Articles

Notes from the practice — on sovereign infrastructure, headless CMS, federal DevSecOps, and the architecture decisions behind them. Written for the engineers and buyers who have to make these systems work.

Latest articles

Your service account's roles are not the roles it uses

One missing field takes down every page that asks for it

The draft preview that showed you the published page

Config-as-code with Config Split: never cex what a split is hiding

The composer.lock that only builds on your machine

The deploy that couldn't recreate its own container

Field access can't see the incoming value: govern Drupal writes with a validation constraint

A status endpoint that's coarse in public, detailed in private

The redirect loop that only happens behind HTTPS

The Two-Phase Pattern for Removing a Drupal Module Without Breaking Deploys

The claim you can drop: an HMAC canonicalization lesson

Why a Next.js Middleware Rewrite Returns 500 Behind a Reverse Proxy

Infrastructure-as-Code for Government: Why It Matters and How to Start

What "Sovereignty" Actually Means in Federal IT

Why Federal Agencies Are Moving to Headless Drupal