Engineering articles from software I build and maintain. Each one comes from a decision, a mistake or an experiment, and I publish when I have something specific to say.
A technical publication
I write about software architecture, data integrity, security, deployment and product engineering through the systems I build. Each article should give a reader something concrete: a model to inspect, a failure to avoid or a tradeoff to evaluate. Shorter observations belong in notes.
Software Engineering · · 6 min read
Submify is an open-source form backend: post JSON with an API key, store in your own PostgreSQL, export XLSX or PDF, upload files to your S3 storage and get Telegram alerts.
Read article: A self-hosted form backend API with PostgreSQL, presigned uploads and Telegram alerts: SubmifySoftware Engineering · · 3 min read
A practical comparison of automated AI review and human review: what AI catches, what it misses, how to combine them, and a setup that keeps review honest.
Read article: AI code review vs human code review: what each one is good atSoftware Engineering · · 3 min read
Vibe coding means accepting what an AI writes without reading it. Engineering with AI means you still own the design, tests and review. How to tell which one you are doing.
Read article: Vibe coding vs vibe engineering: where the line isSoftware Engineering · · 3 min read
What AI coding tools change about the job, which tasks shrink, which grow, and what to practise if you write software for a living or want to start.
Read article: Will AI replace developers? A grounded answer from someone who ships softwareSoftware Engineering · · 3 min read
How to enable row-level security in PostgreSQL, write policies, avoid the superuser and table-owner bypass, keep it fast with indexes, and test it properly.
Read article: PostgreSQL row-level security: a practical guide with policies and pitfallsSoftware Engineering · · 3 min read
A step-by-step way to find why a PostgreSQL query is slow: read EXPLAIN ANALYZE, spot sequential scans, bad estimates, missing indexes, bloat and lock waits, then fix the cause.
Read article: Why is my PostgreSQL query slow? A checklist that starts with EXPLAINSoftware Engineering · · 3 min read
Why PostgreSQL struggles with many connections, how application and external pools differ, PgBouncer's pool modes, and the settings that cause real outages.
Read article: PostgreSQL connection pooling: why you need it and how PgBouncer worksSoftware Engineering · · 3 min read
The main differences between PostgreSQL 18 and 17: asynchronous I/O, UUIDv7, skip scan for B-tree indexes, virtual generated columns, OAuth login and a safe upgrade plan.
Read article: PostgreSQL 18 vs 17: what changed and whether to upgradeSoftware Engineering · · 3 min read
Scraping public web pages is not automatically illegal, but copyright, contract terms, data protection law and computer misuse rules can all apply. A plain overview with practical rules.
Read article: Is web scraping legal? What the law and site terms usually saySoftware Engineering · · 3 min read
The Go concurrency patterns you use in real programs: worker pools, fan-out and fan-in, errgroup, context cancellation, mutexes and how to avoid goroutine leaks and data races.
Read article: Go concurrency patterns: goroutines, channels, worker pools and contextSoftware Engineering · · 3 min read
A learning path for Go aimed at backend work: setup, the language features you need, a small HTTP API with PostgreSQL, tests, and the mistakes beginners make.
Read article: Go for backend beginners: a practical path from zero to a working APISoftware Engineering · · 3 min read
Options for handling form submissions from a static or Jamstack site: hosted form services, serverless functions, and a self-hosted form backend, with spam protection and privacy notes.
Read article: Formspree alternatives and self-hosted form backends: how to handle contact forms
Architecture · · 6 min read
Why Rechvix updates its stock balance projection in Go inside the same transaction as the movement insert, what that costs, and how the risk is contained.
Read article: Stock balances belong in application code, not a database triggerArchitecture · · 3 min read
Shared tables with a tenant ID, schema per tenant, and database per tenant: how each works, what each costs in operations, and which to pick for a small SaaS.
Read article: How to build a multi-tenant SaaS on PostgreSQL: three models comparedArchitecture · · 3 min read
Event sourcing stores every change as an immutable event and derives current state by replaying them. How it works, where it fits, and where it hurts.
Read article: What is event sourcing? A clear explanation with a bank account exampleArchitecture · · 3 min read
What a modular monolith is, how it compares with microservices on deployment, data, team size and failure modes, and the signs that tell you when to split.
Read article: Modular monolith vs microservices: what to build firstArchitecture · · 7 min read
How idempotency keys, database constraints and an outbox make invoice posting safe when a browser or service retries a request.
Read article: A timed-out invoice request should not create a second invoice
Enterprise Systems · · 5 min read
A concrete pricing model from NodeDR POS: derive the tax portion from the shelf price, keep the server authoritative and test rounding at receipt level.
Read article: Calculating GST from an inclusive MRP in a retail POSEnterprise Systems · · 7 min read
Rechvix is self-hosted GST billing, inventory and accounting software built on a double-entry ledger. How a single invoice updates stock, tax and accounts atomically, and what that costs.
Read article: Open-source GST billing and accounting software with a double-entry ledger: how Rechvix worksEnterprise Systems · · 6 min read
NodeDR POS is a self-hosted retail point of sale for Indian shops. How it bills GST-inclusive MRP correctly, tracks customer credit and keeps working with no internet.
Read article: Offline retail POS software for India: GST-inclusive MRP billing, udhaar and barcode checkoutEnterprise Systems · · 6 min read
KinetiRx is self-hosted pharmacy and clinic software with batch and expiry tracking, GST billing, patients, dues, OPD scheduling and cash-drawer reconciliation on a database you control.
Read article: Pharmacy management software with batch and expiry tracking, billing and OPD: KinetiRxEnterprise Systems · · 6 min read
Zulivio is self-hosted workforce software with employee records, attendance as a state machine, guarded work assignments and a sales CRM. How its rules, roles and sessions are designed.
Read article: Self-hosted employee attendance, work assignment and CRM software: how Zulivio models workflowEnterprise Systems · · 6 min read
How NodeDR Construction ERP models the material lifecycle: requisition, approval, purchase order, goods receipt, inventory ledger and consumption against milestones, with fine-grained roles.
Read article: Construction ERP for material procurement: from site requisition to daily consumptionEnterprise Systems · · 3 min read
What a point of sale system should do, the questions that separate good from bad, hidden costs in fees and hardware, offline behaviour, tax handling and a short list of tests before you buy.
Read article: How to choose a POS system for a small business: a buyer's checklistEnterprise Systems · · 3 min read
A framework for comparing Toast, Square and Clover on pricing structure, hardware, payments lock-in, restaurant features, offline mode and contracts, without relying on prices that change.
Read article: Toast vs Square vs Clover: how to compare restaurant and retail POS systemsEnterprise Systems · · 3 min read
Compare cloud and on-premise point of sale on internet dependence, cost, control, security, updates and failure behaviour, and why many businesses want a hybrid.
Read article: Cloud POS vs on-premise POS: which is better for a shop or restaurant?Enterprise Systems · · 3 min read
A buyer's guide to GST billing and accounting software: invoice rules, e-invoicing, e-way bills, returns, inventory, multi-branch support, data ownership and common mistakes.
Read article: GST billing software for small businesses: what to look for in IndiaEnterprise Systems · · 3 min read
What a valid GST tax invoice must contain, how invoice numbers work, HSN and SAC codes, place of supply, CGST SGST IGST split, when to use a bill of supply, and common errors.
Read article: GST invoice requirements: a field-by-field checklist for IndiaEnterprise Systems · · 3 min read
How Tally, Vyapar and Zoho Books differ by deployment, accounting depth, ease of use, GST features, inventory and data ownership, with a framework to pick for your business.
Read article: Tally vs Vyapar vs Zoho Books: choosing accounting and billing software in IndiaEnterprise Systems · · 3 min read
How billing and inventory should work together: stock movements, valuation methods, batches, multi-warehouse, negative stock, returns, and a test plan that catches mismatches before they cost money.
Read article: Billing software with inventory: what to check so stock and accounts agreeEnterprise Systems · · 3 min read
How to pick a CRM when you have a small team: the features that matter, what to skip, free tiers and their limits, alternatives to HubSpot and Salesforce, and self-hosted options.
Read article: Best CRM for a small business: how to choose, and HubSpot and Salesforce alternativesEnterprise Systems · · 3 min read
CRM manages customers and sales. ERP manages the operations behind them: finance, inventory, purchasing and production. The differences, overlaps and the order to adopt them.
Read article: ERP vs CRM: what each one does and which you need firstEnterprise Systems · · 3 min read
What construction ERP and project accounting software includes, from requisition to material consumption and budgets, how pricing is structured, and questions for vendors.
Read article: Construction ERP: what it costs, what it should do, and how to chooseEnterprise Systems · · 3 min read
When a small business outgrows spreadsheets and accounting software, what ERP modules actually matter, cloud versus self-hosted, hidden costs, and a safe adoption plan.
Read article: ERP software for small business: do you need one, and how to pickEnterprise Systems · · 3 min read
What pharmacy software must do: batch and expiry tracking, FEFO selling, schedule drug records, GST billing, patient and due management, returns and backups, with questions for vendors.
Read article: Pharmacy management software: a checklist for batch, expiry and billingEnterprise Systems · · 3 min read
How to choose attendance, leave, shift and work assignment software for a small or mid-size company: methods of tracking, rules, mobile and offline use, payroll links and privacy.
Read article: Attendance and workforce management software: what a small company needsEnterprise Systems · · 6 min read
A practical model for timestamps, branch time zones and close-of-day reports in multi-branch business software.
Read article: A business day is not always a calendar date in the server's time zone
Forward Deployed Engineering · · 3 min read
Forward deployed engineers work directly with customers to fit software to their real operations. What they do day to day, the skills involved, and how the role differs from consulting and support.
Read article: What is forward deployed engineering? The job, the skills and how it differs from support
AI · · 4 min read
An MCP server is a small program that exposes tools, data and prompts to an AI application over the Model Context Protocol. What it is, how it differs from an API, and when you need one.
Read article: What is an MCP server? A plain explanation with a real exampleAI · · 3 min read
Build a working Model Context Protocol server with one tool in about forty lines of TypeScript, test it, connect it to a client, and avoid the mistakes that waste an afternoon.
Read article: How to build an MCP server in TypeScript, step by stepAI · · 3 min read
The recurring reasons LLM agents break after the demo: compounding errors, bad tools, lost context, cost loops and missing evaluation. Fixes you can ship.
Read article: Why AI agents fail in production, and what to build around themAI · · 3 min read
LLM observability means recording enough about every model call to debug, evaluate and cost it. What to capture, what to redact, and how to start with a table and a few queries.
Read article: What is LLM observability, and what should you log?AI · · 3 min read
Where LLM spend actually comes from, how to attribute it to features and users, the alerts worth setting, and the changes that reduce a bill without hurting quality.
Read article: How to monitor and cut LLM costs in productionAI · · 3 min read
A comparison of terminal agents, AI editors and inline assistants by workflow, control, cost model and fit for different kinds of work, without pretending one wins everywhere.
Read article: Claude Code vs Cursor vs GitHub Copilot: how to chooseAI · · 3 min read
How to give a coding agent a short specification, a task list and acceptance tests so it builds what you meant, with a template you can copy.
Read article: Spec-driven development with coding agents: write the spec firstAI · · 3 min read
Run an open-weight language model on your own machine or server with Ollama, call it from code, size the hardware, and decide whether self-hosting beats an API.
Read article: How to self-host an LLM with Ollama, and when it makes senseAI · · 3 min read
A working Docker Compose setup for self-hosted n8n with PostgreSQL, HTTPS behind a reverse proxy, the environment variables that matter, and how to back it up.
Read article: How to self-host n8n with Docker Compose and PostgreSQLAI · · 3 min read
How the three differ in pricing model, hosting, flexibility and learning curve, with a decision guide for small teams, developers and anyone worried about data location.
Read article: n8n vs Zapier vs Make: which automation tool fits which job
DevOps · · 6 min read
How I test a Rechvix backup in a scratch database, check business invariants and document the recovery procedure instead of trusting a successful archive command.
Read article: A PostgreSQL backup is only useful after a restore drillDevOps · · 3 min read
Build a working CI pipeline that tests every push and a CD step that deploys to a server over SSH, with caching, secrets, protected environments and rollback.
Read article: How to set up a CI/CD pipeline with GitHub Actions, step by stepDevOps · · 3 min read
A practical Docker Compose guide: services, volumes, networks, environment files, health checks, depends_on conditions, profiles, common commands and mistakes to avoid.
Read article: Docker Compose in practice: a guide to the parts you use every dayDevOps · · 3 min read
A clear Kubernetes introduction covering pods, deployments, services and ingress, what problems it solves, what it costs in complexity, and simpler alternatives for small teams.
Read article: Kubernetes for beginners: what it is, and whether you need itDevOps · · 3 min read
Terraform provisions infrastructure, Ansible configures machines, and Argo CD keeps Kubernetes in sync with Git. How they differ, where they overlap and when you need more than one.
Read article: Ansible vs Terraform vs Argo CD: three tools for three different jobsDevOps · · 3 min read
Argo CD and Flux both sync Kubernetes from Git. Compare their interface, architecture, multi-tenancy, Helm and Kustomize support, and which suits small and large teams.
Read article: Argo CD vs Flux: choosing a GitOps tool for KubernetesDevOps · · 3 min read
Build a tiny multi-stage Docker image for a Go service, run it as a non-root user, add health checks, use Compose with PostgreSQL, and decide when Kubernetes is worth it.
Read article: Deploying a Go app with Docker: a small, safe image and a Compose file
Networking · · 3 min read
How Let's Encrypt renewal works, why it silently fails, how to check expiry, and how to set up Caddy, Certbot or a DNS challenge so your certificates renew without you.
Read article: SSL/TLS certificate renewal for self-hosted sites: how to stop expiry outagesNetworking · · 3 min read
A reverse proxy sits in front of your apps, handles HTTPS and routing, and hides the servers behind it. How it works, why you want one, and how Nginx, Caddy and Traefik differ.
Read article: What is a reverse proxy? Nginx, Caddy and Traefik comparedNetworking · · 3 min read
What each DNS record type does, how to point a domain at your server, why TTL matters, how to set up email records, and commands to check what the world sees.
Read article: DNS records explained for self-hosters: A, AAAA, CNAME, MX, TXT and moreNetworking · · 3 min read
Compare opening ports on your router with an outbound tunnel. Security, CGNAT, performance, limits and privacy trade-offs, plus WireGuard and Tailscale as alternatives.
Read article: Cloudflare Tunnel vs port forwarding: how to expose a home serverNetworking · · 3 min read
Offline-first apps treat the local device as the primary data store and sync when a connection exists. Core patterns, conflict handling, pitfalls and where it matters, such as retail and restaurants.
Read article: What is offline-first software? How it works and when to build it
Cybersecurity · · 7 min read
I read every repository in Rechvix and found thirteen lookups that relied on PostgreSQL row-level security alone. Here is what I changed and why the role design matters.
Read article: Row-level security is not your only tenant boundaryCybersecurity · · 4 min read
How attacks on Model Context Protocol servers work, why a read-only tool can still exfiltrate data, and a short checklist for running MCP servers safely.
Read article: MCP security: how prompt injection turns a helpful tool into a leakCybersecurity · · 3 min read
Prompt injection is an attack where text a model reads changes what it does. Direct and indirect examples, why it is hard to stop, and defences that hold up.
Read article: What is prompt injection? Examples, why it works, and what helpsCybersecurity · · 3 min read
Vibe-coded apps repeat the same security mistakes: missing authorisation, exposed secrets, trusting the client, unsafe dependencies. A checklist to catch them before launch.
Read article: Is vibe coding safe? The security problems that show upCybersecurity · · 3 min read
Server-side sessions and JSON Web Tokens compared on revocation, scaling, storage, CSRF and XSS risk, with a clear recommendation for typical web apps.
Read article: JWT vs session cookies: which should you use for authentication?Cybersecurity · · 3 min read
OAuth 2.0 delegates access, OpenID Connect adds login on top of it, and SAML does single sign-on for enterprises. How they differ and which to implement.
Read article: OAuth vs OpenID Connect vs SAML: what each one is forCybersecurity · · 3 min read
SQL injection is prevented by never building queries from strings. Parameterised queries in Go, Node and Python, safe handling of dynamic identifiers, least-privilege roles and testing.
Read article: How to prevent SQL injection: parameterised queries and what else to checkCybersecurity · · 3 min read
How attackers target developers through look-alike and hallucinated package names, malicious install scripts and compromised maintainers, and the habits that reduce the risk.
Read article: AI coding agents and supply chain attacks: fake packages and what to checkCybersecurity · · 3 min read
Docker is safe enough for production when you follow a handful of rules: non-root users, a minimal image, no exposed socket, pinned images, limited capabilities and updated hosts.
Read article: Is Docker safe for production? Settings that matterCybersecurity · · 3 min read
A practical order of operations for securing a self-hosted server: SSH keys, firewall, updates, a reverse proxy with TLS, backups, monitoring and keeping admin panels off the internet.
Read article: Self-hosting security: a hardening checklist for a home server or VPSCybersecurity · · 3 min read
How to harden Nginx, Caddy or Traefik as the front door of a self-hosted setup: HTTPS, security headers, rate limiting, request size limits, hiding versions and protecting admin paths.
Read article: Reverse proxy security: TLS, headers, rate limits and what not to exposeCybersecurity · · 6 min read
How business software should record who changed important records while keeping diagnostic logs useful and privacy-conscious.
Read article: An audit trail and an application log answer different questions
Infrastructure · · 6 min read
Design consequences of running a restaurant system on the restaurant's own network, including a Secure-cookie trap that makes login look successful and then fail.
Read article: What changes when the internet is optional: notes from building OrderRestroInfrastructure · · 7 min read
OrderRestro is an open-source restaurant POS with tables, kitchen display, reservations, QR ordering and loyalty that runs on the restaurant's own network. How it is built and why.
Read article: Self-hosted restaurant POS with a kitchen display that keeps working offline: OrderRestroInfrastructure · · 3 min read
A complete checklist for running your own apps: hardware or VPS, backups, domains and DNS, HTTPS, updates, monitoring, secrets and an exit plan. Use it before you move real data.
Read article: The self-hosting checklist: what to set up before you run anything importantInfrastructure · · 3 min read
When running your own software beats a subscription and when it does not, including the hidden costs in time, security and availability, and a simple test for deciding.
Read article: Is self-hosting worth it? An honest look at time, money and riskInfrastructure · · 3 min read
How to compare the real three-year cost of self-hosting and a subscription, including server, backup, time, risk and growth, with a worked example and a template.
Read article: Self-hosted vs SaaS: a cost comparison you can reproduceInfrastructure · · 3 min read
A calm recovery sequence when a self-hosted app loses data: stop writing, preserve what is left, find the real backup, restore to a side copy, verify, and fix the cause.
Read article: Recovering from self-hosted data loss: what to do in the first hourInfrastructure · · 6 min read
A practical choice between polling, SSE and WebSockets for restaurant screens, job status and business dashboards, including reconnect behavior.
Read article: WebSockets or server-sent events? Start with the direction of the conversation
Product Engineering · · 3 min read
A fair comparison of Next.js and WordPress on cost, speed, editing, security, SEO, maintenance and developer skill, with a decision guide for small businesses and developers.
Read article: Next.js vs WordPress: which to use for a business websiteProduct Engineering · · 3 min read
A plain breakdown of what you pay for: domain, hosting, design, development, content, maintenance and marketing, with ranges by approach and a list of costs people forget.
Read article: How much does a small business website cost? What drives the priceProduct Engineering · · 3 min read
SEO targets search rankings, AEO targets direct answers, GEO targets citations in AI-generated responses. What overlaps, what is new, and the steps that help with all three.
Read article: SEO vs AEO vs GEO: the difference, and what to do about eachProduct Engineering · · 3 min read
Practical steps that make your site more likely to be used and cited by AI assistants: crawl access, clear answers, original data, entity clarity and third-party mentions, plus how to check results.
Read article: How to get cited by ChatGPT, Perplexity and Google's AI answersProduct Engineering · · 3 min read
Many good products fail because nobody hears about them. How to find your first customers, test demand before building, and design distribution into the product from the start.
Read article: Why nobody uses your product: distribution before featuresProduct Engineering · · 6 min read
A practical way to design approval workflows that preserve who requested, reviewed and changed a business record.
Read article: Model approvals as state transitions, not a chain of buttonsHave something in mind?
Tell me about the idea, product, or workflow you’re working through.