English edition · 52 translated posts

A QA, trying to keep up.

Public technology notebook. I learn out loud, fail in production and share what actually works. No recycled tutorials, no snake oil.

Read the latest posts Read in Spanish

How to build an AI agent from scratch in TypeScript

Featured

7 min05/13/2026

How to build an AI agent from scratch in TypeScript

While loop, tools, stopping conditions, and budget. How to write a minimal agent in TypeScript with tool calling and no framework, so you understand what's underneath before you pick abstractions.

7 min05/12

AI wrapper vs AI agent: where the chatbot ends

Why an endpoint that forwards to OpenAI isn't a product, and when a wrapper really is enough. An operational definition of an agent and the four components that separate it from any linear call to an LLM.

10 min05/11

The silent cf-connecting-ip bug when you put Cloudflare in front of Traefik

After putting Cloudflare in front, I found that rate limiting had stopped working in several projects, and in one of them resource ownership verification had broken without anyone noticing. The cause was a single line of code that still trusted x-real-ip when it no longer should. Here's the right getClientIp pattern for Node.

9 min05/10

Docker from scratch for QA folks who don't touch infrastructure

Images, containers, volumes, and networks explained for QA. The minimum you need to know so you don't depend on DevOps.

8 min05/09

A TRMNL for VPS alerts, polling or webhook

I'm thinking about moving my infrastructure alerts to a TRMNL e-ink screen. I'm comparing the two possible paths, polling with a JSON endpoint behind Cloudflare Access, or a webhook from the timers I already have.

12 min05/08

SSH vs Cloudflare Tunnel vs Pangolin vs Tailscale vs Headscale vs WireGuard, what I use for what

I have cloudflared in production, Pangolin lined up for the home lab, Tailscale on my laptop, and SSH tunnels open several times a day. From the outside they can look like overlapping alternatives, but each one solves a different problem. Here's the decision tree I keep in my head so I don't end up with six things doing the same job.

8 min05/07

DNS-01 and AOP in Traefik: how I made only Cloudflare talk to my origin

To close port 80 to Let's Encrypt I needed to renew certs with DNS-01, and to stop any TLS connection from reaching the origin without going through Cloudflare I added Authenticated Origin Pulls. I'm going over both changes, the gotchas I ran into, and the right order when you do them in the same session.

8 min05/06

The fallacy of the absence of errors: why bug-free software can still fail

The seventh testing principle says that software with no defects can still fail. The key is testing that it solves the problem, not just that it works.

14 min05/05

Pangolin to open up the home lab to the Internet without depending on Cloudflare

After putting the VPS admin panels behind Cloudflare Tunnel and Access, it's time to deal with the other side of the network, the home lab. I don't want Home Assistant, the NAS, the cameras, and the Raspberry going through Cloudflare's edge every time I open the app on my phone. Pangolin is the self-hosted piece that does the same thing (zero open ports, identity before the first byte) but keeps the entire data path inside my own infrastructure.