Ross Edman · Sr. Principal Engineer at Twilio
Notes from below the application layer.
Infrastructure, Go, homelabs and the small tools that make a terminal feel like home. Written down so I remember how I did it.
Latest
go
security
Introducing sarifix: Make Your Scanners' Findings Fixable
sarifix reads SARIF from the scanners you already run, tracks findings across scans without relying on line numbers, and hands Claude Code the findings its own changes introduced so it fixes them before it finishes.
Archive
2026 12 posts
- Introducing tfmetrics: Terraform Metrics for a Whole Org, Without Running Terraform tfmetrics reads the .tf files across your repos and turns them into inventory, version drift, module adoption and hygiene metrics. No terraform init, no plan, no state and no cloud credentials.
- Introducing sdvarlink and vlx: systemd's Varlink APIs from Go and the Terminal systemd is moving its APIs from D-Bus to Varlink. sdvarlink gives Go programs typed, generated clients for them, and vlx is a terminal explorer for finding, reading and calling them.
- Introducing keyload: Rotate TLS Certificates Without a Restart keyload is a small Go library that reloads TLS certificates, keys and CA bundles while a server or client keeps running, and refuses to swap in anything that's broken.
- Introducing postmarkd: Sending Mail Should Be One Line postmarkd is a small daemon that runs next to your apps and delivers their mail through Postmark, whether they send over HTTP, SMTP, the sendmail command or a CLI.
- The Basics Of polkit What polkit is, how it decides who can do what on a Linux machine, and how to write a rule that lets a group restart one systemd service without sudo.
- Introducing brownout: Turn Off Go Endpoints Without a Deploy brownout is a small Go middleware library for shedding some or all traffic to selected HTTP routes at runtime, from Go, a JSON admin API or a watched file.
- North Texas Summer Nights Are Heating Up Faster Than the Days Thirty-five summers of NOAA data from DFW Airport: 100° days come and go, but nights that stay above 80°F have more than doubled.
- BuildKit As A Library: A CI Pipeline In Go Drive Docker's built-in BuildKit from a Go program to vet, test and cross-compile a project in parallel, with caching, and export the binaries to your machine.
- Shipping Your Own Docker Syntax With BuildKit Write a BuildKit frontend in Go that turns a three-line YAML file into a tiny container image, publish it as an image, and use it from any docker build with a # syntax line.
- Running A Go Service With systemd Write a systemd unit for a Go service, tell systemd when it's ready, keep the watchdog fed, reload on SIGHUP and lock it down with sandboxing options.
- Per-Directory Environments With direnv Load and unload environment variables per directory with direnv, and pull each project's secrets straight from 1password with op read.
- Graceful Shutdown: Respecting SIGTERM With Go Catch SIGTERM with signal.NotifyContext and let http.Server.Shutdown finish in-flight requests before your Go service exits.
2021 4 posts
- Setting Env Vars From 1password Source secrets into your shell from the 1password CLI so your dotfiles can live in git with nothing sensitive on disk.
- Hot Reload: Respecting SIGHUP With Go Reload a Go web server's configuration when it receives SIGHUP, without restarting the process or dropping traffic.
- Working With Multiple Git Configs Give work, personal and side-project repos their own git identity, credentials and hooks with conditional includes.
- Build A Portable Lab In The Cloud Using Tailscale, Terraform and DigitalOcean Spin up DigitalOcean droplets with Terraform and cloud-init, join them to a Tailscale network, and tear it all down when you're done.