user across all devices.
ArgoCD Behind Traefik: Fixing the HTTPS Redirect Loop
Sep 2024Running ArgoCD behind a Traefik ingress with TLS termination causes an infinite redirect loop. Here is why it happens and the one-line fix.
Custom Local Domains on macOS: Why /etc/resolver Files Are Not Enough
Jul 2024Setting up a local .test domain during development led me down a rabbit hole involving Apple's scoped DNS implementation. Here is what actually works.
Wildcard TLS on Kubernetes with cert-manager and Cloudflare DNS-01
May 2024HTTP-01 challenges cannot prove ownership of wildcard domains. Here's the full setup for DNS-01 validation using Cloudflare and cert-manager on k3s.
Why I Settled on k3s After Trying minikube and microk8s
Mar 2024A short story of hitting walls with every popular Kubernetes option before finding the one that just works on a bare VPS.
Browser & web
How the platform actually behaves, once you look closely.
Understanding Stacking Contexts
Jul 2025As web developers, we’re familiar with various tree structures in the browser the DOM tree, the layout tree, and the render tree. But did you know there’s another hidden tree that plays a crucial role in how elements are visually layered? It’s called the stacking context tree.
Event listeners
Jul 2025An event listener is a callback function invoked by the browser when certain events occurs in the browser such as a mouse click, keyboard press, or touch gesture.