The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
MariaDB Full-Text Search Is Probably Enough (I Know, I Know)
Before you spin up another service, try MATCH...AGAINST. I've been surprised more than once by how far native MariaDB full-text gets you.
Every time search comes up on a project, there's an immediate gravitational pull toward adding a dedicated search service. Meilisearch, Algolia, Elasticsearch — pick your poison. I've done it too. But the last three times I've actually stopped, benchmarked, and thought it through, MariaDB's native full-text search was…
Read the daily →PHP-FPM pm.max_children: The Math Nobody Writes Down
Everyone cargo-cults 50 workers. Here's how I actually calculate pm.max_children for a Laravel app on a single VM, and why getting it wrong kills you quietly.
Every few months I inherit a server someone else configured, and is either 10 (starving) or 500 (thrashing). Nobody got fired for either number because the app "works" — until traffic spikes or a slow query holds workers and the whole thing falls over. Here's the math I actually use, and why the defaults are quietly…
Read the daily →Redis Does Three Jobs on One Server and I've Never Replaced It
Five years of using Redis as queue, cache, and session store on a single box. Here's why I haven't touched it.
I keep waiting to find a reason to replace Redis with something more interesting. Five years in, across a dozen production deployments, I haven't found one. That's not a ringing endorsement — it's more like the quiet satisfaction of a tool that just refuses to cause problems. What Redis Actually Solves For Me The…
Read the daily →Rate limiting at nginx before Laravel ever wakes up
Blocking brute-force attempts at the nginx layer is cheaper and faster than doing it in PHP. Here's the actual config I use for login and API endpoints.
Most Laravel apps I inherit have rate limiting wired up in the application layer — a middleware, a facade call in , maybe a package. That's fine as far as it goes, but it means every blocked request still boots PHP-FPM, hits the framework, hydrates the service container, and burns a worker slot. For a login endpoint…
Read the daily →Twilio Verify: Rate Limiting OTP Without Locking Out Real Users
Twilio Verify's built-in rate limiting sounds great until your client's customers start getting locked out. Here's how I actually handle it.
Twilio Verify's default rate limiting will stop a naive enumeration attack. It will also lock out a real user who fat-fingered their phone number twice, and then you're getting a support ticket at 11pm. Getting the balance right requires understanding what Twilio actually does under the hood — and layering your own…
Read the daily →