Moving this site from Hugo to Astro with AI
The site had been stuck on an old Hugo for years. Splitting the move into eleven tasks and giving each one to an agent got it done in an afternoon.
Articles
Everything published here, newest first.
2026
Renaming a k3s node is not a cosmetic change
I renamed four nodes because the old domain annoyed me. The cluster stayed green for weeks while sitting one reboot away from losing every worker.
Overriding one name in a public domain without breaking the domain
A single internal zone for the domain makes the resolver authoritative for all of it, so mail and the public site start returning NXDOMAIN to everyone in the house.
A name should say what something is, not where it runs
I counted seven naming shapes on my own network for the same kind of thing, and one of the suffixes meant two different backends depending on which name you picked.
My Pi-hole had not been blocking ads for most of the network
An adlist with no group assignment applies to no client. Mine had 93,516 domains in it and had been doing nothing for as long as it had been there.
dnsmasq answers on the interface, not on the address
The gateway pings from inside the container and its DNS never answers. I got the diagnosis wrong twice, and the second time it was my own test that was lying.
A UniFi firmware update wipes everything except /data
My container had been dead since the last flash, because the flash took /usr and /var with it. The boot hook that puts it back cannot download anything.
Technitium DNS in a container on a UDM Pro Max
The UDM runs Debian and systemd, so it can run an nspawn container. What it cannot do is let that container talk to the router it is attached to.
Typed resources for every AWX credential type
A generic credential resource works, and it puts the whole burden of knowing what goes inside on whoever writes the terraform.
An empty AWX instance describes an incomplete API
AWX hides POST on endpoints you have nothing to create against, so an empty instance hands back a schema that looks fine and is missing half its fields.
Kubernetes registry credentials that expire on their own
A GitLab deploy token in an imagePullSecret is a long-lived credential sitting in a namespace, and it does not have to be.
What a GitLab token can be depends on which GitLab you ask
Access levels arrive in GitLab releases, so validating them without knowing the version gets you a plausible error at the wrong time.
Generics and hooks in a generated terraform provider
Every AWX quirk used to mean another branch in a template. Now it's a field on a config struct.
AWX returns $encrypted$ and terraform stops trusting you
The most reported bug in the AWX provider was never really a bug in the provider.
2025
Go templates as the source of a terraform provider
The AWX API describes every resource, so the provider is thirteen templates and a config file that says where the description lies.
2024
Configuring the thing that makes tokens needs a token
The GitLab secrets engine needs a GitLab token to start, which makes provisioning it from terraform more awkward than it looks.
One provider, many AWX versions
AWX changes its API between releases, so the provider has to know which release it was generated from.
2023
Generating a terraform provider from the AWX API
AWX describes its own resources if you send it an OPTIONS request, so writing the schemas by hand was work I did not need to do.
A Vault secrets engine for GitLab tokens
GitLab tokens live in CI variables for a year at a time, and nobody remembers which ones are still there.
2022
Writing a terraform provider for AWX
AWX has a perfectly good API, but managing it by hand stops scaling the moment more than one person touches it.