One admin, real MFA: Keycloak TOTP for a personal site
The public pages hold nothing secret. The admin panel behind them is another matter.
Blog
Engineering notes, platform delivery, and personal brand updates.
How I ship: from git push to production in ten minutes
One delivery loop for client platforms and this site alike — and why my pipeline cancels builds instead of queueing them.
Why I killed WordPress and built my own platform
The site you are reading is a small production system — and moving to it was mostly a redirects problem.
From D to A: giving a Next.js site a real Content-Security-Policy
Nonces over allowlists, the style-src trade-off nobody mentions, and why the fonts had to move home.