The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Stripe Webhooks Will Race You. Here's How to Win.
Idempotency keys feel like a safety net until you hit 500 orders a day and realize your webhook handler has a race condition that's been double-charging people.
Stripe will deliver the same webhook event more than once. They document this openly. Most developers read it, nod, and then write a handler that's still broken under load. I was one of them until an e-commerce client's fulfillment system started creating duplicate shipments on Black Friday. The idempotency key Stripe…
Read the daily →Swap on a Laravel VM: Survival Mechanism, Not a Fix
Swap on a production VM isn't shameful — it's a tuning decision. Here's how I configure it and why I treat it as a canary, not a crutch.
Every Laravel project I've deployed on a small VPS has eventually hit the same wall: the OOM killer shows up unannounced, takes out php-fpm or MySQL, and the site goes dark. Swap didn't cause that. But the absence of swap made it uglier than it had to be. Here's how I think about it after two-plus decades of keeping…
Read the daily →Laravel Log Rotation on a Single VM: The Octane File-Handle Trap
Running Octane and logrotate on the same VM looks fine until your logs silently vanish. Here's what's actually happening and how to fix it.
Logrotate runs at 2 AM, rotates to , creates a fresh , and your monitoring says everything is fine. But Octane is still writing to the old inode — the one that's now — and the new file stays empty until you restart the worker. This is a silent failure. No exceptions, no alerts, just a log file that stops growing while…
Read the daily →Why HTTP-01 Fails You on Private Laravel Deployments
HTTP-01 ACME challenges sound simple until your server can't be reached from the internet. Here's why DNS-01 is the only answer for private networks.
The first time HTTP-01 silently fails on a private-network deployment, you spend an embarrassing amount of time staring at Certbot output wondering what you did wrong. You didn't do anything wrong — the challenge type itself is the problem. DNS-01 is the fix, and once you wire it up properly it's actually more elegant…
Read the daily →Lambda Cold Starts: When the Latency Math Says No
Cold starts behind API Gateway look fine on paper until a real client hits a sleeping function and waits three seconds for a login page. Here's where I draw the line.
Cold starts are the thing AWS hoped you wouldn't think too hard about. For high-traffic endpoints, they're a rounding error. For the low-traffic internal tools and healthcare portals I build, they can be the entire user experience. I spent a chunk of last year migrating a client's internal ops tool off a small EC2…
Read the daily →