Infrastructure
Terraform in Practice #8 Deploying on ECS Fargate: Task Definitions, Services, and the Cutover Behind the ALB
Examining the limits of the user_data approach and moving the compute layer to containers. We build an ECS cluster and a Fargate task definition, separate the execution role from the task role, create a service with an ip-type target group, and run EC2 and containers side by side behind the same ALB before cutting over with a single listener change — all in code.
Terraform in Practice #7 IAM as Code: Instance Roles, Least Privilege, and GitHub Actions OIDC
Writing trust policies and permission policies with the aws_iam_policy_document data source, then attaching a role to EC2 through an instance profile to complete SSM Session Manager access and secret reads. We narrow least privilege down to individual resource ARNs, and build the OIDC federation that lets GitHub Actions assume an AWS role without access keys — all in code.
timestamptz Pitfalls: The Easy Mistakes in PostgreSQL Time Handling
A collection of practical traps in PostgreSQL time handling. The misconception that timestamptz stores a time zone, why results look different depending on the session TimeZone, the dual behavior of AT TIME ZONE that changes depending on input type, how date_trunc and daily grouping change with where midnight is anchored, why future appointments need more than timestamptz (time zone rules change), and now() versus clock_timestamp().
Terraform in Practice #6 Secrets Management: SSM vs Secrets Manager and Write-Only Arguments
We compare SSM Parameter Store and Secrets Manager on cost and features to set a selection standard, then use Terraform 1.11 ephemeral resources and write-only arguments to build a configuration where the DB password appears in neither plan nor state. We also design the path where the application reads the secret at runtime, solving the plaintext problem from the last part structurally.
UUID vs bigint Primary Keys: What the Performance Gap Really Is, and uuidv7
Settling the perennial UUID-vs-bigint primary key debate with measurable grounds. Why bigint is the default (size, insert locality, join cost), the mechanism by which UUID v4 scatters the index and hurts writes and cache efficiency, how time-ordered uuidv7 resolves most of that and PostgreSQL 18's built-in function, uuidv7's remaining trade-offs (creation-time exposure, 16 bytes), and the internal-bigint-plus-external-UUID hybrid design.
Terraform in Practice #5 RDS and S3: Codifying the Data Tier with Safety Guards
We place an isolated PostgreSQL RDS instance in private subnets using a DB subnet group and security group chaining, then configure gp3 storage, backups, and the prevent_destroy safety guard. We also set up an S3 bucket for static assets with public access blocked, and confirm the problem that the DB password kept temporarily in a variable stays in state as plaintext, handing it off as the task for the next part.
The N+1 Query Problem: Symptoms, Detection, and Fixes
N+1 queries, the most common culprit when ORM-backed services slow down. How lazy loading builds the structure where one listing fires 101 queries, detection via application logs and the calls column of pg_stat_statements, the three fixes (JOIN, batched IN loading, and the ORM's eager-loading options), and the prevention principle of designing for the shape of data a screen needs rather than counting queries afterward.
PostgreSQL Upsert Done Right: ON CONFLICT Usage and Traps
Handling "update if present, insert if not" without race conditions using ON CONFLICT. Why the SELECT-then-INSERT approach breaks under concurrency, how to use DO NOTHING and DO UPDATE, referencing new values with EXCLUDED, why the conflict target (a unique constraint) should be named explicitly, the cost of rows being locked and rewritten even when nothing changed, the relationship with MERGE, and the sequence-gap phenomenon.
Terraform in Practice #4 ALB and Auto Scaling: Launch Template, Target Group, and Scaling Policy
We promote the single EC2 instance to an Auto Scaling group behind a load balancer. The instance definition moves into a launch template, the ALB, target group, and listener get wired together, and a CPU target tracking scaling policy goes on top. We also delete the verification instance from the code to walk through how resource removal works in IaC, and receive the first response in a browser.
pgvector in Practice: What to Know When Running Vector Search on PostgreSQL
A practical guide to running embedding search on PostgreSQL without a separate vector database. The vector type and distance operators, why HNSW is the default index and how it compares to IVFFlat, the underfetching problem when combined with filters and iterative index scans (0.8.0), halfvec for half the size and 4,000 dimensions, and the criteria for when a dedicated vector database actually becomes necessary.
Terraform in Practice #3 EC2 and Security Groups: SG Chaining Design and Booting with user_data
Instead of writing CIDR blocks, we connect security groups by security group reference — a chaining design across an ALB and EC2 two-tier layout. We then look up the latest AL2023 AMI with a data source and launch an EC2 instance into a private subnet that boots a web server via user_data. Also covered: why no SSH port is opened, and the plan to complete access with Session Manager.
PostgreSQL vs MySQL: Which One for a New Project in 2026
Sorting out the choice between the two open-source RDBMSs. The conclusion: new projects default to PostgreSQL unless there is a specific reason not to, while teams already standing on the MySQL ecosystem usually have no reason to switch. Covers the timing of MySQL 8.0 end of support (April 2026) and the 8.4 LTS transition, the difference in feature breadth (JSONB, window functions, extensions), MVCC implementation differences, replication-ecosystem maturity, and the cases where either choice is fine.