Writing

The companion to my NITHUB Innovation Fair masterclass, Building Technology Infrastructure for Scale. The demo you watched: an AI agent that diagnosed a broken deploy, named the missing secret without ever printing it, then stopped to ask before it changed anything. The three guardrails behind it, the slides, and the four part write up are all here. It matters most on the day your product goes viral. Diagnosis was automated. The decision was mine.

The day your product goes viral is the day you ship the most, under the most pressure. Before you get there, a failed deploy has to be a non event: the platform holds the old version and rolls back on its own, no agent and no human required. That floor is what everything else in this series stands on.

I gave an agent a real failed deploy and the tools to fix it. The most important thing it did was stop and ask before touching a secret. Diagnosis was automated. The decision was mine. That split, plus the one class of action I keep out of its reach entirely, is the whole point.

Letting an agent help operate your product is not one yes or no decision. It is three separate limits, and you need all three: constrain the procedure it follows, gate the privileged actions it can take, and limit what it can even see. Miss one and the other two do not save you.

You are a small team and cannot be awake for every alert, so an AI agent that reads your logs sounds like the teammate you cannot afford to hire. It can be, but only if you are clear about which half of the job to hand it. The line is not how capable the model is. It is which mistakes are cheap and which ones you cannot take back.

Pi-hole blocks ads for every device on your network, but only at home — and exposing it to the internet to fix that is a genuinely bad idea. Blackhole runs Pi-hole entirely inside a Tailscale VPN using a shared network namespace, so the ad blocker follows you to any device, anywhere, while staying completely invisible to the public internet.

Most engineers who end up running infrastructure didn't plan to. Reoclo turns that accidental responsibility into a service teams can actually rely on, built from years of running real infrastructure across different stacks and scales.

Email deliverability problems are almost always configuration problems: SPF, DKIM, and DMARC quietly misconfigured until a mailbox provider starts filtering you to spam. Prawnwire is transactional email infrastructure built to get this right from the start and keep it right.

The blue-green tutorials all assume a spare server. Here is how I run zero-downtime deploys for my own platform on a single RAM-constrained box: what gets a color, what stays singleton, why the cutover is just a Caddy reload, and how a stopped-but-resumable old color buys near-instant rollback.

Modern work is split across several browsers and many profiles, but macOS still forces every link through a single global default. Air Traffic Controller is a profile-aware default browser router for macOS that sends every click to the right browser and the right profile, automatically.