[
9 Stories
[

Building the Tuonela Platform

From scattered scripts to unified CLI, from build-vs-buy decisions to migration lessons. The technical journey of building a modern content platform on Astro and Cloudflare.

The Fifty-Thousand-Word Stack Decision
The Fifty-Thousand-Word Stack Decision

I asked my AI assistant for a quick overview of static site generators. Four hours later, I had enterprise-grade analysis of seventeen frameworks, fifty-one thousand words of hosting research, and zero lines of code. The decision was always going to be Astro.

by Petteri Leppikallio & Marvin, Dec 9, 2025

The Two-Repository Architecture That Wasn't
Coming Soon Story 2 of 9
[
engineering
engineering
[
The Two-Repository Architecture That Wasn't

Marvin proposed an elegant two-repository architecture to solve draft privacy. GitHub Actions crossing repos. PAT tokens. Clean separation of concerns. I asked one question: "Why can't we just use a single private repo?" Sometimes the clever architecture is just complexity in disguise.

by Petteri Leppikallio & Marvin, Dec 10, 2025

When $99 Beats 99 Hours: A Build vs Buy Meditation
Coming Soon Story 3 of 9
[
business-cost
business-cost
[
When $99 Beats 99 Hours: A Build vs Buy Meditation

Some things you can't cost-effectively build yourself. This is about recognizing when to buy design taste instead of trying to reverse-engineer it, and learning to question the analysis that leads you there.

by Petteri Leppikallio & Marvin, Dec 9, 2025

The Four-Hour Detour
Coming Soon Story 4 of 9
[
engineering
engineering
[
The Four-Hour Detour

Four hours debugging Gitleaks, Biome, TypeScript, DNS conflicts, and a missing 14-character config line. We migrated to Workers for SSR and native bindings we'd never use. Twenty-four hours later, we'd migrate back.

by Petteri Leppikallio & Marvin, Dec 10, 2025

The R2 Integration That Security Killed
The R2 Integration That Security Killed

Building elaborate R2 architecture with manifest verification felt like professional-grade security until the audit revealed the truth: the manifest was checked at build time and ignored entirely at runtime. The migration to Cloudflare Images was supposed to fix everything, and then we discovered the public variant sitting in the allowlist like a landmine.

by Petteri Leppikallio & Marvin, Dec 10, 2025

Trust Without Verification
Coming Soon Story 6 of 9
[
engineering
engineering
[
Trust Without Verification

Three hours debugging SSR truncation. Five middleware fixes that changed nothing. The problem was build output, not runtime. Sometimes the hardest lessons are about questioning the hypothesis, not fixing the code.

by Petteri Leppikallio & Marvin, Dec 10, 2025