Mattias Geniar on ma.ttias.be

Alex West wrote Not Business Advice , a free series of 13 short books about building profitable personal projects, compiled from the daily blog posts he’s written since 2018. It’s the story of how he made over $1M from his own side projects, and I’m reading it right now. It’s really good: honest about the failure, luck, and burnout, not just the wins. Go read it, it’s free.

We watch websites for a living at Oh Dear , so I figured I knew roughly how often things break. The data set me straight on which outages are worth worrying about.

You can already point an AI agent at your Filament admin panel and have it click around like a human. Take a screenshot, find the button, fill the form, submit, screenshot again to check it worked. With computer-use or a browser MCP, that works today. It’s also slow, brittle, and spends a small fortune in tokens describing pixels to figure out where the “Save” button is.

Laravel Octane promises a faster Laravel: keep your app booted in memory, skip the framework bootstrap on every request, do less work per request. We run a fleet of uptime-checker boxes at Oh Dear that do nothing but fire HTTP, TCP, and ping checks at the sites we monitor, so I figured they’d be a good, low-risk place to try it. We moved a handful of them from PHP-FPM to Octane on FrankenPHP , measured it properly, and then moved every one of them back.

I’ve been moving our CI off GitHub-hosted runners onto our own arm64 hardware. The plan was straightforward: a pool of ephemeral runners on a dedicated CI box, and each test shard spins up its own MySQL, Redis, and ClickHouse as service containers, all under rootless Docker.

Google PageSpeed flagged a stylesheet on ohdear.app the other day: front.css, the bundle for its public-facing pages. That surprised me, because Cloudflare sits in front of ohdear.app and Cloudflare does Brotli, and a Brotli’d copy of that file is around 40 KB. Browsers were downloading just over 50 KB of gzip instead. So why wasn’t Brotli kicking in?

Every server I run, including the fleet behind Oh Dear ’s uptime checks, has the same set of debugging tools installed before anything goes wrong. Not because the application needs them, but because the one time you reach for strace is at 2am, the box is misbehaving, and apt install is the last thing you want to be doing while you work out what broke.

I spent a chunk of the last few weeks upgrading a fleet of Ubuntu servers in place, one LTS to the next, with do-release-upgrade. Dozens of boxes, mostly stateless, mostly boring once you’ve done the first few.

Back in 2016 and 2017 I recorded a podcast called Syscast : interviews with people I admired in the Linux, open source and infrastructure world. Matt Holt about Caddy , Daniel Stenberg about curl , Seth Vargo about Vault , and a handful more. Ten episodes, roughly ten hours of audio, and then life got in the way and I put it on pause.

Back in 2015 I wrote about running Varnish 4.x on systemd , when the RedHat-family packages moved your startup options out of /etc/sysconfig/varnish and into a new /etc/varnish/varnish.params file that the unit sourced.

A long time ago I wrote a Varnish tip about seeing which cookies get stripped in your VCL . The idea is still one of the most useful things you can do with varnishlog: compare what the browser sent against what reached your backend, so you can confirm your cookie-stripping rules do what you think.

Alex Hormozi has a solid definition of confidence: You don’t become confident by shouting affirmations in the mirror, but by having a stack of undeniable proof that you are who you say you are.

Years ago I posted a handful of Varnish 3.0 one-liners for varnishtop and varnishlog . They were all variations on the same idea: pick a log tag like RxURL or TxURL, then grep for what you wanted.

I wrote a piece over on the Oh Dear blog about a failure mode that most uptime monitoring quietly gets wrong: a domain gets pulled from its registry’s zone, but its authoritative nameservers keep answering, and cached resolvers happily serve the stale delegation for days. Your monitoring says green. The domain is gone.

Back in 2016 I gave a talk called Varnish Explained and wrote it up slide by slide. It still gets traffic, which is nice, except the version numbers on those slides are now a decade old and the project doesn’t even go by the same name anymore.

When I wrote about running HTTP/3 with Caddy in 2020 , it was a ritual. You opted in with an experimental_http3 global option, the protocol was still draft h3-27, and to test it you needed a custom-compiled curl and a browser nightly with the right flags flipped. It worked, but it was clearly the bleeding edge.

Update: the fix described in this post has since been merged into Laravel and ships in the next 13.x release. From that release on, a child class’s plain $timeout property correctly overrides an attribute inherited from a parent, so the specific footgun below no longer bites. This post stays up as a historical write-up: how the bug behaved, the subtle PHP reflection edge case behind it, and the fix that closed it.

Ten years ago I wrote about Google’s QUIC protocol , back when it was an experiment you could realistically only test against Google’s own servers. I was excited about it, and I ended that post hoping the spec would get standardised and show up in other browsers and servers.

At Oh Dear , our status pages can run on a customer’s own domain, and we’ve always served on-demand ACME certificates for them: someone points their domain at us, and Caddy provisions a Let’s Encrypt certificate for it automatically. We’re now adding a second option, letting customers bring their own certificate. For that, Caddy doesn’t provision anything; it fetches the certificate from an HTTP backend in our app.

I’m finding myself thinking longer about the code I write and the features that get developed, than I did before the agentic coding era.

We have 4 streaming services at home: Netflix, Disney+, Prime Video, and Apple TV+. Try finding which films and series are actually available with Dutch audio.

Our babysitter recently played a fun game with our kids called “Fake It”. It’s a simple party game, not too complex, and doesn’t require any props. The app store is full of them, but they all hide ads or have a €9.99/week (week!) subscription model, all trying to trick you into buying or paying. But it’s such a simple game. Surely, I can just make my own version, right?

We just shipped a mobile-friendly version of Oh Dear . It touched 226 files, added over 5,000 lines, and modified 160+ Blade templates. The PR took three weeks from first commit to merge.