Writing
Deep-dives on infrastructure, platform security, and cloud engineering. Written from production work, not from documentation.
Desirable Difficulties
Desirable difficulties is a cognitive psychology idea: making learning harder on purpose slows you down now and makes it stick later. This is the loop I run on to keep growing as a platform engineer, and the one I'm running now to get my head around AI/ML.
I Stopped Clicking Through the AWS Pricing Calculator. Now I Just Describe the Architecture.
The AWS Pricing Calculator MCP lets Claude build a real estimate from a sentence and hand back a shareable calculator.aws URL. No credentials, no clicking. For presales engineers this is the difference between a same-day quote and 'let me get back to you next week.'
I Got Tired of Passing --profile on Every OCI CLI Command
ocswitch is a small shell script that manages multiple OCI profiles and persists the active one across all terminal sessions. No more --profile flags, no more editing config files.
DNS as Code: Managing Cloudflare Records with DNSControl
Manual DNS edits in dashboards leave no audit trail and no review process. DNSControl turns your Cloudflare zone into a Git-backed, PR-reviewed, CI-deployed system - here is a working POC you can fork.
Bypassing Cloudflare for True Origin Health Checks with Blackbox Exporter and CoreDNS
When Cloudflare masks origin failures, your health checks lie to you. A CoreDNS sidecar that overrides DNS resolution lets Blackbox Exporter probe origins directly while keeping TLS and Host headers intact.
The Git habits that made reviewers trust me before they read a single line of code
How a structured branching strategy, conventional commits, and knowing when to use cherry-pick instead of a full merge helped me stand out when contributing to projects on GitHub, GitLab, Azure DevOps, and AWS CodeCommit.
Built My Own Prometheus Service Discovery for Oracle Cloud Because a 3-Year-Old PR Never Got Merged
When the upstream OCI service discovery PR sat open for three years, I built the other end of the HTTP SD interface myself. This is running in production across 10+ OCI tenancies.
End-to-End Supply Chain Security for a Go Project: TUF on CI, cosign, and SLSA L3
How I wired together tuf-on-ci, Sigstore, SLSA L3 provenance, and GitHub Pages to build a fully verifiable release pipeline for oci-prometheus-sd-proxy with no long-lived signing keys anywhere.