Terraform is an open-source Infrastructure as Code (IaC) tool by HashiCorp that lets you define and provision cloud infrastructure using a declarative configuration language. This guide explains what Terraform is, why it matters, and how to get started managing infrastructure across AWS, Azure, and Google Cloud.
Our primary region could not write to its database for 38 minutes, yet Route 53 kept answering with the primary endpoint. The health check was green the whole time. Then automatic failback broke writes a second time. Here is why, and the health check design that fixed both.
Our per-tenant limit was 100 requests per second, yet one tenant pushed 310 through to a partner API that then blocked us. The Redis limiter read the counter, decided in Node, then wrote back. Moving the whole token bucket into one Lua script fixed it.
Backup and restore, pilot light, warm standby and active-active are not maturity levels. They are price points for a given RPO and RTO. Here is how we picked a different strategy for each of five workloads, what each one cost, and how we prove the numbers.
We took a Laravel API from 300 to 4,000 requests per second without rewriting it. The wins came from four layers: Octane workers, a layered cache, Horizon queues with separate supervisors, and read replicas with sticky writes. Here is the setup and the traps.
After an OOM kill, our warehouse consumer restarted from its last committed offset and applied a few seconds of stock movements a second time. A quick fix that committed first lost events instead. Storing offsets in the same database transaction as the results fixed both.
New Pods failed with CreateContainerConfigError while old ones kept running. A key renamed in the cloud secret store made External Secrets rewrite the Kubernetes Secret without DATABASE_URL. We show how to find the missing key fast and how to fail before rollout next time.
A practical theming setup built on plain CSS: semantic custom properties, light-dark() for color schemes, clamp() for fluid type and spacing, and min()/max() for layouts that need no media queries. Includes the mistakes that broke our first attempt.
Every Postgres database we inherit has the same hidden costs: indexes nobody reads, tables twice their real size, and tables without a primary key. These are the catalog queries we run on day one, how to read them safely, and how to clean up without downtime.
A single 40-character form value froze an API worker for minutes. A nested quantifier in a validation regex made Python's backtracking engine try exponentially many paths. We show how we proved it, rewrote the pattern and added RE2 and CI checks.
After we raised a Lambda timeout to handle large PDFs, customers started getting the same invoice email twice. The SQS queue's visibility timeout was still 60 seconds, so slow messages reappeared and a second invocation picked them up mid-processing.
We built a pre-push gate that runs linters, secret and SAST scans, containerised tests and an LLM review of the diff before code leaves a laptop. The hard parts were not the model call: ordering, cost caps, redaction, fail-open rules and keeping CI as the real authority.
Our Terraform repo grew to two clouds, four environments and 140 state files, and every change felt risky. This is the layout we moved to: versioned modules, a unit catalog, Terragrunt stacks per region, and one state file per small blast radius.
Our trading dashboards queried a nightly warehouse and were always hours behind. We moved to Kafka, Flink SQL and Apache Doris: exactly-once ingestion into merge-on-write tables, pre-aggregated minute metrics and partitioning that keeps dashboard queries well under a second.
We stopped adding patterns because a book listed them and kept only the three that removed real pain from a Node.js billing service: strategy for pricing rules, adapter for payment providers and plain constructor injection. Here is the before and after code.
Our API had 1,400 tests and still shipped a breaking field rename, a 40-second p99 under load and an object-level authorization hole. Each one belonged to a test type we were not running. This is the map we now use: which API test type catches which failure, with a small example of each.
Passing --workers 4 to docker run crashed the container with exec: "--workers": executable file not found. Arguments after the image name replace CMD entirely; they do not append. We explain the override rules in Docker, Compose and Kubernetes and the image layout that makes extra flags safe.
Terraform created our new EKS cluster cleanly, then nobody could use it: kubectl said we must be logged in, and the Helm step in CI failed the same way. The cluster had API-only authentication, no creator admin, and access entries for the wrong role ARNs.
Our order worker stopped completely for 47 minutes and the throughput alarm never fired. With no datapoints arriving, the alarm moved to INSUFFICIENT_DATA instead of ALARM, and only ALARM had an action. The fix was choosing missing data treatment per alarm.
Our nightly export finished its work in 20 minutes, yet the Job sat at 0/1 completions for six hours and then failed with DeadlineExceeded. The database proxy sidecar never exited. We replaced shutdown hacks with native sidecars (restartPolicy: Always init containers) and show a full repro.
Our cleaning job filled missing countries and lowercased emails, yet the output table still had nulls and mixed case. Chained assignment wrote to a temporary copy, and the warning that said so had been silenced. We fixed it with .loc and turned on Copy-on-Write.
Moving an on-premises RHEL 9 VM to EC2 with VM Import failed twice: first on the VMDK format, then on GRUB. Once the AMI finally booted, it had no network. Here is the pre-flight checklist we now run on every guest before uploading a disk.
After saving their profile, some users saw the old values on the next page and saved again. Laravel's sticky option only covers a single request, and the redirect read from a replica that was seconds behind. We fixed it with a WAL position check.
Our nightly export reported the right row count but wrote an empty CSV. A refactor had turned a list into a generator, and the first loop consumed it. Here is how we traced it, the three ways to fix it, and the type hints that now catch it.
Event-driven is not one pattern but four, and teams get hurt when they mix them up. We compare event notification, event-carried state transfer, event sourcing and CQRS on one billing example, with the costs each one adds and the signals that tell you which fits.