~/search

Filter the site index. Works without JavaScript (full list below).

60 entries

• ~/home

  Home

• ~/about

  About System Admin

• ~/work

  Case Studies

• ~/blog

  Terminal Logs

• ~/uses

  Tools & Stack

• ~/now

  Current focus

• ~/adr

  Architecture Decision Records

• ~/display

  CRT phosphor mode

• ~/rss.xml

  RSS feed

• ~/llms.txt

  Machine-readable site summary

• ~/llms-full.txt

  Full machine-readable dump

• ~/tags

  Topics index

• ~/status

  Build status and health

• ~/guides

  Field guides

• Zero Trust for Small Business

  Field guide

• Tailscale vs Twingate

  Field guide

• Cost Discipline

  Field guide

• TweakDeals: Real Price History for AliExpress Tech

  Price-intelligence platform tracking AliExpress tech gear with real discount history from observed prices. Next.js 16 on Cloudflare Workers + Neon Postgres.

• Spilled Palette Studio: Art Gallery at 95+ Lighthouse

  Aesthetic-first Next.js 14 portfolio for digital artist Aswathi Bindhu Jawahar — dynamic masonry grids, Cloudinary image optimization, and Framer Motion interactions at 95+ Lighthouse.

• Tally Prime Remote Access: Migrating RDS from blocked Tailscale to Twingate

  How I bypassed ISP-level DPI restrictions in Oman to restore Tally Prime ERP access. A migration from Tailscale to Twingate using RDS RemoteApp, Let's Encrypt, and Zero Trust principles.

• Automated AI Inventory Forecasting: Python & Prophet

  Built an ETL and forecasting pipeline using Python, SQLite, and Meta's Prophet AI to automate replenishment for ~7,800 SKUs. Reduced the supply chain planning cycle from days to hours.

• Unified IT Infrastructure for a 10-Branch Retail Group

  Multi-year modernization for 10+ retail branches across two countries: centralized financial ERPs onto Windows Server 2019 RDS, replaced hardware VPNs with a Tailscale mesh, and added Prometheus and Grafana observability.

• Mushtariyat.com: High-Performance E-Commerce on DigitalOcean

  Bespoke WooCommerce platform on a $20 DigitalOcean droplet serving 5,000+ monthly visitors, with Redis object caching, Cloudflare edge caching, and Thawani Pay for the Omani market.

• What Prometheus Sees: Monitoring 10 Branches from One Grafana

  The unified-infrastructure case claims Prometheus and Grafana observability — this is the architecture behind the claim: what gets scraped, what the dashboard shows, what fires alerts, and the one blind spot the design still carries.

• The Receipts Ledger: Every Dollar This Infrastructure Didn't Spend

  Pure synthesis, no new numbers: the $2,500/yr VPN saving, the $20 droplet vs $2,000 SaaS quote, the $20/mo KV line deleted, and the zero-bill pipelines — each linked to its proof.

• Tally Prime on RDS RemoteApp: The Day-2 Shape (Sessions, Licenses, Certificates)

  The RDS cutover posts cover the migration night — this is what operating it looks like after: session-broker license management, timeout policies at peak hours, the 60-day certificate cycle, and the connector you still have to watch.

• ZTNA Phase 2: The Plan and the Definition of Done

  The /now entry commits to moving the last Tally Prime hop off the legacy VPN segment onto ZTNA. This is the plan, not a build log: what Phase 1 proved, what the last hop needs, and what done looks like — no completion claims yet.

• 18,000 Observations a Day: Inside the TweakDeals Price Pipeline

  The case proves the what — 2,084 products, 21 jobs, 2-minute poll. This is the how: the quota-aware poll loop, the scoring curve that unclumped 55.8% at 75, and stale-by-design edge reads.

• The Database Emptied Itself Twice: Forensics on Shared Credentials and Truncate-Capable Scripts

  Twice in 2026 the TweakDeals database was emptied from under the site — in August, 2,544 products at 10:32 UTC were zero by 11:05. Forensics, guards, and the prebuild cache that saved the site.

• Paperclip Agents Rebuilding My Portfolio: The DAR Loop and the LIKE/REJECT Gate

  Four Paperclip agents took a Next.js portfolio from idea to merged pull request while I only reviewed. The interesting part is not the code — it is the DAR issue queue, the visual approval gate that stopped a broken redesign from shipping, and the two failure modes I had to design around.

• The CSP Outage I Caused Myself: Placeholder Nonces, strict-dynamic, and Prebuilt Headers

  A placeholder nonce that shipped to production took this site down for 41 minutes. Here is the exact failure, why static headers cannot emulate per-request nonces, and the three fixes that made the site both faster and actually secure.

• What I Ask Before Touching Your VPN

  Five outputs before any migration sketch: netcheck UDP, DERP reachability, the cert subject names, the NAT shape, and the rollback plan. Drawn from the RDS cutover's transcripts and ADR-003.

• Tally Prime XML to SQLite ETL Cookbook

  The unglamorous plumbing behind the 18h-to-4h forecasting win: streaming a 1.8 GB Tally Prime XML export with lxml iterparse, surviving mixed encodings and damaged nodes, into an indexed SQLite frame.

• I Deleted My Vercel KV Instance: Rate Limiting on the Free Tier Without a Data Store

  Vercel KV cost me $64 in idle months and caused one 26-minute connection-pool outage. I moved the fast path to a per-process sliding window and the durable counters to Postgres — $20/month to zero, and p99 latency on /api/search from 310 ms to 12 ms.

• RDS Certificate Subject-Name Mismatch: Binding Let's Encrypt Across All Four Roles

  Twingate routed RDS traffic fine — then RD Gateway rejected every session on certificate subject-name mismatch. The fix: win-acme DNS-01 plus one PowerShell script binding all four RDS roles every 60 days.

• OpenClaw as an IT Operations Nerve Center: My 2026 Setup

  How I replaced a patchwork of cron jobs, scripts, and notifications with a single autonomous AI agent that handles infrastructure monitoring, code deployments, and operational workflows — running 24/7 on a MacBook Air.

• The Slim CI Rebuild: One Pipeline Per Push, One Browser Download, Zero Redundant Installs

  Every push to an MR branch ran two GitLab pipelines and every Playwright job downloaded its own Chromium. Commit 1f3a658 fixed all three with workflow rules, lockfile-keyed caching, and a shared browser artifact — here is the exact diff and what it cannot prove.

• The Redirects That Vanished: vercel.json, Prebuilt Deploys, and 308s Rebuilt as Routes

  vercel deploy --prebuilt reads .vercel/output/config.json, not vercel.json — so six redirect rules silently stopped firing and /syslog answered 404. Commit 4e238be re-emitted them as routes[] entries, and 19d1b23 taught the probes about trailing slashes. Real code, real ordering constraints.

• Nonces End to End: generate, build, inject, finalize, verify

  Five scripts carry one UUID from mint to production header — scripts/generate-csp.mjs, inject-nonce.mjs, finalize-csp.mjs, csp-check.mjs, verify-prod-csp.mjs. Two production incidents drew the map; the pipeline diagram in this post is the repo's own chain.

• Grounding the Ask Box: An 8 KB Fact Blob, a Cite-Slugs Rule, and the Guards Around It

  The site's ask box answers from a build-time JSON blob capped at 8 KB — titles, slugs, summaries, tags, metrics, nothing else. Here is how scripts/generate-chat-facts.mjs builds it, the cite-slugs rule in src/pages/api/chat.ts, the rate-limit and body guards, and what none of that actually proves.

• Build Attestation: One build.json Feeds the Footer, /status, and /api/health

  scripts/generate-build-info.mjs hashes every content file into src/generated/build.json before astro build; Footer.astro, status.astro, and api/health.ts all read that one file — counts never drift because there is exactly one place they can come from.

• AI Inventory Forecasting: From 18 Hours to 4 Hours

  How I replaced a crashing Excel-based inventory planning process for 7,800+ SKUs with a Python multiprocessing pipeline using Meta's Prophet AI — cutting weekly planning time from 18 hours to 4 hours overnight.

• Tailscale Blocked? Moving Tally Prime ERP to Twingate ZTNA

  When TRA Oman blocked our VPN protocol, operations halted across 4 branches. Here is the technical and business breakdown of how we migrated to Zero Trust architecture and restored operations within 48 hours.

• 5 Lessons from 10 Years of Digital Transformation

  A decade of leading IT initiatives in Oman — ERP migrations, AI deployments, Zero Trust adoption. Here are the hard-won strategic insights that actually translate to business value.

• WooCommerce Optimization: Caching & Core Web Vitals

  How I optimized a heavy WooCommerce store on a DigitalOcean droplet to pass Google's Core Web Vitals — cutting TTFB from 1,200ms to 300ms (−75%) and improving mobile conversion rates within 30 days.

• Astro + Tailwind

  Static-first pages with islands where needed; this portfolio is the demo.

• Cloudflare Workers

  Edge-served static shells with a micro-API for live data. Staleness by design, never blank.

• GitLab CI + Playwright/Vitest

  Empty-DB gates and staleness monitors in CI. Deploys that fail boring instead of blank.

• Neon Postgres

  Serverless Postgres over HTTP for the edge; Prisma where there's Node, raw SQL where there isn't.

• Nginx + Redis

  Nginx terminates and caches, Redis absorbs the catalog reads. The $20 VPS formula.

• PowerShell

  Every Windows Server I touch gets scripted before it gets documented. Repeatable beats clever.

• Prophet + SQLite

  One time-series model per SKU, persisted in SQLite. Boring storage, honest forecasts.

• Python ETL (lxml/Pandas)

  Stream the gigabyte, never load it. Iterparse plus a pre-processor beats RAM every time.

• Tailscale

  The default mesh until the ISP says otherwise; ACLs per port, not blind LAN trust.

• Twingate

  Outbound-TLS ZTNA is what survives DPI. No public IP, no inbound ports, no handshake to fingerprint.

• Windows Server RDS

  RemoteApp turns a desktop ERP into a streamed app; session-host tuning is the whole job.

• ~/now — Current focus

  Rebuilding this site on Astro 7 with a real command palette (no SaaS template in sight), because content-collections-driven pages keep the homepage metrics and deployment proof in sync instead of drifting apart.

• Per-request CSP nonces via build-time finalize chain

  Inline scripts needed to run under a strict CSP without 'unsafe-inline' on a fully static export.

• Slim CI pipeline — single install, shared browsers, deduped jobs

  Three near-identical CI jobs each ran npm ci and downloaded Playwright browsers, tripling build minutes.

• Twingate ZTNA over Tailscale for RDS remote access

  Oman ISPs fingerprinted and dropped WireGuard UDP, severing Tailscale access to the Tally Prime RDS estate.