https://aaronwylie.com/blog Articles on full-stack development, backend, real-time systems, security and observability. en-ca https://aaronwylie.com/blog/wordpress-to-modern-stack-nextjs-api https://aaronwylie.com/blog/wordpress-to-modern-stack-nextjs-api Tue, 14 Jul 2026 09:00:00 GMT When to migrate off WordPress, what you gain, and how to do it without a big-bang rewrite - preserving SEO along the way. https://aaronwylie.com/blog/observability-101-dynatrace-kubernetes-lab https://aaronwylie.com/blog/observability-101-dynatrace-kubernetes-lab Tue, 09 Jun 2026 09:00:00 GMT Metrics, logs and traces - and how building a lab to break things on purpose teaches you to find root causes fast. https://aaronwylie.com/blog/eddystone-ble-beacons-broadcast-to-phones https://aaronwylie.com/blog/eddystone-ble-beacons-broadcast-to-phones Tue, 12 May 2026 09:00:00 GMT How BLE beacons push signals to thousands of phones with no network - the tech behind APPIX, and why broadcast beats connections at scale. https://aaronwylie.com/blog/scaling-live-video-webrtc-sfu https://aaronwylie.com/blog/scaling-live-video-webrtc-sfu Tue, 14 Apr 2026 09:00:00 GMT Why peer-to-peer WebRTC falls apart with an audience, and how a Selective Forwarding Unit makes low-latency one-to-many streaming possible. https://aaronwylie.com/blog/realtime-webhook-inspector-fastify-websockets https://aaronwylie.com/blog/realtime-webhook-inspector-fastify-websockets Tue, 10 Mar 2026 09:00:00 GMT Build a tool that gives you a unique URL and streams incoming HTTP requests to your browser live - Fastify, WebSockets, and the nginx gotcha. https://aaronwylie.com/blog/k-anonymity-password-breach-checks https://aaronwylie.com/blog/k-anonymity-password-breach-checks Tue, 10 Feb 2026 09:00:00 GMT Check whether a password has been breached without ever sending it - the clever cryptographic trick behind Have I Been Pwned, and how to build on it. https://aaronwylie.com/blog/preventing-ssrf-nodejs-outbound-requests https://aaronwylie.com/blog/preventing-ssrf-nodejs-outbound-requests Tue, 13 Jan 2026 09:00:00 GMT Any time your server fetches a user-supplied URL you risk SSRF. How the attack works and how to shut it down - including the redirect gotcha. https://aaronwylie.com/blog/security-headers-a-grade-csp-hsts https://aaronwylie.com/blog/security-headers-a-grade-csp-hsts Tue, 09 Dec 2025 09:00:00 GMT The six response headers that close common browser-side attacks, how to add them at nginx, and how to write a CSP that does not break your site. https://aaronwylie.com/blog/zod-single-source-of-truth-fastify-openapi https://aaronwylie.com/blog/zod-single-source-of-truth-fastify-openapi Tue, 11 Nov 2025 09:00:00 GMT Make one schema validate requests, serialize responses, and generate your OpenAPI docs - so the docs can never drift from the code. https://aaronwylie.com/blog/deploy-fullstack-digitalocean-docker-nginx https://aaronwylie.com/blog/deploy-fullstack-digitalocean-docker-nginx Tue, 14 Oct 2025 09:00:00 GMT A reproducible, one-command deploy of a full-stack app to a $6 Droplet - Docker Compose, nginx reverse proxy, free HTTPS, and the ufw/Docker trap.