Projects

The underpinnings for any Go command-line tool, and (as a few of my projects now prove) for comprehensive web services too. It standardises the boilerplate and wiring you end up writing in every Go project, and puts config, logging, self-update, a DI container and the rest straight at your fingertips. Highly opinionated, and it makes some calls people will disagree with, but it works, and it works really well. The CLI it ships with is a big part of that: keeping a Go app built, updated and maintained becomes almost trivial.

The Rust counterpart to go-tool-base, and deliberately not a straight port. Rather than copy the Go version wholesale, it reimagines the same idea through Rust idioms and off-the-shelf crates, while keeping a common signature and feature set so the two feel familiar if you switch between them. The same streamlined developer experience, done the Rust way.

A layered configuration store: read from files, the environment, flags and remote backends, ask where any value came from, and write a change back without wrecking the file. Rewritten off Viper to own config I/O end to end.

Remote systems as first-class layers, with the same precedence and provenance a file gets, and write-back wherever the system allows it safely.

Read and write config files from filesystems other than the local disk: compiled into the binary, on a remote host over SSH, or in a cloud object store. config.OS() and config.Dir ship in the core.

One small module per file format, so you only compile the parsers you use. YAML is built into the core.

Use a go-billy filesystem anywhere an afero one is expected: a complete billy-to-afero adapter with optional locking that makes a live handle concurrency-safe.

A safe entry point for opening URLs: scheme allowlist, length bound and control-character rejection.

Startup ordering, health probes, graceful shutdown and self-healing restarts for Go services.

A storage-mode abstraction for user-supplied secrets: env-var reference, OS keychain or literal value, with a pluggable backend and an auditable keychain opt-out.

Structured, user-friendly error reporting for CLIs: actionable hints, exit codes carried on the error, debug-gated stack traces and a pluggable support channel.

The error package the estate owns: stack traces, user-facing hints, structured attributes for logging, and an aggregate that behaves like the standard library's, so nothing goes missing below a Join. It imports nothing outside the standard library, and a test enforces that.

Hardened OpenTelemetry setup for Go services: OTLP logs, metrics and traces, wired up once and correctly.

Structured, themeable output for CLI tools: one Renderer facade for text, JSON, YAML, CSV, TSV and Markdown, plus tables, spinners, progress bars and status lines. Framework-free core, with an opt-in cobra subpackage.

Strips credential-like content from free-form strings before they reach logs or telemetry.

Bounded, DoS-safe regex compilation for patterns that might come from untrusted sources.

Find a project's root by walking up to a marker file, over an injected afero filesystem so it stays testable.

Edit a YAML document without destroying it: comments, key order, quoting and block styles survive a targeted change. Built for config, useful on its own.

Transport-agnostic request authentication: API key, JWT/OIDC and mTLS, usable from either transport.

A light gRPC client dial factory: a decoupled target, go/tls credentials and the transit client interceptors.

A hardened *http.Client factory: secure TLS defaults, downgrade-proof redirects and the transit middleware.

A framework-free, mkcert-style local development CA: a per-machine root, cross-OS trust-store install and browser-trusted HTTPS on localhost and LAN IPs with zero manual setup.

Hardened, framework-free TLS plumbing for Go: sensible defaults and the pieces the transports and clients build on.

The shared HTTP and gRPC client middleware both factories use: retry, circuit-breaker and auth.

A framework-free HTTP + gRPC + gateway server stack: hardened server constructors, health endpoints, authentication and security headers.

Cardinality-safe Prometheus instrumentation: a scrapeable /metrics endpoint (Go runtime, process and build-info collectors), optional pprof, mounted on your server or standalone. The pull/scrape counterpart to the OTel observability module; go/transport, gRPC and OTel isolated in opt-in subpackages.

Serve an OpenAPI spec and an interactive Stoplight Elements docs site from one Register call, mounted on your transport mux. Keeps the ~2.4 MB embedded docs UI out of servers that don't need it.

A light, framework-free multi-provider AI chat client with provider support kept opt-in.

Receive, reply and moderate across chat platforms with no vendor SDK in the core. The other side of the chat modules: those talk to models, this one talks to the people.

The application context and command contract for RTB-based CLI tools: App<C>, ToolMetadata, typed config and cancellation.

Embedded-asset overlay filesystem: ship defaults in the binary, override on disk.

A unified AI chat client: Claude, OpenAI, Gemini, Ollama and compatibles behind one interface.

The CLI runtime family: a four-crate workspace on one version line. rtb-cli builds the application; the others each register a built-in command into the same link-time registry.

Strongly-typed layered configuration with hot reload.

User-secret storage behind one seam: env-var reference, OS keychain or literal config.

Error types and the miette diagnostic report pipeline for CLI tools.

Forge release providers (GitHub, GitLab, Gitea, Codeberg, Bitbucket), plus git operations over gix.

Strips credential-like content from strings before they reach logs or telemetry.

Opt-in, consent-gated anonymous usage telemetry with pluggable sinks.

Reusable terminal-UI widgets: wizards, tables and spinners.

FFmpeg in pure Go with no install, no CGO and no disk: a WASM build of FFmpeg running over a virtualised, in-memory filesystem, so media processing ships as a single binary and stays sandboxed. That virtual FS layer is a big part of the appeal, and the whole thing sits behind one clean Go interface, no dropping to a shell, no wrangling CGO bindings. A native FFmpeg backend is on the way too, for the performance edge cases where you can trade the security posture for speed, and it speaks the very same interface.

Keryx is ancient Greek for 'the herald', which is precisely the job. A little utility I built for myself because I'm dreadfully bad at social media: point it at the page bundle for one of these blog posts and it turns that into a sharp piece of short-form media, ready to post to the platforms I want to be on.

Krites is ancient Greek for 'the judge', and judging photographs is the whole job. I built it for an audience of one, my wife: a simple, UI-driven tool (not a command line in sight) that helps her rip through culling 4,000-plus wedding images to her own standards. It leans on local ML rather than a cloud-AI subscription, so it works wherever she is, signal or not. It's since grown an optional AI critic as well, expert feedback on composition, colour and technique, there to help her learn rather than to do the judging for her.

Turn a repository's Conventional-Commits history, or a release-notes archive, into a structured, categorised changelog.

Public container images that keep the toolchain repeatable across software and infrastructure projects.

Reusable GitLab CI/CD components I include rather than copy across my projects, so the pipeline lives in one place instead of drifting copy-paste in every repo.

A Claude Code plugin marketplace for the reusable skills, guardrails and workflow habits I use across my projects.

Forge release operations: a provider contract, registry and credential chain, with no vendor SDK in the core. Each forge is a swappable provider module.

The Homebrew tap for phpboyscout tools, used to distribute the binaries that come out of the release pipeline.

Git repository operations for Go: clone, commit, worktrees and tree inspection over go-git, behind focused role interfaces.

A standalone command-line tool for signing and verifying release artefacts with OpenPGP. The private key never leaves your KMS, HSM or PEM file, and nothing about it cares what language your project is written in.

A small, standalone module for creating and verifying signatures on files. I pulled it out of go-tool-base so it stays lightweight and anything can use it, not just go-tool-base projects: it's what signs the CLI binaries and the ffmpeg-wasm bundle I distribute. It works through pluggable backends, so the key can live somewhere like AWS KMS rather than on disk, with Google Cloud, Azure and HashiCorp Vault to follow.

A support and moderation bot bridging Discord and GitLab: it answers what the docs already cover, with citations, and offers to raise an issue with the thread attached when it can't. Every question it can't answer is a documentation gap with a timestamp on it.

The small first stack for a new AWS account: remote state, CI OIDC identity and an aws-nuke config. It deliberately stops there.

A GitLab Runner fleeting fleet on AWS: one always-on manager plus scale-to-zero spot workers on the docker-autoscaler executor. Built to replace cattle-ops/gitlab-runner and expose the levers it hid, including worker disk size and a shared cache layer.

The downstream account baseline: audit logging, threat detection, account hardening, operator access and the alerts wiring I keep reusing.

The KMS-backed release signing module: asymmetric keys, CI signer role and the policy shape needed to sign without ever exporting the key.

This site: the home for the project write-ups, leadership pieces, tutorials and the occasional personal essay.

Hailey's vanlife photography and galley-kitchen cooking site, built ahead of the 2027 trip so the shape exists before the content does.

A bespoke site for my dad's 15th-century coaching inn and bed and breakfast in Shepton Mallet.