Articles

Notes from production

Field notes on shipping AI you can trust — evals, RAG, agents, and the engineering discipline around them.

What happens when you type a URL

Type pangaea.id, press Enter — and a global relay starts: DNS, anycast, a TLS handshake, a static page from the edge. The whole trip, in plain English.

DNSNetworkingCloudflare

Point the domain at Cloudflare (DNS)

The technical walkthrough: move pangaea.id's nameservers from Hostinger to Cloudflare without dropping email — the steps, the records to carry, and the dig check.

DNSCloudflareEmail

CI/CD: GitHub Actions → Cloudflare Pages

The technical setup: GitHub Actions → Cloudflare Pages — the project, a least-privilege token, two secrets, and the one-push-to-main release (with the gotchas).

CI/CDGitHub ActionsCloudflare

Root → www: the 301 redirect

Pick one canonical address: we 301 the bare pangaea.id to www.pangaea.id so all SEO credit lands on one URL — the Cloudflare Redirect Rule, step by step.

SEOCloudflareRedirect

Fast, safe SSL & security on the edge

The free, layered Cloudflare security baseline — Always Use HTTPS, TLS Full strict, HSTS, CAA records that protect auto-renewal, strict CSP, WAF, Turnstile.

SSLSecurityCloudflare

HTTP caching with Cloudflare's CDN

How cache headers in _headers plus Cloudflare's edge make a static site feel instant on repeat visits and almost free to serve — the full per-file policy.

CachingCDNPerformance

Email DNS: MX, SPF, DKIM, DMARC

How domain email works: MX delivers your inbound mail (checked by the sender), SPF/DKIM/DMARC prove the outbound (checked by the recipient), and using it in Gmail.

EmailDNSDeliverability

Why “faithfulness ≥ 0.90” should gate your deploys

A practical look at turning eval scores into a CI gate — and what to do when a release fails it.

EvalCI/CDRAG

Hybrid retrieval + reranking, explained

BM25 vs dense vs hybrid, and why a reranker is usually the cheapest accuracy you can buy.

RAGRetrievalReranking