$ cat ~/tags/infrastructure — 12 entries
The unified-infrastructure case claims Prometheus and Grafana observability — this is the architecture behind the claim: what gets scraped, what the dashboard shows, what fires alerts, and the one blind spot the design still carries.
Pure synthesis, no new numbers: the $2,500/yr VPN saving, the $20 droplet vs $2,000 SaaS quote, the $20/mo KV line deleted, and the zero-bill pipelines — each linked to its proof.
The RDS cutover posts cover the migration night — this is what operating it looks like after: session-broker license management, timeout policies at peak hours, the 60-day certificate cycle, and the connector you still have to watch.
Twice in 2026 the TweakDeals database was emptied from under the site — in August, 2,544 products at 10:32 UTC were zero by 11:05. Forensics, guards, and the prebuild cache that saved the site.
Vercel KV cost me $64 in idle months and caused one 26-minute connection-pool outage. I moved the fast path to a per-process sliding window and the durable counters to Postgres — $20/month to zero, and p99 latency on /api/search from 310 ms to 12 ms.
Twingate routed RDS traffic fine — then RD Gateway rejected every session on certificate subject-name mismatch. The fix: win-acme DNS-01 plus one PowerShell script binding all four RDS roles every 60 days.
How I replaced a patchwork of cron jobs, scripts, and notifications with a single autonomous AI agent that handles infrastructure monitoring, code deployments, and operational workflows — running 24/7 on a MacBook Air.
Every push to an MR branch ran two GitLab pipelines and every Playwright job downloaded its own Chromium. Commit 1f3a658 fixed all three with workflow rules, lockfile-keyed caching, and a shared browser artifact — here is the exact diff and what it cannot prove.
vercel deploy --prebuilt reads .vercel/output/config.json, not vercel.json — so six redirect rules silently stopped firing and /syslog answered 404. Commit 4e238be re-emitted them as routes[] entries, and 19d1b23 taught the probes about trailing slashes. Real code, real ordering constraints.
Five scripts carry one UUID from mint to production header — scripts/generate-csp.mjs, inject-nonce.mjs, finalize-csp.mjs, csp-check.mjs, verify-prod-csp.mjs. Two production incidents drew the map; the pipeline diagram in this post is the repo's own chain.
scripts/generate-build-info.mjs hashes every content file into src/generated/build.json before astro build; Footer.astro, status.astro, and api/health.ts all read that one file — counts never drift because there is exactly one place they can come from.
A decade of leading IT initiatives in Oman — ERP migrations, AI deployments, Zero Trust adoption. Here are the hard-won strategic insights that actually translate to business value.