# Deepak Dinesh — full content dump > Senior IT Systems Engineer & Digital Transformation Specialist · Muscat, Oman · deepakdinesh@outlook.com ## Guides - [Zero Trust for Small Business](https://www.deepakdinesh.com/guides/zero-trust-small-business): The complete Zero Trust record: a weekend Tailscale-to-Twingate cutover under DPI pressure, the certificate-binding fix, the ADR verdict, and the stack notes — with receipts. - [Tailscale vs Twingate Under DPI](https://www.deepakdinesh.com/guides/tailscale-vs-twingate): Tailscale vs Twingate decided by one observed event: Omani DPI fingerprinted WireGuard and four branches went dark. Protocol-shape table, cutover metrics, and the openly-carried trade. - [Cost Discipline: Every Dollar Not Spent](https://www.deepakdinesh.com/guides/cost-discipline): Six cost receipts in one URL: the $2,500/yr VPN saving, the $20 droplet vs $2,000 SaaS quote, the deleted $20/mo KV line, and the zero-bill pipelines — each linked to its proof. ## Case studies (6) ### TweakDeals: Real Price History for AliExpress Tech url: https://www.deepakdinesh.com/work/tweakdeals date: 2026-10-06 tags: Next.js, Cloudflare Workers, Neon, PostgreSQL, Data Pipeline, Scraping, SEO, TypeScript stack: Next.js 16, React 19, Cloudflare Workers, Neon PostgreSQL, Prisma, TypeScript, Tailwind CSS, Turborepo, Vitest, Resend Price-intelligence platform tracking AliExpress tech gear with real discount history from observed prices. Next.js 16 on Cloudflare Workers + Neon Postgres. ### Spilled Palette Studio: Art Gallery at 95+ Lighthouse url: https://www.deepakdinesh.com/work/spilled-palette-studio date: 2026-05-15 tags: Next.js, Frontend, UI/UX, Cloudinary, Framer Motion stack: Next.js 14, Tailwind CSS, Framer Motion, Cloudinary, Vercel Aesthetic-first Next.js 14 portfolio for digital artist Aswathi Bindhu Jawahar — dynamic masonry grids, Cloudinary image optimization, and Framer Motion interactions at 95+ Lighthouse. ### Tally Prime Remote Access: Migrating RDS from blocked Tailscale to Twingate url: https://www.deepakdinesh.com/work/rds-migration-tailscale-to-twingate date: 2025-10-26 tags: Tally Prime, Twingate, Tailscale, Zero Trust ZTNA, Deep Packet Inspection, RDS RemoteApp, PowerShell, Let's Encrypt stack: Twingate, Windows Server 2019 RDS RemoteApp, Ubuntu 24.04 (Hyper-V connector), Let's Encrypt via win-acme, PowerShell How I bypassed ISP-level DPI restrictions in Oman to restore Tally Prime ERP access. A migration from Tailscale to Twingate using RDS RemoteApp, Let's Encrypt, and Zero Trust principles. ### Automated AI Inventory Forecasting: Python & Prophet url: https://www.deepakdinesh.com/work/inventory-forecasting-tool date: 2025-03-30 tags: Python, Data Engineering, Prophet AI, ETL, SQLite, Pandas, Automation, Multiprocessing stack: Python, Meta Prophet, SQLite, Pandas, Multiprocessing Built an ETL and forecasting pipeline using Python, SQLite, and Meta's Prophet AI to automate replenishment for ~7,800 SKUs. Reduced the supply chain planning cycle from days to hours. ### Unified IT Infrastructure for a 10-Branch Retail Group url: https://www.deepakdinesh.com/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group date: 2024-03-01 tags: Systems Engineering, Windows Server, Tailscale, Tally Prime, Automation, PowerShell, Prometheus, Grafana stack: Windows Server 2019, Remote Desktop Services (RemoteApp), Tailscale, Tally Prime, Active Directory + GPO, PowerShell, Prometheus + Grafana Multi-year modernization for 10+ retail branches across two countries: centralized financial ERPs onto Windows Server 2019 RDS, replaced hardware VPNs with a Tailscale mesh, and added Prometheus and Grafana observability. ### Mushtariyat.com: High-Performance E-Commerce on DigitalOcean url: https://www.deepakdinesh.com/work/mushtariyat date: 2020-05-01 tags: E-commerce, WooCommerce, WordPress, PHP, DigitalOcean, Nginx, Redis stack: PHP 8.1, WordPress + WooCommerce, MariaDB, Nginx, Redis, Cloudflare CDN + WAF, Thawani Pay API, Ubuntu 20.04 LTS, DigitalOcean Droplet Bespoke WooCommerce platform on a $20 DigitalOcean droplet serving 5,000+ monthly visitors, with Redis object caching, Cloudflare edge caching, and Thawani Pay for the Omani market. ## Terminal logs (22) ### What Prometheus Sees: Monitoring 10 Branches from One Grafana url: https://www.deepakdinesh.com/blog/monitoring-ten-branches-grafana date: 2026-10-12 tags: Infrastructure, Automation The unified-infrastructure case claims Prometheus and Grafana observability — this is the architecture behind the claim: what gets scraped, what the dashboard shows, what fires alerts, and the one blind spot the design still carries. ### The Receipts Ledger: Every Dollar This Infrastructure Didn't Spend url: https://www.deepakdinesh.com/blog/infrastructure-receipts-ledger date: 2026-10-11 tags: Strategy, Infrastructure, Performance Pure synthesis, no new numbers: the $2,500/yr VPN saving, the $20 droplet vs $2,000 SaaS quote, the $20/mo KV line deleted, and the zero-bill pipelines — each linked to its proof. ### Tally Prime on RDS RemoteApp: The Day-2 Shape (Sessions, Licenses, Certificates) url: https://www.deepakdinesh.com/blog/rds-day-2-operations date: 2026-10-10 tags: Infrastructure, Automation The RDS cutover posts cover the migration night — this is what operating it looks like after: session-broker license management, timeout policies at peak hours, the 60-day certificate cycle, and the connector you still have to watch. ### ZTNA Phase 2: The Plan and the Definition of Done url: https://www.deepakdinesh.com/blog/ztna-phase-2-build-log date: 2026-10-09 tags: Security, Networking, Zero Trust The /now entry commits to moving the last Tally Prime hop off the legacy VPN segment onto ZTNA. This is the plan, not a build log: what Phase 1 proved, what the last hop needs, and what done looks like — no completion claims yet. ### 18,000 Observations a Day: Inside the TweakDeals Price Pipeline url: https://www.deepakdinesh.com/blog/tweakdeals-price-pipeline date: 2026-09-27 tags: Data Engineering, Python, Cloudflare The case proves the what — 2,084 products, 21 jobs, 2-minute poll. This is the how: the quota-aware poll loop, the scoring curve that unclumped 55.8% at 75, and stale-by-design edge reads. ### The Database Emptied Itself Twice: Forensics on Shared Credentials and Truncate-Capable Scripts url: https://www.deepakdinesh.com/blog/empty-database-postmortem date: 2026-09-17 tags: Post-Mortem, Security, Infrastructure Twice in 2026 the TweakDeals database was emptied from under the site — in August, 2,544 products at 10:32 UTC were zero by 11:05. Forensics, guards, and the prebuild cache that saved the site. ### Paperclip Agents Rebuilding My Portfolio: The DAR Loop and the LIKE/REJECT Gate url: https://www.deepakdinesh.com/blog/paperclip-dar-loop date: 2026-09-02 tags: AI Agents, Automation, Web Development Four Paperclip agents took a Next.js portfolio from idea to merged pull request while I only reviewed. The interesting part is not the code — it is the DAR issue queue, the visual approval gate that stopped a broken redesign from shipping, and the two failure modes I had to design around. ### The CSP Outage I Caused Myself: Placeholder Nonces, strict-dynamic, and Prebuilt Headers url: https://www.deepakdinesh.com/blog/csp-nonce-outage date: 2026-08-18 tags: Security, Next.js, CSP, Cloudflare, Post-Mortem A placeholder nonce that shipped to production took this site down for 41 minutes. Here is the exact failure, why static headers cannot emulate per-request nonces, and the three fixes that made the site both faster and actually secure. ### What I Ask Before Touching Your VPN url: https://www.deepakdinesh.com/blog/vpn-migration-intake-checklist date: 2026-08-10 tags: Security, Networking, Zero Trust Five outputs before any migration sketch: netcheck UDP, DERP reachability, the cert subject names, the NAT shape, and the rollback plan. Drawn from the RDS cutover's transcripts and ADR-003. ### Tally Prime XML to SQLite ETL Cookbook url: https://www.deepakdinesh.com/blog/tally-etl-cookbook date: 2026-07-29 tags: Data Engineering, Python, SQLite, Supply Chain The unglamorous plumbing behind the 18h-to-4h forecasting win: streaming a 1.8 GB Tally Prime XML export with lxml iterparse, surviving mixed encodings and damaged nodes, into an indexed SQLite frame. ### I Deleted My Vercel KV Instance: Rate Limiting on the Free Tier Without a Data Store url: https://www.deepakdinesh.com/blog/killing-vercel-kv date: 2026-07-11 tags: Performance, Infrastructure, Automation Vercel KV cost me $64 in idle months and caused one 26-minute connection-pool outage. I moved the fast path to a per-process sliding window and the durable counters to Postgres — $20/month to zero, and p99 latency on /api/search from 310 ms to 12 ms. ### RDS Certificate Subject-Name Mismatch: Binding Let's Encrypt Across All Four Roles url: https://www.deepakdinesh.com/blog/rds-cert-binding-guide date: 2026-06-20 tags: Security, Infrastructure, Automation Twingate routed RDS traffic fine — then RD Gateway rejected every session on certificate subject-name mismatch. The fix: win-acme DNS-01 plus one PowerShell script binding all four RDS roles every 60 days. ### OpenClaw as an IT Operations Nerve Center: My 2026 Setup url: https://www.deepakdinesh.com/blog/openclaw-it-operations-nerve-center date: 2026-06-04 tags: AI Agents, OpenClaw, Automation, Infrastructure How I replaced a patchwork of cron jobs, scripts, and notifications with a single autonomous AI agent that handles infrastructure monitoring, code deployments, and operational workflows — running 24/7 on a MacBook Air. ### The Slim CI Rebuild: One Pipeline Per Push, One Browser Download, Zero Redundant Installs url: https://www.deepakdinesh.com/blog/slim-ci-rebuild date: 2026-05-21 tags: Infrastructure, Automation Every push to an MR branch ran two GitLab pipelines and every Playwright job downloaded its own Chromium. Commit 1f3a658 fixed all three with workflow rules, lockfile-keyed caching, and a shared browser artifact — here is the exact diff and what it cannot prove. ### The Redirects That Vanished: vercel.json, Prebuilt Deploys, and 308s Rebuilt as Routes url: https://www.deepakdinesh.com/blog/prebuilt-redirect-saga date: 2026-04-23 tags: Infrastructure, Automation vercel deploy --prebuilt reads .vercel/output/config.json, not vercel.json — so six redirect rules silently stopped firing and /syslog answered 404. Commit 4e238be re-emitted them as routes[] entries, and 19d1b23 taught the probes about trailing slashes. Real code, real ordering constraints. ### Nonces End to End: generate, build, inject, finalize, verify url: https://www.deepakdinesh.com/blog/nonce-pipeline-ensemble date: 2026-03-26 tags: Security, Infrastructure Five scripts carry one UUID from mint to production header — scripts/generate-csp.mjs, inject-nonce.mjs, finalize-csp.mjs, csp-check.mjs, verify-prod-csp.mjs. Two production incidents drew the map; the pipeline diagram in this post is the repo's own chain. ### Grounding the Ask Box: An 8 KB Fact Blob, a Cite-Slugs Rule, and the Guards Around It url: https://www.deepakdinesh.com/blog/grounded-ask-fact-blob date: 2026-02-19 tags: AI Agents, Automation The site's ask box answers from a build-time JSON blob capped at 8 KB — titles, slugs, summaries, tags, metrics, nothing else. Here is how scripts/generate-chat-facts.mjs builds it, the cite-slugs rule in src/pages/api/chat.ts, the rate-limit and body guards, and what none of that actually proves. ### Build Attestation: One build.json Feeds the Footer, /status, and /api/health url: https://www.deepakdinesh.com/blog/build-attestation-status-health date: 2026-01-15 tags: Infrastructure, Automation scripts/generate-build-info.mjs hashes every content file into src/generated/build.json before astro build; Footer.astro, status.astro, and api/health.ts all read that one file — counts never drift because there is exactly one place they can come from. ### AI Inventory Forecasting: From 18 Hours to 4 Hours url: https://www.deepakdinesh.com/blog/ai-inventory-forecasting date: 2025-03-30 tags: Data Engineering, Python, Prophet AI, Multiprocessing, SQLite, Supply Chain How I replaced a crashing Excel-based inventory planning process for 7,800+ SKUs with a Python multiprocessing pipeline using Meta's Prophet AI — cutting weekly planning time from 18 hours to 4 hours overnight. ### Tailscale Blocked? Moving Tally Prime ERP to Twingate ZTNA url: https://www.deepakdinesh.com/blog/bypassing-vpn-blocks date: 2024-05-15 tags: Security, Networking, Zero Trust When TRA Oman blocked our VPN protocol, operations halted across 4 branches. Here is the technical and business breakdown of how we migrated to Zero Trust architecture and restored operations within 48 hours. ### 5 Lessons from 10 Years of Digital Transformation url: https://www.deepakdinesh.com/blog/10-years-of-digital-transformation date: 2024-03-01 tags: Strategy, Infrastructure A decade of leading IT initiatives in Oman — ERP migrations, AI deployments, Zero Trust adoption. Here are the hard-won strategic insights that actually translate to business value. ### WooCommerce Optimization: Caching & Core Web Vitals url: https://www.deepakdinesh.com/blog/woocommerce-seo-optimization date: 2023-11-20 tags: Web Development, Performance, WordPress How I optimized a heavy WooCommerce store on a DigitalOcean droplet to pass Google's Core Web Vitals — cutting TTFB from 1,200ms to 300ms (−75%) and improving mobile conversion rates within 30 days. ## Stack (11) - Astro + Tailwind [Frontend]: Static-first pages with islands where needed; this portfolio is the demo. - Cloudflare Workers [Tooling]: Edge-served static shells with a micro-API for live data. Staleness by design, never blank. - GitLab CI + Playwright/Vitest [Operations]: Empty-DB gates and staleness monitors in CI. Deploys that fail boring instead of blank. - Neon Postgres [Tooling]: Serverless Postgres over HTTP for the edge; Prisma where there's Node, raw SQL where there isn't. - Nginx + Redis [Infrastructure]: Nginx terminates and caches, Redis absorbs the catalog reads. The $20 VPS formula. - PowerShell [Operations]: Every Windows Server I touch gets scripted before it gets documented. Repeatable beats clever. - Prophet + SQLite [Data]: One time-series model per SKU, persisted in SQLite. Boring storage, honest forecasts. - Python ETL (lxml/Pandas) [Data]: Stream the gigabyte, never load it. Iterparse plus a pre-processor beats RAM every time. - Tailscale [Security]: The default mesh until the ISP says otherwise; ACLs per port, not blind LAN trust. - Twingate [Security]: Outbound-TLS ZTNA is what survives DPI. No public IP, no inbound ports, no handshake to fingerprint. - Windows Server RDS [Infrastructure]: RemoteApp turns a desktop ERP into a streamed app; session-host tuning is the whole job. ## Now (1) - Current focus: - Rebuilding this site on Astro 7 with a real command palette (no SaaS template in sight), because content-collections-driven pages keep the homepage metrics and deployment proof in sync instead of drifting apart. - Zero Trust rollout, phase 2: moving the last Tally Prime ERP hop off the remaining legacy VPN segment onto ZTNA (follows the completed Oct 2025 cutover in ~/work/rds-migration-tailscale-to-twingate), so no branch still depends on a fingerprintable VPN handshake. - Writing up the Prophet forecasting pipeline's move off the nightly cron. The ~7,800-SKU run from ~/work/inventory-forecasting-tool deserves a scheduler with retries and checkpoints, not a fire-and-forget timer. > index card: https://www.deepakdinesh.com/llms.txt > feed: https://www.deepakdinesh.com/rss.xml > resume: https://www.deepakdinesh.com/Deepak_Dinesh_Resume.pdf