The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
Self-hosted GitHub Actions runners on a $10 VPS: worth it, with caveats
Running GitHub Actions on your own VPS cuts CI costs to near zero. Here's the setup I use and the gotchas that will bite you if you skip the boring parts.
GitHub's hosted runners are convenient right up until you're paying $50/month for a Laravel app with a modest test suite. I moved several client projects to self-hosted runners on a $10 DigitalOcean Droplet and cut that bill to essentially zero. The setup takes about an hour. The gotchas take longer to find. Why…
Read the daily →Stripe Metered Billing: Building a Usage Ledger That Survives Out-of-Order Webhooks
Stripe's metered billing webhooks don't arrive in order. Here's how I built an idempotent usage ledger that doesn't double-charge customers when they don't.
Stripe's metered billing is genuinely useful until the first time you realize webhooks don't arrive in chronological order — and your usage ledger has silently double-counted 40% of a customer's API calls. I learned this the hard way building a usage-based billing system for a biotech client running genomics…
Read the daily →Docker Healthchecks That Actually Mean Something
Your container says healthy. Your app is throwing 500s. Here's why that happens and how to write healthchecks that actually gate traffic.
Your container is . Your app is throwing 500s on every request. Your load balancer is happily routing traffic into the void. Welcome to the false confidence of a default Docker healthcheck. I've debugged this exact situation more than once. Most recently on a Laravel app running behind Traefik for a healthcare client…
Read the daily →SSE over nginx + PHP-FPM: the buffering problem nobody warns you about
Server-Sent Events look dead simple until nginx and PHP-FPM start swallowing your stream. Here's what actually happens and how to fix it.
Every SSE tutorial on the internet shows you the same 15 lines of PHP and calls it done. What they don't show you is the part where you deploy to a real nginx + PHP-FPM stack and your beautifully streaming events arrive in one giant blob — or not at all — because three different layers are buffering your output…
Read the daily →Laravel Sanctum SPA Auth Across Subdomains Will Bite You
Sanctum's subdomain cookie auth looks simple until CORS and session config conspire to ruin your day. Here's the config that actually works.
Sanctum's documentation makes subdomain SPA authentication look like a ten-minute job. It is not a ten-minute job. I've set this up across probably a dozen projects now — e-commerce frontends on hitting APIs on , healthcare portals, a real estate dashboard — and every single time there's a moment where the cookie just…
Read the daily →