Writing

Internal mTLS Between Services With a Private CA (step-ca)

October 5, 2026

Run a private CA with step-ca, issue short-lived leaf certificates to each service, verify both ends with mutual TLS, and automate renewal via systemd.

This Fixes: npm ERESOLVE Peer Dependency Conflict

October 5, 2026

npm install fails with ERESOLVE when a package demands a peer your tree cannot satisfy. Fix it by reading the conflict, using overrides, and verifying with npm ls.

New UK Operational Incident and Third-Party Reporting Rules: Building the Pipeline

October 5, 2026

The FCA, PRA and Bank of England have standardised what operational incidents and third-party arrangements UK firms must report, and when. Treat it as a data-capture and submission build, not a policy.

Don’t forget your US vendors are gone for four days

October 5, 2026

US Thanksgiving falls on Thursday 26 November 2026 and your American vendors go dark for four days. Here is the one thing to check before the date.

The IReF Data Dictionary: Building a Single Semantic Layer for Statistical Reporting

October 5, 2026

IReF collapses the euro area’s statistical returns into one framework. The firms that win own a governed semantic layer decoupling source systems from reporting outputs.

The UK Cyber Security and Resilience Bill: Preparing as a Data Centre Operator

October 2, 2026

The Cyber Security and Resilience Bill brings data centres and managed service providers into scope. A readiness playbook for operators to build incident pipelines and supply-chain evidence before designation starts the clock.

Why I Migrated From Jenkins to GitHub Actions (and What I Kept On Jenkins)

October 2, 2026

A hands-on account of moving pipelines off self-hosted Jenkins to GitHub Actions, with the honest trade-offs and the builds I deliberately kept on Jenkins.

Automating Data Subject Rights at Scale: The DSAR Fulfilment Pipeline Regulators Reward

October 2, 2026

Manual data-subject-access handling breaks the moment volume rises and misses the one-month deadline. Here is how to build a DSAR fulfilment pipeline across the whole estate.

Spec-First API Development with OpenAPI 3.1: Design the Contract Before the Code

October 2, 2026

Author an OpenAPI 3.1 document first, lint it with Spectral, mock it with Prism, then generate a typed client so the spec gates the build rather than trailing it.

Recognised Legitimate Interests Under DUAA: A Data-Protection Engineering Checklist

October 2, 2026

The DUAA adds recognised legitimate interests as a seventh UK GDPR lawful basis. A practical engineering checklist for re-mapping processing and tagging records.

Previous Next