What’s underneath your app.
I’m Peter Wiggers. I studied civil engineering at TU Delft, where you learn to read the ground before you build on it. Then I spent thirteen years doing the same in IT, building the cloud platforms that banks, logistics companies and regulated SaaS quietly depend on.
So this blog is drawn like a soil survey. Every topic is a layer, from the AI growing at the surface down to the security that everything rests on.
Drill log
A $100 Claude seat holds up to $4,000 of API tokens
A Team Premium seat includes billions of tokens a month. Route your people through your own API key instead, and you pay list price for work the seat already covers.
Stop rebuilding your CI runner on every push
Stateless CI runners made builds clean, and then made us write caching logic into every workflow. Warm microVM snapshots give you a disposable runner that already remembers everything.
Sovereignty needs an exit, not just an address
Hosting with a European company is necessary, but it doesn't make you sovereign on its own. Being able to move between European providers whenever you want does.
One private network for my clusters, my colleagues and my living room
Why I love Tailscale, and how I use it to reach Kubernetes APIs, Postgres, colleagues' machines and my Home Assistant setup without opening a single port.
What two SOC 2 cycles taught me about security engineering
Compliance frameworks are mostly about proving you do what you say. Here's how to make that cheap.
Use the cloud, just don't let your code know which one
My one rule against vendor lock-in. Only use managed open source, so your application talks PostgreSQL, RabbitMQ and Kubernetes, and never a cloud SDK.
Making Flux fast with 1,200 tenants in one repository
What I learned tuning Flux's kustomize-controller for a monorepo with 1,200 tenants, including a /tmp trick that made it into the official Flux docs.
Your DNS ad blocker is a man in the middle you invited
DNS-level ad blocking with public blocklists is great, until you realise you've given strangers the power to rewrite where your traffic goes.
Pick an LLM provider you can walk away from
Notes on designing AI features for a regulated SaaS where auditability matters more than the leaderboard.
Warm standby beat multi-cloud, and it wasn't close
A regulated customer asked for multi-cloud resilience. What they actually needed was a second region and a rehearsed failover.
Internal apps deserve real certificates too
Stop installing private root CAs on every device. With Let's Encrypt DNS validation, internal apps get publicly trusted certificates without ever being reachable from the internet.
Your requests and limits are where the cloud bill hides
How right-sizing Kubernetes workloads cut public cloud spend by roughly 40% across thirty-odd clusters.
Database migrations in GitOps need a Job, not a pipeline
With Flux there's no deploy pipeline to run migrations in. A Kubernetes Job in its own Kustomization, plus one dependsOn, gets you migrations that run once and before your app.