~/blog/series/infra
Infrastructure
From local dev to production-grade systems.
What this series is about
This series is short and stays that way. Five posts circling the same question: where does your stack actually live, and how much of it do you control when the vendor stops being friendly?
It starts at the machine, in the boring and concrete sense: being able to reach the hardware that runs your software, change what is on it, and not be one billing dispute away from losing access. Then the same question moves a layer up, to your data. Where does it sit, whose law covers it, and who else can reach it?
The three newer posts show how that question has behaved since 2026. The third is about the price of tooling that felt subsidised for years. The fourth is about what leaves your machine the moment an agent signs in on your behalf, and how to keep that quiet. The fifth follows the same question into CI, where the runner an agent writes a workflow for is a machine you own and almost never look at.
I self-host nowhere near everything, and most of the time the trade-off goes the other way. It only holds up if you know what you are giving up, and that is what these posts are for. Where the line sits between convenience and dependence stays yours to draw. The series exists so you draw it deliberately.
Take back control of your data
GDPR is cracking, AI rules are loosening, and your data still runs on American servers. Time to take control yourself.
The meter was always going to switch on
GitHub Copilot went usage-based on June 1. Developers are angry. But the anger is pointed at the bill, not the thing that created it: two years of subsidised pricing that made an uneconomic habit feel like a productivity gain.
Claude Code credential masking: keep secrets out of your sandbox
How to configure Claude Code sandbox credential masking so your agent shell holds a sentinel instead of your real token: env vars, JWT claims, AWS re-signing, and the three things this control does not buy you.
CI runner security when an agent writes your workflow
Self-hosting your forge and your runner is a defensible call in 2026. Nobody writes the CI runner security guide for the platform you moved to, and an agent permission model built around a dialog does not survive the trip into a pipeline.