https://r3p.dev/blogs Writing on technology, infrastructure, workflows, and things worth documenting. en Thu, 20 Aug 2026 00:00:00 GMT https://r3p.dev/blogs/deploying-umimaclean https://r3p.dev/blogs/deploying-umimaclean Taking a real AdonisJS 7 and Inertia application from a push on master to a running production service - what `node ace build` produces, a two-stage Containerfile, Postgres and the app as Quadlet units, a CI pipeline that builds to GHCR and deploys over SSH, and the proxy detail that silently breaks rate limiting. Thu, 20 Aug 2026 00:00:00 GMT adonisjs github-actions deployment podman https://r3p.dev/blogs/umimaclean-stack-part-13 https://r3p.dev/blogs/umimaclean-stack-part-13 The final part - three suites split by what each proves, asserting on Inertia props instead of parsing HTML, factories with states that name business situations, organising tests by role because that is what breaks, and an honest account of what is not covered. Tue, 18 Aug 2026 00:00:00 GMT japa testing adonisjs playwright https://r3p.dev/blogs/umimaclean-stack-part-12 https://r3p.dev/blogs/umimaclean-stack-part-12 The security layer in full - phone-number identity, why a signed-cookie session still has to be revocable, the passwordChangedAt trick, CSRF with a webhook exception, five rate limiters keyed on different things, private file storage with signed URLs, and the accounts that cannot be deleted. Mon, 17 Aug 2026 00:00:00 GMT adonisjs security authentication rate-limiting https://r3p.dev/blogs/umimaclean-stack-part-11 https://r3p.dev/blogs/umimaclean-stack-part-11 The frontend layer in detail - config-in-CSS and what disappeared with tailwind.config.js, why components are copied rather than installed, cva variants over prop soup, atomic-design folders that actually answer a question, and charts that theme themselves through CSS variables. Sun, 16 Aug 2026 00:00:00 GMT tailwindcss react base-ui recharts https://r3p.dev/blogs/umimaclean-stack-part-10 https://r3p.dev/blogs/umimaclean-stack-part-10 Building spreadsheet exports an owner actually uses - why numbers must be numbers, the UTC-components bug that shifts every date by a day, a generic sheet builder that erases its own type parameter, frozen headers and autofilters, and why the export must never stop at the current page. Sat, 15 Aug 2026 00:00:00 GMT exceljs reporting adonisjs luxon https://r3p.dev/blogs/umimaclean-stack-part-9 https://r3p.dev/blogs/umimaclean-stack-part-9 Building on WhatsApp because that is where the customers are - why there is no email field anywhere, the unofficial API trade-off, an endpoint that returns HTTP 200 to report failure, signed URLs that carry their own identity, and why reminders are sent by hand. Fri, 14 Aug 2026 00:00:00 GMT fonnte whatsapp adonisjs notifications https://r3p.dev/blogs/umimaclean-stack-part-8 https://r3p.dev/blogs/umimaclean-stack-part-8 Integrating an Indonesian payment gateway properly - Core API versus Snap, why the Midtrans order id cannot be your order number, the SHA-512 webhook signature that is the whole security of the flow, mapping five gateway statuses onto four of your own, and the escape hatch for the callback that never arrives. Thu, 13 Aug 2026 00:00:00 GMT midtrans payments qris adonisjs https://r3p.dev/blogs/umimaclean-stack-part-7 https://r3p.dev/blogs/umimaclean-stack-part-7 Building an address picker people can actually use on a phone - why the marker is fixed and the map moves, react-leaflet hooks, the tile layer licensing corner, Haversine distance for route ordering, and a service area that is not a circle. Wed, 12 Aug 2026 00:00:00 GMT leaflet react maps geospatial https://r3p.dev/blogs/umimaclean-stack-part-6 https://r3p.dev/blogs/umimaclean-stack-part-6 Why SSE beat WebSockets for a one-directional problem - how Transmit channels and authorisation work, the two channels this app has, why broadcasts carry stored values instead of labels, and what breaks when you run more than one process. Tue, 11 Aug 2026 00:00:00 GMT adonisjs transmit sse realtime https://r3p.dev/blogs/umimaclean-stack-part-5 https://r3p.dev/blogs/umimaclean-stack-part-5 The layer between a model and a page - variants that encode who may see what, why depth is a property of the resource, Tuyau turning route names into compile-time checks, and Inertia 2 forms that need no useState at all. Mon, 10 Aug 2026 00:00:00 GMT inertia react adonisjs typescript https://r3p.dev/blogs/umimaclean-stack-part-4 https://r3p.dev/blogs/umimaclean-stack-part-4 What it means to build a React app with no API - how Inertia visits work, shared props via middleware, flash messages and validation errors that arrive automatically, why SSR is configured but off, and the mobile app I gave up to get here. Sun, 09 Aug 2026 00:00:00 GMT inertia react adonisjs frontend https://r3p.dev/blogs/umimaclean-stack-part-3 https://r3p.dev/blogs/umimaclean-stack-part-3 Generated model schemas, migrations as the source of truth, partial unique indexes that enforce what application code cannot, RESTRICT as a history-preservation strategy, transactions around multi-table writes, and the numeric-returns-a-string gotcha that shipped broken exports. Sat, 08 Aug 2026 00:00:00 GMT adonisjs lucid postgresql database https://r3p.dev/blogs/umimaclean-stack-part-2 https://r3p.dev/blogs/umimaclean-stack-part-2 Making validation composable and localised - a shared rule vocabulary, Indonesian messages registered once, a global transform that hands you Luxon dates, and the line between what a validator may know and what belongs in a service. Fri, 07 Aug 2026 00:00:00 GMT adonisjs vinejs validation typescript https://r3p.dev/blogs/umimaclean-stack-part-1 https://r3p.dev/blogs/umimaclean-stack-part-1 How an AdonisJS 7 application is actually assembled - providers and preloads, the two middleware stacks and why the order matters, constructor dependency injection with no container registration, subpath imports, and validated environment variables. Thu, 06 Aug 2026 00:00:00 GMT adonisjs typescript nodejs architecture https://r3p.dev/blogs/umimaclean-tech-stack https://r3p.dev/blogs/umimaclean-tech-stack A tour of every library in a real production codebase and what each one actually cost - why AdonisJS over Express, Inertia instead of a REST API, Leaflet with Google tiles, Midtrans Core API over Snap, and the two data-type gotchas that broke my spreadsheet exports. Wed, 05 Aug 2026 00:00:00 GMT adonisjs inertia react leaflet https://r3p.dev/blogs/umimaclean-operations-platform https://r3p.dev/blogs/umimaclean-operations-platform What I learned building UmimaClean - why frozen prices are the most important decision in the schema, how a conditional UPDATE stops two staff driving to the same address, why a payment webhook needs an escape hatch, and the parts I would build differently. Mon, 03 Aug 2026 00:00:00 GMT adonisjs inertia react postgresql https://r3p.dev/blogs/caddy-reverse-proxy https://r3p.dev/blogs/caddy-reverse-proxy What automatic HTTPS actually does under the hood, the Caddyfile syntax that matters, reverse proxy recipes for real applications, the gotchas that cost me time - and an honest account of where Nginx is still the better tool. Tue, 02 Jun 2026 00:00:00 GMT caddy nginx reverse-proxy https https://r3p.dev/blogs/podman-quadlet-systemd https://r3p.dev/blogs/podman-quadlet-systemd A practical guide to Quadlet - where unit files go, what every section does, how networks and volumes are wired, building images declaratively, auto-updates, and the specific errors that waste the most time. Includes the rootless requirements nobody mentions. Sat, 30 May 2026 00:00:00 GMT podman quadlet systemd containers https://r3p.dev/blogs/why-podman-over-docker https://r3p.dev/blogs/why-podman-over-docker A practical comparison after actually running both - the daemon versus fork-exec model, what rootless containers really protect you from, why systemd integration mattered more than I expected, and the cases where Docker is still the right answer. Thu, 28 May 2026 00:00:00 GMT podman docker containers linux https://r3p.dev/blogs/vps-setup-part-5 https://r3p.dev/blogs/vps-setup-part-5 The final part of setting up my first VPS on Debian 13 Minimal. Building a container image in GitHub Actions, publishing it to GHCR, running it as a Quadlet service behind Caddy with no published ports, deploying on git push, then adding a second stack with a database and persistent storage. Sun, 24 May 2026 00:00:00 GMT vps podman quadlet deployment https://r3p.dev/blogs/vps-setup-part-4 https://r3p.dev/blogs/vps-setup-part-4 Part 4 of a journey learning how I set up my first VPS on Debian 13 Minimal. Putting Caddy in front as a reverse proxy with automatic HTTPS - a private container network, persistent certificate storage, and a Quadlet unit that survives reboots. Sat, 23 May 2026 00:00:00 GMT vps debian caddy podman https://r3p.dev/blogs/vps-setup-part-3 https://r3p.dev/blogs/vps-setup-part-3 Part 3 of a journey learning how I set up my first VPS on Debian 13 Minimal. Getting rootless Podman working properly - the packages Debian Minimal leaves out, UID mapping, lingering, privileged ports, and running a first container as a systemd Quadlet service. Fri, 22 May 2026 00:00:00 GMT vps debian podman quadlet https://r3p.dev/blogs/vps-setup-part-2 https://r3p.dev/blogs/vps-setup-part-2 Part 2 of a journey learning how I set up my first VPS on Debian 13 Minimal. Fixing the Debian 13 SSH port gotcha, adding swap, closing every port with ufw, banning repeat offenders with fail2ban, and letting security patches apply themselves. Thu, 21 May 2026 00:00:00 GMT vps debian server security https://r3p.dev/blogs/vps-setup-part-1 https://r3p.dev/blogs/vps-setup-part-1 Part 1 of a journey learning how I set up my first VPS on Debian 13 Minimal. This part focuses on initial access, system updates, SSH keys, user separation, and SSH hardening to secure the base system before any services are deployed. Wed, 20 May 2026 00:00:00 GMT vps debian server ssh