Blog
Thoughts on engineering, design, and building great products.
Migrating & Upgrading GitLab 15.6.1 to 19.2: New Box, Going Private, Cutover Behind Production
One long night migrating GitLab EE 15.6.1 to 19.2. Build a new box, restore, step-upgrade through a dozen required-stops, move GitLab from public (Cloudflare + ELB) to private (NLB + PrivateLink + Transit Gateway), then cut over with split-horizon DNS — all without touching the old box. With real upgrade bugs, speed-up tricks, and seven post-cutover issues and their fixes.
AWS-native Observability for EC2 with the CloudWatch Agent
A hands-on lab building an observability pipeline for EC2 with the CloudWatch Agent, CloudWatch Logs, CloudWatch Metrics, Alarms, SNS email and a Dashboard, across two real cases: installing the agent on an existing EC2 instance, and bootstrapping the agent at launch time on a brand-new one.
Things GitHub Actions Tutorials Tend to Skip
After Part 1's first pipeline, this article covers 9 things basic CI/CD tutorials skip about GitHub Actions: concurrency control (with the github.ref gotcha), the branch rule for reading YAML on external events, the workflow_* family (dispatch, call, run — with the head_sha gotcha), cache dependencies, matrix strategy, Docker Hub instead of building on the server, GITHUB_TOKEN permissions, OIDC for AWS (no more long-lived SSH keys), and environment + required reviewers.
A Pragmatic Pipeline: Approval Gate, Parallelism, and Triggers
A pipeline that runs isn't yet a pipeline you can use at work. This article adds three pragmatic things: a manual approval gate that blocks deploy until someone signs off (demoed for real over the CLI), running multiple actions in parallel with runOrder, and trigger filtering so the pipeline runs only for the right branch — using pipeline type V2.
CodePipeline: Wiring Source, Build, Deploy Into a Chain
Until now every stage ran by hand. CodePipeline wires them into one automated chain: Source pulls code from CodeCommit, Build calls CodeBuild, Deploy calls CodeDeploy — artifacts flow from one stage to the next. This article builds the first pipeline, runs it for real, and dissects how artifacts pass between stages.
CodeArtifact: An Internal Package Repository for Builds
Real builds depend on a stream of packages from the Internet — risky when an external source changes or disappears. CodeArtifact is a managed package repository: both a proxy cache for public PyPI/npm and a store for your private packages. This article creates a domain and repository, publishes a Python package then reinstalls it from CodeArtifact, and wires it into CodeBuild.
What CI/CD Is and the AWS Developer Tools Suite
Series opener: why deploying by hand eventually breaks, how CI and CD differ, and which AWS services let you build a pipeline — CodeCommit, CodeBuild, CodeDeploy, CodePipeline, CodeArtifact. How the pieces assemble into a chain that carries code from commit to running on EC2, all driven by the AWS CLI.