Guide

I’ve just completed migrating my blog from WordPress to a static site generator. This new setup gives me the best of both worlds: the simplicity and security of static files with the convenience of a visual editor.

Why I Made the Switch

After years of maintaining WordPress sites, I wanted something simpler:

• No database to maintain - Everything is stored in Git
• Better performance - Static files served from a CDN
• Enhanced security - No server-side code to exploit
• Version control - Every change tracked in Git
• Simple backups - Just clone the repository

The Technology Stack

I chose a modern JAMstack approach:

Recently I read an article on the concept of Entity Services over at InfoQ by Michael Nygard (and written up by Jan Stanberg). I’m not attempting to comment deeply on the article itself, only on the subject.

This is a topic I’ve spent an inordinate amount of time on over the years, you can see my thoughts in many a blog post and talk.

In talk form, I give a rundown of the problem and the issues it will create here while introducing the Muon project.

When building microservices, you have to naturally distribute your application around a network. It is almost always the case that you are building in a cloud environment, and often using immutable infrastructure.

The Challenge of Dynamic Service Location

In traditional monolithic applications, components communicate through in-process method calls. With microservices, these components are distributed across a network, and their locations can change dynamically due to:

• Auto-scaling events
• Service failures and recovery
• Deployments and updates
• Infrastructure changes
• Container orchestration

This dynamic nature makes hardcoding service locations impractical and brittle. Service discovery provides a solution by enabling services to dynamically find and communicate with each other.

A question often posed to us during our research and project work is “how should I secure a Microservice?”

When it comes to securing microservices, two primary approaches dominate the landscape: session-based security and OAuth/token-based security. Each has its strengths and weaknesses, and understanding these differences is crucial for making the right architectural decisions.

Session-Based Security

Session-based security represents the traditional approach to web application security. In this model: