Blog

Notes on Elixir, Rust, Python and the Linux command line — written while building things, mostly so I can find the answer again next year.

The engineering here is mine; some of the prose had help. How these posts get written.

All writing

26 posts
11 Sep 2026
15 min

Beyond mTLS: identity for a fleet of IoT devices

Certificates and mTLS are the easy part. The hard part is identity over a device's whole life: first enrolment, rotation, power loss mid-rotation, and a gateway that was offline for two years.

architectureelixiriotnervessecurity
03 Sep 2026
1 min

Compile-time Markdown in Phoenix

Parsing every post at build time removes a whole category of problem: no database, no cache, no cold render.

buildelixirphoenix
Series · 5 parts · complete

A Nerves system for the IOT-DIN gateway

Writing a custom Nerves base image for a CompuLab IOT-DIN-IMX8PLUS by hand: the packaging bugs, the flashing dead end, and the DDR failure that stopped it booting.

▸ show all 5 parts
  1. Authoring a Nerves system by hand
  2. It compiles. It still won't package.
  3. Flashing without the vendor's flashing tool
  4. Ran out all six config attempts
  5. Provisioning the next board
Series · 4 parts · in progress

A custom Nerves gateway on the STM32MP1

Building a Nerves system from scratch for the STM32MP157F-DK2: the boot chain, device trees, and the first attempt at a working build.

▸ show all 4 parts
  1. Why build a custom Nerves gateway from scratch
  2. The STM32MP1 boot chain, from power-on to Linux
  3. Device trees demystified: reading the hardware map
  4. Building the Nerves system: the first attempt
Series · 5 parts · in progress

Secure boot on Nerves

Carrying everything learned on the lab unit into a real, purpose-built Nerves system — without touching the build running in the field.

▸ show all 5 parts
  1. From a lab unit to a real production Nerves system
  2. Forking the system, and a first signed boot
  3. Signing the kernel, clean on the first try
  4. The build signs itself now
  5. It boots — and a gate I didn't know I had
Series · 10 parts · complete

Secure boot on an i.MX8M gateway

Adding proper secure boot to an industrial IoT gateway, on a disposable lab unit, making every mistake where it costs nothing.

▸ show all 10 parts
  1. The hardware: an i.MX8M gateway with a TPM
  2. Understanding HAB keys: SRK, CSF and the fuses
  3. Generating HAB keys with NXP's CST
  4. Backing up the eMMC before touching anything
  5. Getting the U-Boot build environment exactly right
  6. Building the first unsigned bootloader
  7. A real mistake, and rescuing myself from it
  8. Turning on secure boot, for real this time
  9. Signing the kernel, and a bug the chip caught
  10. From here to the end: what is left to lock down