Abstract Software Factory
I build to learn. Each project ships with a decision record: what I chose, on what basis, and why.
Field notes
Readable Tags, Verified Digests
Developers name images by tag, but a tag can be repointed without anyone noticing. One pipeline signs and attests the image; another, given only the tag, resolves, verifies and runs the exact digest. It worked.
In the Squared Circle
A striking exchange read as a movement problem: preparation, entry, adjustment, exit. The lens does not fight for you; it makes you name the problem first, relative to the opponent, then pick the phase where your strength meets their weakness. Worked through Volkanovski against Holloway, checked against fights after the fact.
Arc 1 · Down the stack
Three related projects, each one layer deeper than the last. Run a real system, then the runtime under it, then the platform under that.
Invidious on GCPOperate a real system.applicationbuilding
A self-hosted, multi-backend Invidious deployment, fully automated, with a public health dashboard. The benchmark: match a well-known public instance, then beat it.
- Infrastructure as code: GCP, GKE
- Signed images, pulled by digest (written up)
- Multi-backend deployment
- Secrets via OIDC, none stored
- Public health dashboard
- Load-tested scaling
Planned architecture (C4, level 2)
Invidious on GCP · container diagramC4 level 2Viewer[Person]Watches videos without tracking↓ HTTPSGitHub Actions[Container: CI/CD]Builds, signs and attests imagesIngress[Container: GKE load balancer]Routes and spreads requestsGrafana[Container]Public instance-health dashboard↓ pushes signed image↓ HTTP↑ queriesArtifact Registry[Container: image store]Images pulled by digest →Invidious × N[Container: Crystal on GKE]Serve the frontend and APIPrometheus[Container]← Scrapes metrics↓ SQL ↘ HTTPSSecret Manager[Container: GCP]Secrets via OIDC, no stored keysPostgreSQL[Database: Cloud SQL]Users and subscriptionsYouTube[External system]Video sourceTerraform + Ansible [Infrastructure as code] · provisions everything abovepersonruntimedeliverydata and secretsexternal
Container engineUnderstand what runs it.runtimenext
Build, run and manage OCI containers from first principles, behind one web UI. A mini Portainer.
Own deploy platformBuild what runs everything.platformlater
A small Render-like platform on Kubernetes. First job: deploy GitLab, fully automated.
Select a stop to open it.