~/blog/series/infra
Infrastructure
From local dev to production-grade systems.
What this series is about
This series is short and stays that way. Four posts circling the same question: where does your stack actually live, and how much of it do you control when the vendor stops being friendly?
It starts at the machine, in the boring and concrete sense: being able to reach the hardware that runs your software, change what is on it, and not be one billing dispute away from losing access. Then the same question moves a layer up, to your data. Where does it sit, whose law covers it, and who else can reach it?
The two newer posts show how that question has behaved since 2026. The third is about the price of tooling that felt subsidised for years. The fourth is about what leaves your machine the moment an agent signs in on your behalf, and how to keep that quiet.
I self-host nowhere near everything, and most of the time the trade-off goes the other way. It only holds up if you know what you are giving up, and that is what these posts are for. Where the line sits between convenience and dependence stays yours to draw. The series exists so you draw it deliberately.
Take back control of your data
GDPR is cracking, AI rules are loosening, and your data still runs on American servers. Time to take control yourself.
The meter was always going to switch on
GitHub Copilot went usage-based on June 1. Developers are angry. But the anger is pointed at the bill, not the thing that created it: two years of subsidised pricing that made an uneconomic habit feel like a productivity gain.
Claude Code credential masking: keep secrets out of your sandbox
How to configure Claude Code sandbox credential masking so your agent shell holds a sentinel instead of your real token: env vars, JWT claims, AWS re-signing, and the three things this control does not buy you.