Uses.

Centralizes fat-client workloads like Tally Prime on session hosts: RAID-backed VMs, connection-broker license management, GPO lockdown, and scheduled PowerShell retention jobs. Branches get an app window. Not a server to nurse.

Runs the estates documented in ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group and ~/work/rds-migration-tailscale-to-twingate.

The operational story is the certificate pipeline. A win-acme CLI setup with Cloudflare DNS-01 validation renews the RDS TLS certificates without opening port 80 or retraining users to click through warnings, with a custom PowerShell script handling the lifecycle end to end. It kept the central Tally Prime ERP at near-100% uptime. See ~/work/rds-migration-tailscale-to-twingate.

Nginx handles TLS, permalinks, and static-asset caching in front of PHP-FPM; Redis object caching takes the repeat catalog queries so MariaDB only works on writes and cold reads. OPcache on, UFW shut, Cloudflare in front.

The exact stack behind ~/work/mushtariyat. It held 99.9% uptime through sale events on a single droplet.

The formula held where it mattered: Mushtariyat kept 99.9% uptime across White Friday and Eid Al-Fitr sale windows on that single $20 droplet, and the 2023 optimization pass made it load 65% faster. Roughly two orders of magnitude cheaper than the Shopify Plus quote it replaced. See ~/work/mushtariyat.

Default remote-access fabric where the network inspects TLS. Clients dial out over TLS on 443, so there is nothing listening to probe and nothing for middleboxes to throttle by signature.

Proved out on the RDS cutover documented in ~/work/rds-migration-tailscale-to-twingate. It replaced an IPsec tunnel that could not hold through aggressive filtering.

The proof was the Oman cutover. tailscale netcheck from affected branches reported UDP: false as ISP DPI fingerprinted and dropped WireGuard handshakes, so Twingate connectors dialing out over TLS 443 restored Tally Prime ERP access through double NAT with no public IP and no inbound firewall rules. See ~/work/rds-migration-tailscale-to-twingate.

WireGuard mesh with identity-based ACLs: an inventory scanner reaches one port on one host, never the whole subnet. New branches onboard with an install. Not a hardware shipment.

Carries the 10-branch retail network documented in ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group.

The mesh replaced Sophos and Cyberoam hardware VPNs that dropped connections regularly, eliminating roughly $2,500 a year in proprietary hardware support and licensing. Prometheus scrapes confirm the result, with 10/10 branch targets up. New branches are now a software install, not a hardware shipment. See ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group.

Supplier feeds arrive as gigabyte XML nobody validated. A pre-processor normalizes the dialect, then lxml.etree.iterparse streams elements while Pandas handles the aggregation frame. Constant memory regardless of feed size.

The pipeline pattern behind ~/work/inventory-forecasting-tool.

The canonical input was a 1.8 GB Tally XML export the supply-chain team used to wrangle through crashing Excel sheets. The run log shows parsing the full dump, then fitting Prophet per SKU with 8 workers until all 7,800 models converged. Stockouts and tied-up capital became a CSV replenishment plan. See ~/work/inventory-forecasting-tool.

Prophet fits seasonality per SKU without a feature store; SQLite holds the models and forecast tables in a single file that backs up with a copy. No cluster, no serving layer. A cron job and a CSV.

Forecasts the catalog in ~/work/inventory-forecasting-tool.

At scale that meant 7,800 Prophet models converging over a 782,904-row sales velocity frame. A sequential run projected at over 18 hours came down to hours with multiprocessing across physical cores. The pipeline cut the supply-chain planning cycle from days to hours. See ~/work/inventory-forecasting-tool.

Primary automation language for Windows Server, RDS and Hyper-V estates. Nothing clever, just scripts I can re-run.

I default to declarative, idempotent scripts: re-running one should be a no-op, not a new incident. This has paid off most on RDS session-host provisioning and on the Tally Prime ERP migration documented in ~/work/rds-migration-tailscale-to-twingate. Two places where a second run used to mean a second ticket.

The same discipline runs the 14-day rolling backup cleanup on a Task Scheduler. A retention script keeps the newest 14 Tally Prime dumps and removes the rest, so re-running the job is a logged no-op rather than a surprise. See ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group.

Every deploy passes an empty-DB protection gate (fewer products than expected blocks the landing) plus staleness monitors on the price pipeline. Vitest covers the scoring math. Playwright walks the checkout-critical paths.

Guards the operations story in ~/work/tweakdeals.

Those gates exist because of real forensics: a DATABASE_URL once baked into a Worker bundle and truncate-capable scripts led to a two-signal restore gate, re-applied forensics triggers, and a mid-run circuit breaker in the scoring pipeline. So “the database is empty” is now a boring blocked deploy, not an incident. See ~/work/tweakdeals.

Static HTML from the edge, live prices rehydrated from a micro-API in the browser. When the database disappears, the committed prebuild cache degrades the site to stale data instead of a blank page.

Serves ~/work/tweakdeals, including through every 2026 database incident. I learned this the hard way: with a roughly 14 MB prebuild cache of about 2,200 products committed to the repo, every 2026 database incident degraded TweakDeals to prices a few hours stale instead of a blank page. Static-first delivery turned outages into staleness problems. See ~/work/tweakdeals.

Branch-per-deploy Postgres with scale-to-zero: migrations run through Prisma in Node, while edge Workers talk to it over HTTP with parameterized raw SQL. Backups and point-in-time restore come with the platform. One less thing I maintain.

Stores the price history behind ~/work/tweakdeals.

In production Neon holds the Product, PriceLog, CronRun, and DeadLetterQueue tables behind the catalog. The poller is built around its limits: it counts down API quota on every run, and failed scrapes land in the dead-letter queue with exponential backoff instead of throwing the batch away. See ~/work/tweakdeals.

Content collections for typed Markdown/MDX, zero JavaScript by default, Tailwind for the terminal aesthetic. Interactive pieces hydrate as islands. Everything else ships as HTML.

Builds this site and the gallery case study in ~/work/spilled-palette-studio.

On this site the pattern pays off in the homepage metrics strip: every metric shown is declared in a work entry’s frontmatter, so updating ~/work updates the homepage instead of drifting from it. Content collections as the single source of truth. See src/pages/index.astro.