The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
GitHub Actions Secrets Are Not Enough for Multi-Env CI
Environment-scoped secrets in GitHub Actions feel like the answer until you actually run multi-environment CI at scale. Here's what bites you.
I spent two days last spring untangling a secrets mess on a project that had grown from one environment to four. Everything looked correct in the GitHub UI. The deployments were failing in ways that made no sense until I realized we had three different values for the same secret name living in three different scopes…
Read the daily →Make.com Is Great Until You Need It to Think
I use Make.com for real work. I also know exactly where it stops being a tool and starts being a liability. That line is sharper than most people draw it.
I've built probably thirty Make.com scenarios in the last two years. I've also ripped three of them out and replaced them with Laravel webhook listeners because they got too clever. The boundary between "great use of Make" and "you're going to regret this" is real, and most people cross it without noticing. What…
Read the daily →nginx geo module: GeoIP routing and rate limiting for free
You don't need a paid WAF or middleware to block or throttle traffic by country. nginx's geo module does it before your app even wakes up.
The best middleware is the middleware that never runs your application code. I've been using nginx's built-in module for years to do cheap, fast, zero-dependency GeoIP-based routing and rate limiting, and I keep meeting developers who don't know it exists - or who are paying for a WAF to do something nginx handles…
Read the daily →ProxySQL vs. Laravel's Connection Pool: When the Proxy Earns Its Keep
Running MariaDB on a single VM? Here's when adding ProxySQL between Laravel and your database actually pays off - and when it just adds another thing to break.
ProxySQL is one of those tools that looks like overkill until the night your MariaDB server starts rejecting connections at 2am because you've got 400 open sockets and is 151. I've been there. But I've also added ProxySQL to setups where it genuinely made things worse - slower deploys, one more daemon to babysit, and…
Read the daily →S3 Lifecycle Policies Won't Break Your URLs (If You're Careful)
Tiering old user uploads to Glacier sounds free - until your app tries to serve a file and gets a 403. Here's how I do it without breaking anything.
I've been burned by this twice. S3 lifecycle policies look like free money - move old objects to cheaper storage, save 70% on storage costs, done. The problem is your app doesn't know the file moved, and neither does the user's browser when it follows a pre-signed URL to something that's now archived. Here's how I…
Read the daily →