https://staging.gumoji.com/journal/ Engineering write-ups, incident reports and the occasional opinion about compliance, written by the people who did the work. en https://staging.gumoji.com/journal/nis2-ci/ https://staging.gumoji.com/journal/nis2-ci/ Fri, 02 Oct 2026 00:00:00 GMT Compliance Less than the consultants say, more than most pipelines do. A practical reading of Article 21 for people who own a .gitea/workflows folder. https://staging.gumoji.com/journal/fourteen-minutes/ https://staging.gumoji.com/journal/fourteen-minutes/ Fri, 18 Sep 2026 00:00:00 GMT Reliability A connection pool, a config default and a very patient load balancer. What broke, what we changed, what we're still watching. https://staging.gumoji.com/journal/forked-gitea/ https://staging.gumoji.com/journal/forked-gitea/ Fri, 04 Sep 2026 00:00:00 GMT Platform Horizontal scaling needed changes upstream couldn't take yet. Here's how we keep the diff small and send the rest back. https://staging.gumoji.com/journal/keycloak-upgrades/ https://staging.gumoji.com/journal/keycloak-upgrades/ Fri, 21 Aug 2026 00:00:00 GMT Security Theme drift, provider SPIs and the migration script nobody reads. Our upgrade checklist, shared in full. https://staging.gumoji.com/journal/reachability/ https://staging.gumoji.com/journal/reachability/ Fri, 07 Aug 2026 00:00:00 GMT Security A critical in code you never call is a footnote. A medium on your login path is your week. https://staging.gumoji.com/journal/gateway-contract/ https://staging.gumoji.com/journal/gateway-contract/ Fri, 24 Jul 2026 00:00:00 GMT Platform Why we keep gateway config in the same repo as the service, reviewed by the same people. https://staging.gumoji.com/journal/iso-evidence/ https://staging.gumoji.com/journal/iso-evidence/ Fri, 10 Jul 2026 00:00:00 GMT Compliance Pull requests, pipeline logs and access reviews are evidence. You just need to keep them where an auditor can find them.