Posts

GitOps has a famously awkward edge case: you want everything in Git, but you can’t commit a plaintext database password to a repository. The usual workarounds — a separate secrets manager, a wall of kubectl create secret commands, a shared password vault that nobody keeps in sync — all break the “Git is the source of truth” promise. SOPS (Secrets OPerationS) and age solve this neatly. Together they let you commit encrypted secrets straight into Git, review them in pull requests, and decrypt them only where they’re needed. ...

If you have ever juggled nvm, pyenv, rbenv, a pile of .env files, and a Makefile in the same project, mise (pronounced “meez”, short for mise-en-place) is worth a look. It replaces all of them with a single tool and a single mise.toml config file. In this post I’ll introduce the three major concepts that make mise useful day to day: Dev tools — install and switch between runtimes like Node, Python, and Go. Environments — load the right environment variables per directory. Tasks — a built-in task runner for builds, tests, linting, and scripts. Then I’ll walk through a small but fully runnable example that ties all three together. ...

This post walks through how I deploy my personal static blog using Hugo, the PaperMod theme, GitHub, and Cloudflare Workers. A note on Workers vs. Pages: Cloudflare is consolidating static site hosting from Cloudflare Pages into Cloudflare Workers. As of 2025, Workers Static Assets is the recommended way to host new static sites, and Pages is in maintenance mode. In the dashboard both still live under the unified Workers & Pages section, which is why the deploy commands below use wrangler deploy (a Workers command) rather than the older Pages workflow. ...