The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Twilio Verify: Rate Limiting OTP Without Locking Out Real Users
Twilio Verify's built-in rate limiting sounds great until your client's customers start getting locked out. Here's how I actually handle it.
Twilio Verify's default rate limiting will stop a naive enumeration attack. It will also lock out a real user who fat-fingered their phone number twice, and then you're getting a support ticket at 11pm. Getting the balance right requires understanding what Twilio actually does under the hood — and layering your own…
Read the daily →Zero-Downtime Laravel Deploys Without the Orchestrator Tax
You don't need Kubernetes to ship without dropping requests. Here's the atomic release pattern I use on single servers, built in plain bash and a symlink.
The first time a client called me mid-afternoon because their e-commerce checkout was throwing 500s during a deploy, I was already halfway through a on the live server. Classic. That was enough — I moved everything to atomic releases that week and I haven't had a deploy-window outage since. The good news: you don't…
Read the daily →Laravel Queues: A Supervisor Config That Actually Survives Production
Most Laravel queue setups work fine in dev and fall apart quietly in prod. Here's the Supervisor config I've landed on after too many silent failures.
The default Laravel queue Supervisor config in the docs will get you started. It will also let jobs silently disappear after a Redis restart, leave zombie workers after a deploy, and OOM-kill your workers with no restart if you're not paying close attention. I've been burned by all three. Here's what I actually run…
Read the daily →Feature Flags: Write Your Own or Pay for LaunchDarkly?
I've rolled my own feature flags a dozen times and used LaunchDarkly on two projects. Here's the honest inflection point between them.
I've built feature flag systems from scratch more times than I can count, and I've also wired up LaunchDarkly on two production projects. The honest answer to "which should I use" is not the one most blog posts give you. Most posts either sell you on LaunchDarkly immediately or tell you it's overkill. Both are…
Read the daily →nginx split config: cached HTML for marketing, PHP-FPM for the rest
Serving static cached HTML for your marketing pages while Laravel handles auth routes cuts PHP-FPM load dramatically. Here's the exact nginx config I use.
I've been running this split for about three years now and I'm still surprised more Laravel shops don't do it. Your marketing pages — homepage, pricing, about, blog — don't need PHP-FPM. They need to be fast. Your authenticated app routes do need PHP, but they're a fraction of your total traffic. Splitting the two at…
Read the daily →