A one person lab, with uptime.

Field note

No private key ever touches the server: the shop loads watch-only xpubs and derives a fresh address per sale from a RANGED descriptor with .derive(index), since calling .script_pubkey() without deriving always hands back /0/0 in embit. The entrypoint runs check_depix before gunicorn and refuses to start the app if the configured xpub derives an address other than the expected one, so a swapped xpub becomes a broken deploy instead of a silently redirected payment. On Liquid the blinding key is derived per address via SLIP-77, HMAC-SHA256 of the master blinding key over the scriptPubKey. And the reaper command destroys the buyer's personal data 72 hours after delivery, which puts privacy law in cron instead of on paper.

Field note

The stock firmware misbehaves on a T-Display with the CH9102F: opening the serial port from Blockstream Green or SideSwap pins GPIO0 low and kills the Boot button. Ticking Disable ModemHandShake in the driver holds until the first app that overrides it, so the answer had to come from the circuit: RTS leaves the CH9102F, runs through the 10k R19 into the base of Q2, whose collector pulls GPIO0 down, and the modern driver holds RTS at a constant DC level, saturating that base for good. Swapping R19 for a 100nF SMD 0603 ceramic capacitor turns the coupling from DC to AC: the steady level is blocked, the fast reset and boot pulses still get through. A software bug fixed with a soldering iron. The Secure Boot .pem keys are the first line of the .gitignore and were never committed, because losing that key bricks every board already fused to it.

Field note

Access control runs on two axes that never mix: administering means writing and follows unidade_administradora_id, while commanding means reading consolidated numbers and follows the chain of subordination, walked with a recursive CTE over unidade_pai_id. Merge them and anyone who only needs to read totals gets write access to national ID numbers and health records for entire battalions, and health data is a special category under Brazilian privacy law. The filter lands in SQL, not on screen: hiding the button is a courtesy, the clause is what stops you. Same spirit in the migration runner, which runs at boot under pg_advisory_xact_lock with a sha256 per file, so editing a migration that was already applied makes the server refuse to start instead of drifting in silence.

Field note

No Meta API publishes a link sticker to a Story, so a headful Puppeteer under Xvfb drives an already logged in Meta Business Suite and posts to Instagram and Facebook in one shot. The right sticker only lives under Edit > Stickers > Link, because the 'Add link' button next to it is the swipe-up that Meta itself flags as not supported on Instagram; and its container measures 0x0, so the real box has to be rebuilt from the three handles. After 'Share' the page navigates away and tears down the context, which means 'Execution context was destroyed' is the success signal, not a failure. Where the browser could be killed, it was killed: Amazon became a plain HTTP getShortUrl call with the Associates panel cookie, and Mercado Livre became createLink, both Chromium free.

Field note

For Bitcoin there is no proprietary explorer in the path: the backend speaks Electrum JSON-RPC over SSL against a pool of three servers, turns the scriptPubKey into an Electrum scripthash and parses the raw transaction locally with embit. On Liquid the confidential addresses come off the descriptor via SLIP77 and unblinding happens on the box itself, with requests round robined between liquid.network and blockstream.info. Deduplication is per wallet, unique on (wallet, txid), so the same txid can sit on both ends of an internal transfer without either side being dropped, and an is_internal flag keeps those amounts neutral in invested and P&L. The price service has a real circuit breaker: three consecutive Binance failures fall through to AwesomeAPI, backed by a 30 second Redis cache and a one hour last known value for emergencies.

Field note

This is not a pile of tutorials. The convention is written down in CLAUDE.md and all 18 stacks follow it: restart unless-stopped rather than always, no-new-privileges:true, bind mounts under /srv/<service> instead of named volumes, secrets only through interpolation, TZ America/Sao_Paulo, a database healthcheck gated by depends_on condition service_healthy, and one database per stack instead of a shared Postgres. The guides document the trap that actually breaks an install: create the /srv folders over SSH before deploying the stack, or Docker creates them as root and the non-root container cannot write. The Cloudflare Tunnel rule is just as specific, because cloudflared runs bare metal on the host and is not part of the stack: Cloudflare terminates TLS and the container serves plain HTTP, so the public URL variable points at https while the internal protocol stays http. The densest guide covers backing up an Orange Pi 5, aimed squarely at what Timeshift misses, the bootloader in SPI NOR and the raw NVMe sectors, across four disaster scenarios.