// ─────────────────────────────────────────────
//  BLOG POSTS — edit here to add / update posts
//  Fields:
//    id       : unique slug, used in URL hash  (e.g. 'my-first-post')
//    date     : ISO string                     (e.g. '2026-04-14')
//    category : 'personal' | 'professional' | 'entertainment' | 'homelab'
//    title    : string
//    excerpt  : short summary shown on card
//    content  : full post body (HTML supported)
// ─────────────────────────────────────────────

export const posts = [
  {
    id: 'rescued-optiplex-rabbit-hole',
    date: '2026-04-10',
    category: 'homelab',
    title: "Rescued a Dell Optiplex and Now I Can't Stop",
    excerpt: "A decommissioned Optiplex 3000, Docker, and a rabbit hole I didn't expect.",
    content: `
      <p>It started with a Dell Optiplex 3000 that was about to get wiped and trashed. I grabbed it
      before it disappeared and figured I'd run a few things on it. That was a mistake — in the best way.</p>

      <p>Docker opened a door I didn't know was there. The more I poked around, the more I realized
      how much is already solved. Need a game server? There's a container for that. Need to monitor
      your uptime, metrics, logs, and analytics? Container, container, container, container.</p>

      <p>That's exactly what I ended up with: <strong>Uptime Kuma</strong> for service uptime,
      <strong>Netdata</strong> for system metrics, <strong>Umami</strong> for page analytics, and
      <strong>Dozzle</strong> for container logs. Simple stack, everything in one place, surprisingly complete.</p>

      <p>The part that got me was publishing this site. I was genuinely a little nervous — I was exposing
      something to the internet, inside my own network. Old me would've stopped there. Instead I thought:
      <em>there's probably a container for the security piece too.</em> Turns out, yeah. Problem solved.</p>

      <p>AI has a lot to do with this shift. Things that used to feel out of reach — self-hosting,
      networking, monitoring — feel a lot more approachable when you can just ask questions and get unstuck fast.</p>

      <p>Next goal: more Optiplexes, a Kubernetes cluster, and seeing how far this rabbit hole actually goes.
      I'll keep you posted.</p>
    `,
  },
  {
    id: 'survival-sandbox-journey',
    date: '2026-04-14',
    category: 'entertainment',
    title: "Survival Sandboxes and the Itch I Can't Scratch",
    excerpt: "From Star Wars Galaxies to Enshrouded — apparently I've always been about building stuff and calling it home.",
    content: `
      <p>I never connected the dots until recently, but there's a clear thread running through every game
      I've actually sunk time into: you build something, and it feels like yours.</p>

      <p>It started with <strong>Star Wars Galaxies</strong> — one of the first MMOs I played. Yeah there
      was grinding, leveling, the full RPG loop. But what I kept coming back to was base building. There was
      something about someone walking into your place and saying <em>"this is cool"</em> that hit different.
      That little moment of validation from a stranger in a game. I get it now more than I did then.</p>

      <p>Fast forward and I'm playing <strong>Minecraft</strong> with my kid. Graphics are what they are,
      but the crafting system is genuinely deep. And watching a kid figure out resource chains and basic
      survival logic — that's actually pretty solid for a young brain. It holds up.</p>

      <p>A coworker told me he basically lived on Steam sales, buying whatever looked interesting at a
      discount. I did the same and landed on <strong>No Man's Sky</strong>. That game broke my brain a
      little. Procedurally generated solar systems, planets, flora, fauna — 18 quintillion planets. The
      number is absurd. But strip that away and it's basically Minecraft in space: gather everything or
      die trying. I put a lot of hours in, but a game that massive is hard to maintain intensity on.
      Eventually I dialed back.</p>

      <p>Steam does this thing where it watches what you play and suggests similar titles. That's how I
      found <strong>Enshrouded</strong>. Fantasy RPG setting, traditional classes, fluid real-time combat
      — no turn-based stuff, not my thing — with that same loop of crafting, foraging, and figuring things
      out. The quest line actually guides you through different biomes in a way that feels structured without
      being hand-holdy. Only complaint: I wish it was on Nintendo Switch so I could play it in traffic.
      Half joking.</p>

      <p>A coworker mentioned he ran a Minecraft server and something clicked — <em>I wonder if there's a
      container for Enshrouded.</em> There was. Threw it on the Dell Optiplex that was headed to
      decommission and it runs without breaking a sweat. A simple Docker Compose file and done. Sometimes
      working in networking and infrastructure has its perks: you see how the sausage is made and suddenly
      self-hosting a game server feels less like a project and more like a Tuesday.</p>

      <p>How long will the Enshrouded phase last? No idea. But here's the takeaway: if something looks
      interesting, Google it. There's probably a server image, a mod, a community, or at minimum a Reddit
      thread that tells you if it's worth your time.</p>
    `,
  },
  {
    id: 'tls-proxy-saved-mobile-security-launch',
    date: '2026-08-05',
    category: 'professional',
    title: "How a Small TLS Proxy Saved a Mobile Security Launch From a One-Year Delay",
    excerpt: "A legacy provisioning system couldn't speak modern TLS to a new security API. Here's how a lightweight reverse proxy closed the gap in days, not a year.",
    content: `
      <p>A new mobile security service — phishing and malware filtering through a dedicated APN —
      was ready to launch. Integration testing hit a wall: the legacy provisioning system could not
      complete a TLS handshake with the security platform's API.</p>

      <h3>The Setup</h3>
      <p>Launching a new value-added service in a mobile network means coordinating multiple technology
      layers — from radio and packet core (EPC/5GC) to provisioning platforms and third-party security
      systems. The architecture called for a dedicated APN routing subscriber traffic through filtering
      engines, and integration with the provisioning platform so every subscription change triggered a
      call to the security platform's REST API. Everything was ready on paper. Then, during integration
      testing against the production API, communication failed outright.</p>

      <h3>The Root Cause</h3>
      <p>The logs showed a classic cipher negotiation failure:
      <code>javax.net.ssl.SSLException: Received fatal alert: handshake_failure</code>.</p>
      <ul>
        <li>The legacy provisioning system ran an old Java stack, capped at outdated TLS 1.0/1.1 cipher suites.</li>
        <li>The security API required modern TLS 1.2/1.3 ciphers, no exceptions.</li>
      </ul>
      <p>This wasn't a vendor being difficult. TLS 1.0/1.1 have been formally deprecated by the IETF
      (RFC 8996) since 2021, blocked by every major browser since 2020, and banned under PCI DSS,
      NIST SP 800-52 Rev. 2, and HIPAA. Any provisioning backend still speaking TLS 1.0/1.1 isn't an
      isolated exception — it's part of an entire category of telco infrastructure hitting its
      expiration date at roughly the same time.</p>

      <h3>The Operational Crossroads</h3>
      <p>The official answer — upgrading the provisioning engine's Java version — required upgrading
      the entire platform core: massive regression testing across dozens of other critical services,
      an estimated 12-18 month planning window, and no budget allocated for the current year. Accepting
      that path meant freezing the security project indefinitely and losing the commercial launch window.</p>
      <p>Accumulated technical debt grew by an estimated $6 trillion globally between 2012 and 2023
      (Oliver Wyman), with the U.S. alone accounting for $2.2 trillion of that increase. At the
      enterprise level, the average company loses over $370M a year from its inability to modernize
      legacy systems efficiently.</p>

      <h3>The Fix: A Reverse Proxy in the Middle</h3>
      <p>Instead of forcing a structural change onto the provisioning platform, we applied a core
      systems-design principle: decouple application logic from the transport layer.</p>
      <pre>Legacy Provisioner --TLS 1.0/1.1--> Reverse Proxy --TLS 1.2/1.3--> Security API (Allot)
    (old Java)               (container / NGINX)          (filter engine)
                              [ Handshake translation ]</pre>
      <p>The provisioning system sent its request to the proxy's internal address using the only
      cipher suites its old Java stack supported. The proxy terminated that legacy TLS session
      internally, then immediately opened a fresh handshake to the external Allot API using modern
      TLS 1.2/1.3. The response traveled back the same path, in reverse. Deployed as an ultralight,
      isolated container — designed, tested, and live in a matter of days.</p>

      <h3>The Business Result</h3>
      <ul>
        <li><strong>Zero delay to go-to-market.</strong> The service launched on schedule.</li>
        <li><strong>Breathing room for the real upgrade.</strong> The infrastructure team got over a
        year to plan, budget, and execute the major provisioning upgrade properly.</li>
        <li><strong>Zero risk introduced.</strong> Not a single parameter on the core provisioning
        platform was touched.</li>
      </ul>

      <h3>Why This Pattern Is Standard Now</h3>
      <p>What we solved with a few lines of proxy config is, in hindsight, a tactical answer to a
      structural industry trend. The TLS-legacy grace period is closing in cascade — Meraki, Azure
      Storage, Office 365, and Exchange Online are all running their own TLS 1.0/1.1 shutdowns through
      2026. Tech debt now represents roughly 40% of large enterprises' IT balance sheets (McKinsey),
      and the sidecar/proxy pattern — terminating TLS and decoupling transport with NGINX, HAProxy, or
      Envoy — is already standard practice in container architectures precisely because it absorbs this
      kind of compatibility gap without touching critical systems.</p>

      <h3>Lessons Learned</h3>
      <ol>
        <li><strong>Technical debt always collects eventually.</strong> Global technical debt sits at
        61 billion person-days of remediation work (CAST Software, 2025) — waiting for "someday"
        budget stops being a viable strategy.</li>
        <li><strong>Engineering pragmatism beats perfectionism.</strong> The pragmatic solution beat
        the purist one, and delivered business value while managing risk safely.</li>
        <li><strong>The proxy/sidecar pattern became a standard.</strong> Decoupled proxies became a
        default part of our container architectures going forward.</li>
        <li><strong>AI as an accelerator, not a replacement for judgment.</strong> AI tools sped up
        troubleshooting the handshake failure and generating precise proxy configs — they didn't
        replace the engineering call to make.</li>
      </ol>

      <p><em>Have you run into a legacy-meets-modern-API collision in your own projects? What pattern
      did you use to bridge it?</em></p>

      <p style="font-size:0.85em;opacity:0.7">Sources: Cisco Meraki Documentation, The Register,
      Microsoft Learn / Tech Community, SSL Insights (TLS 1.3 Adoption 2026), Pegasystems / Savanta
      (2025), Oliver Wyman (via Brights.io), CAST Software ("Coding in the Red", 2025), McKinsey
      (via byteiota.com), HFS Research.</p>
    `,
  },
]