One small part per post: a probe, a daily job, a trick, a trap that cost an afternoon.
A font loaded from Google at page load sends the visitor's IP address to Google before anyone has consented to anything. Next.js can bundle the same font at build time, so the request never happens.
A Mac sits at home behind a normal router, no public IP, no port forwarding, and I open a shell on it from a laptop anywhere. Tailscale does the network and the keys, MagicDNS gives it a name. Plus the three things to check when it stops answering.
An older MacBook does fine as an always-on machine for scheduled jobs and builds, if you stop it from sleeping, let it log itself in, and leave it alone. The handful of settings that matter and what to re-check after every macOS update.
A small company with no ops department, a dozen moving parts and a founder who used to fix servers at 3 am. What changed: one part-time DevOps engineer, working async, and a repo that is the only place work is handed over.
A fault gets noticed with your hands full and forgotten by the time you reach a desk. A tiny local web page takes a photo and one sentence and appends it to a markdown file, where it waits until somebody fixes it.
Someone wants to see the thing before it is deployed, and the thing is a dev server on my laptop. Two Tailscale commands hand out a temporary HTTPS link: serve for people inside your network, funnel for anyone with a browser. When to use which, and how to switch it off again.
Scheduled jobs on a Mac belong in a launchd plist: they survive reboots, run as your user, and log where you can find them. One minimal plist, the commands to load it, and the privacy gotcha that makes a job under Documents fail with Operation not permitted.
A forty-minute Monday task, done by an agent from a written procedure, with a check at the end that decides whether the result counts. The procedure file is the real work; the run is the easy part.
A few machines in my Tailscale network run unattended. Instead of naming each one in the access rules, they carry one tag, and the rules talk about the tag: who may reach them, on which ports, who may SSH in. Adding a machine stops being a policy edit.
A folder of source material, a scheduled job that turns one item into an article each morning and publishes it, and a human who reads every post for the first week before the job is allowed to run alone.
launchctl kickstart -k restarts a launchd job with the configuration it already has in memory. Edit the plist, kickstart, and the service comes back running the old settings while looking freshly restarted. How it bites and the two lines that fix it.
A fresh AWS account can send mail through SES only to addresses you have verified yourself. Your test to your own inbox works, the first real recipient fails, and the error is easy to miss. How to spot it and how to get out.
Editors drop finished files into a shared Google Drive folder. A cron job copies the folder to a public S3 prefix with rclone, so every file gets a stable URL that works in a browser, an API call or a spreadsheet, without anyone logging in.
Every ten minutes a script loads a product's checkout page and checks that the pay button is there. It posts to a chat channel exactly twice per incident: once when it goes down, once when it comes back. Never in between.
Lead forms on Meta collect names all night and show them in a dashboard nobody opens. A short scheduled script pulls yesterday's leads, writes a clean CSV and mails it before the client's first coffee.
