We write down what we learn.

Today Section Co. is officially open for business 🙌

What started as a thought exercise on how artificial intelligence might work in the context of architecture has grown into Section Co., a licensed architecture firm and applied AI lab. We're licensed to practice architecture in Colorado, Kentucky, Utah and Wisconsin, with Florida and Texas coming soon.

Imagine this: you merge to main, and a minute later your app is live on fresh servers. No SSH keys to manage, no ports open to the world, and nothing to babysit.

That's our setup with Kamal Deploy and GitHub Actions, and you can have it running today. This article covers how to build it, including a not-so-fun Docker surprise that quietly bypasses your firewall, and the one-line fix.

Close every inbound port on your Ubuntu server and still serve the world. Here's how to run a Cloudflare Tunnel as a locked-down systemd service.

ZFS gives you checksummed data, cheap snapshots, and software RAID that you can actually trust. In this article I'll walk through installing Ubuntu Server on a two-drive server with the operating system on a mirrored ZFS pool and the bootloader on plain, mirrored ext4. We'll start with the step most people skip: making sure your RAID controller isn't getting in the way.

We've started to add Ubuntu servers alongside our FreeBSD fleet, and deploying Linux servers has been a learning curve. We still love FreeBSD, but some software packages we need to use depend on Linux.

This article is about how to set up Tailscale on your Ubuntu server and then how to block all inbound traffic.

For most applications, spinning up HTTP for localhost development is fine, but what if you need HTTPS for things such as secure cookies or HTTPS-only headers? Let's explore how to use Caddy to make HTTPS for localhost development super easy.

We LOVE Ollama and use it to run both local and cloud-based AI models on our development laptops. That said, we've run into a few issues with pulling the latest models over the past few months, so here's how to solve it.

We set up all of our FreeBSD servers to be accessed via Tailscale's SSH so we documented it here for our quick reference in the future for new server setup. Hope it helps someone else as well.

We needed a simple and secure way to run Tailscale as a VPN exit node on a FreeBSD server so we documented it here for future reference. Hope it helps someone else as well.

Field notes from bringing our first datacenter server's networking online.

FreeBSD’s native support for ZFS snapshots and jails provides a powerful foundation for immutable deployments. By creating a new jail from a ZFS snapshot for every release, we get instant rollbacks, zero‑downtime upgrades, and a clean, reproducible environment. This article walks through the (very opinionated) flow that we use, from jail setup through running Caddy as a health‑checked reverse proxy in front of the jails.

At Section we LOVE Temporal. It gives us a high velocity in development because our code doesn't have to worry as much about implementing retry logic. We are in the process of moving to a self-hosted Temporal server and as such we're starting with the baby step of setting up a Temporal CLI dev server to run on our FreeBSD deployment platform.

At Section, we love Turso, Go, and FreeBSD. This guide walks you through building and installing the Turso Go client on FreeBSD, so that you can start writing Go applications that connect to Turso from your FreeBSD server.

Sometimes in life you stumble upon unexpected joy :) For me, it was recently Zed. After a couple of weeks, I was completely sold on Zed as my new IDE. Then one morning I was thinking about how insanely fast Groq’s inference is and it dawned on me: what if I could use Groq as my inference backend in Zed?

At Section, we deploy on FreeBSD and use Infisical as a security store. At the time of this article, there isn't a FreeBSD port available for Infisical. So this guide will walk you through how to install Infisical CLI on FreeBSD.

OVHcloud supports FreeBSD on some, but not all, of their server offerings. In this article I'll demonstrate how to install FreeBSD on any OVHcloud bare metal server instance.

This guide shows you how to configure your FreeBSD server to accept connections only through Cloudflare Tunnels, blocking all other inbound traffic. You can then control access using Cloudflare Zero Trust.

Learn how to securely expose FreeBSD services to the internet using Cloudflare Tunnels. This step-by-step guide shows you how to set up and configure tunnels to protect your FreeBSD applications with Cloudflare's security features.

Getting FreeBSD 14.3 running on Parallels 26 was a bit of a challenge. Here are the steps I took to get it working:

At Section, we LOVE Temporal. It gives us a high velocity in development because our code doesn't have to worry as much about implementing retry logic. We also are heavy users of Cloudflare Workers. The combination of these two is awesome, but not straightforward. Let's dig in:

I recently was reviewing the error logs on a Cloudflare Worker that had only been active for a week and was surprised to see the extent of attacks occurring that were sniffing for leaked credentials. Let's take a look at some of the URLs that were being accessed.

I was setting up a new Linux development environment and got the below error whenever I ran ‘go build’:

github.com/tursodatabase/go-libsql: 
build constraints exclude all Go 
files in [directory]

I’ve been writing webpage copy for the pricing page of a SaaS product and decided it would be interesting to compare ChatGPT 4, Claude 3.5, and Grok 2 LLM AI models while doing so (in hindsight I should have also included Llama).

Using HTMX and Cloudflare Workers is a great way to sprinkle in some dynamic functionality into your Cloudflare Pages static site. Let's look at an example of handling a form submission.

Nested CSS is now baseline, meaning that it's finally supported across all the major browsers. We've been playing around with it and have found it really improves readability of your CSS. Let's go through some examples.

Wait! What? Securing a static site? Yup, even if your site only contains static content, it doesn't mean you're safe from vulnerabilities like Cross-Site Scripting (XSS) and others. This becomes an even bigger issue if you've added forms or other interactive elements. The good news is that securing your site is straightforward.