GitHub Actions Self-Hosted Runner on Linux: Setup Guide
When my GitHub Actions minutes ran out, I made a Linux server a self-hosted runner: dedicated user, SHA256 check, systemd, labels and security trade-offs.
#security
Posts
Security and API Fixes in Open Source: 3 Pull Requests
A Cypher injection in LightRAG, a wrong enum value in the OpenAI Python SDK and hardcoded decimals in Coinbase AgentKit: three PRs, how each ended, and why.
Adding Lookaround to Google RE2: A Proof of Concept
My fork that adds bounded lookaround to Google RE2 without backtracking, the #585 issue I opened, and what EPFL's unbounded lookbehind work showed me.
Python Email Automation: smtplib, aiosmtplib and SPF
Python email automation done right: EmailMessage, smtplib with app passwords, aiosmtplib for batches, Jinja2 templates, and SPF, DKIM and DMARC for delivery.
MinIO Object Storage After the Community Edition Ended
Object storage with MinIO: stateless apps, boto3 and presigned URLs, erasure coding, object lock, and what to run now that the community edition is archived.
Nginx Load Balancing, Caching and Hardening Guide
Nginx as reverse proxy and load balancer: micro-caching, rate limiting, HTTP/2 and HTTP/3, security headers and JSON logs. A practical guide for nginx 1.30.
Kubernetes Container Orchestration: A Production Guide
What to get right before running Kubernetes in production: resources and QoS, probes, CrashLoopBackOff debugging, Gateway API, Secrets, HPA and pod security.
Python Image Processing: Pillow or OpenCV?
Image processing in Python with Pillow 11+ and OpenCV 4.x: safe uploads, EXIF rotation, WebP, headless OpenCV in Docker and a background processing pipeline.
API Authentication Strategies: JWT, OAuth 2.1, Passkeys
API authentication strategies by caller: storing API keys safely, JWT pitfalls, OAuth 2.1 with PKCE, passkeys, mTLS between services, and FastAPI dependencies.
Python PDF Processing: pypdf, pdfplumber and WeasyPrint
Read, split, merge, encrypt and generate PDFs in Python: pypdf, pdfplumber for tables, WeasyPrint for HTML to PDF, OCRmyPDF for scans and pyHanko for signing.
GitHub Actions CI/CD Pipeline for a Python Project
A GitHub Actions CI/CD pipeline for Python: tests with uv, Docker images on GHCR, approval-gated deploys, reusable workflows, OIDC and security hardening.
Building a Reliable Webhook Handler in Python
A reliable webhook handler in Python and FastAPI: HMAC signature checks, replay protection, a durable inbox table, idempotent processing and event fan-out.
API Rate Limiting in Python with Redis, Lua and FastAPI
API rate limiting in Python: token bucket vs sliding window, an atomic Redis Lua limiter, a FastAPI dependency, 429 with Retry-After, and client-side backoff.
Traefik v3 Reverse Proxy with Automatic SSL on Docker
A practical Traefik v3 setup for Docker: label-based routing, automatic Let's Encrypt SSL, middlewares, sticky sessions, canary releases and v2 migration traps.
Solana Program Development with Rust and Anchor 1.x
Solana program development with Rust and Anchor 1.x: accounts, PDAs, constraints, tests, security, and where Proof of History stands after Alpenglow.
Web3 Wallet Integration: EIP-6963, Ethers v6 and Reown
Web3 wallet integration today: EIP-6963 wallet discovery, ethers v6 BrowserProvider, chain switching, Reown AppKit for mobile, Sign-In with Ethereum.
Flash Loan Arbitrage Bot: Lessons From My Python Prototype
DEX arbitrage with Aave V3 flash loans: what my Python bot did and didn't do, a Solidity contract that enforces profit on-chain, and mainnet fork tests.
How a DEX Aggregator Works: Quotes, Routing, Contracts
The parts of a DEX aggregator: Uniswap V2/V3 quotes with ethers v6, gas-adjusted comparison, split routing, a safe swap contract and MEV protection.
Solidity Security and Gas Optimization: A Practical Guide
Reentrancy, access control, proxy pitfalls, oracle manipulation and gas optimization in Solidity 0.8 with OpenZeppelin 5, plus Foundry tests and a checklist.
NFT Minting on Ethereum: ERC721A, Merkle Allowlist, Tests
An allowlist NFT contract with ERC721A and OpenZeppelin 5: Merkle proofs, IPFS metadata, Foundry tests, an ethers v6 mint button and a Sepolia deploy.
