Journal
Infrastructure
4 posts
- Self-Hosted SSO: Wiring authentik to Next.js 16 and Auth.js v5, Including the Logout That Does Not Log OutPutting an identity provider you own in front of your own applications is a weekend of work and a decade of consequences. Here is the whole mechanism — the discovery document, the id_token, the encrypted session cookie — and the single logout that Auth.js cannot perform at all.EngineeringSecurity13 min
- Self-Hosting Coolify: Migrating Real Apps, Wiring Cloudflare and What Build-on-Push Actually DoesCoolify gives you a Heroku-shaped button on a box you own. It is worth it — but only once you understand that you have not bought a platform, you have bought a generator for Docker and Traefik configuration, and it is Docker and Traefik that will page you.EngineeringDevOps13 min
- Building a Personal AI OS: File Watchers, Local IPC and Daemonised AgentsA terminal agent is a tool you visit. An AI OS is a set of small daemons that react to things happening on your machine. The difference is not the model — it is the event bus, the queue, and the discipline to keep every piece boring.AutomationAI8 min
- Hardening Agent Sandboxes: MicroVMs, gVisor and WebAssembly for Untrusted CodeAn AI agent running shell commands is an arbitrary code execution primitive you installed on purpose. Here is the isolation ladder — container, gVisor, Firecracker, WebAssembly — what each one actually stops, and what it costs per sandbox.AIAgents7 min