Blog

PKCE is 80% of a secure SPA login in an afternoon. The other 20% — token storage, Cognito's opinions, and a brutal race condition where the verifier got wiped before the callback page even mounted — is where the time actually goes. The specific bugs, with the fix.

When you're the only engineer, your infrastructure has to be as legible as your application code — because future-you is the only person who can fix it. How I structure Terraform across Tourismo and Addris: modules, environments, remote state, and OIDC-based CI that holds no AWS keys.

Addris ingests every property sale, planning application and transport stop in Ireland, geocodes it, and answers map queries in milliseconds. The ingestion pipeline has no server running between jobs. Here's the architecture, the PostGIS at the centre of it, and the trade-offs of going fully event-driven.

If you share a drive that starts in your driveway, you've just published your home address. Tourismo's Privacy Zones trim the sensitive ends off a GPS track in the browser, before a single coordinate leaves the device. Here's how it works and why the default matters.

DynamoDB was the right call for a serverless PWA built by one person. But single-table purity is a trap, and a few of my access patterns wanted a relational database the whole time. An honest post-mortem of the data layer behind Tourismo.

AI, and Claude in particular, is changing how software gets designed in every industry, not just tech. I'm all for it. But here's why you still need experienced engineers steering the ship.

A while back I promised a full write-up of this site once it was rebuilt. Here it is, what I tore out, what I put in, and why I went with boring, static and version-controlled over clever.

Seventh time is the charm. Why I rebuilt my blog site for the 7th time and it's only the beginning.