Journal — 7 entries
Field notes fromthe platform layer.
Engineering write-ups, incident reports and the occasional opinion about compliance. Written by the people who did the work.
What NIS2 actually asks of your CI pipeline
Less than the consultants say, more than most pipelines do. A practical reading of Article 21 for people who own a .gitea/workflows folder.
02 Oct 2026 · 9 min read · Ines de Vries
Fourteen minutes in August: a write-up
A connection pool, a config default and a very patient load balancer. What broke, what we changed, what we're still watching.
Why we forked Gitea, and how we stay friends upstream
Horizontal scaling needed changes upstream couldn't take yet. Here's how we keep the diff small and send the rest back.
Keycloak upgrades without the cold sweat
Theme drift, provider SPIs and the migration script nobody reads. Our upgrade checklist, shared in full.
Reachability beats severity: triaging 4,000 CVEs
A critical in code you never call is a footnote. A medium on your login path is your week.
A gateway is a contract, not a proxy
Why we keep gateway config in the same repo as the service, reviewed by the same people.
ISO 27001 evidence your platform already has
Pull requests, pipeline logs and access reviews are evidence. You just need to keep them where an auditor can find them.
Nothing in this category yet.