Every few months I solve something, feel clever about it, and then forget the details entirely. This is the fix: a scratchpad.

Why a scratchpad, and not a blog

The label matters more than it should. The moment something is A Blog Post, I want it to be complete: a proper introduction, a tidy conclusion, a diagram, one more read-through before it goes out. That standard is reasonable for a long-form article. It is a bad fit for “here is the flag that fixed it”.

Calling this a scratchpad sets the expectation differently, for whoever reads it, and mostly for me. An entry here can be three paragraphs and a command that happened to work. It can be informal, it can be opinionated, and it can be superseded next month. Nothing needs to be the definitive word on anything; it just needs to be written down.

So the format is deliberately freestyle. If a post occasionally reads like a note to myself, that is the point.

The stack, and why it is boring

The whole point of this site is that it should still build in five years without much attention. That ruled out most of the fun options.

  • Hugo, a single static binary. It renders Markdown to HTML and does nothing else. It arrives via the hugo-extended npm package, so there is no separate toolchain to install.
  • PaperMod, pulled in as a Hugo Module rather than a vendored copy or a git submodule. The theme is pinned in go.mod, so Renovate bumps it like any other dependency.
  • No JavaScript of my own. Nothing to bundle, nothing to patch.

That last point is the one I care about. I have had a Hugo theme go unmaintained before, and digging a vendored theme out of a repository years later is miserable. Treating the theme as a tracked dependency means I find out when it stops moving, instead of discovering it the next time Hugo changes an API.

Deployment

Pushing to main triggers a GitHub Actions workflow that builds the site and runs wrangler pages deploy against Cloudflare Pages. Pull requests get their own preview URL, posted back as a comment. Both come from a reusable workflow shared across my repositories, so this repo only holds the configuration.

Security headers live in static/_headers, which Cloudflare applies at the edge, no server to configure.

What goes here

Short notes about infrastructure, security and automation, mostly the kind of thing I would otherwise have to rediscover from a stale browser tab.