All blog posts

Mutual TLS (mTLS) from Scratch with OpenSSL and Nginx

Build a private Certificate Authority, issue client certificates, and enforce cryptographic two-way authentication at the Nginx reverse proxy layer.

Private Site-to-Site Mesh with WireGuard and Self-Hosted Headscale

Build a self-hosted WireGuard mesh network using Headscale as an open-source control plane for Tailscale clients. Connect VPS instances, homelabs, and local machines without public IPs.

Injecting hardware cameras into the iOS simulator using IOSurface

Handling Network Requests Gracefully

Network calls fail. Clients retry. Here is how to handle duplicate requests without charging your users twice.

Configuring Nginx for Reverse Proxy

A quick guide on how to set up Nginx as a reverse proxy for your backend applications.

Let's Talk About gRPC

gRPC is not a replacement for REST. It's a different tool with different tradeoffs. Here's what it actually does, where it fits, and where it doesn't.

Creating Your First Kubernetes Cluster

A complete walkthrough for spinning up your first Kubernetes cluster, deploying something real, and understanding what's actually happening.

Message Queues: When to Use Kafka, RabbitMQ, or SQS

A direct comparison of three message queue systems: Kafka, RabbitMQ, and Amazon SQS. What each one actually does, where each one breaks, and how to pick without second-guessing yourself six months later.

Securing My Ubuntu Server — Part 3: Zero Trust with Cloudflare Tunnel

Closing port 22 for good. Using Cloudflare Tunnel to route SSH and web traffic through Cloudflare's network with zero publicly exposed ports, then locking it down further with Cloudflare Access.

Securing My Ubuntu Server — Part 2: Firewalls, Fail2Ban, and Zero Open Ports

Defense in depth for your VPS: configuring UFW, layering DigitalOcean's cloud firewall on top, and using Fail2Ban to automatically ban malicious IPs before they get a second chance.

Securing My Ubuntu Server — Part 1: Initial Setup, User Management, and System Hardening

The absolute must-have steps I personally took to lock down a brand-new DigitalOcean Droplet: sudo users, SSH key auth, application-specific users, sudoers, and a basic firewall.

VIPER Was a Cage. Now It Is a Ruin.

VIPER promised clean iOS architecture. What it delivered was bureaucracy. SwiftUI made the case worse: the pattern is now structurally incompatible with how Apple wants you to build apps.

Tools, Not Religions

The endless debates about which framework is best, which language wins, and which library is the GOAT all share one thing: they're asking the wrong question.

Is TCA Really That Good?

An honest look at The Composable Architecture. What it solves, what it costs, and when you actually need it.

MVVM in SwiftUI

The debate over MVVM in SwiftUI misses the point. We should be asking what a ViewModel is actually supposed to do inside a framework like SwiftUI.