# Baselarte

> Baselarte (Baselarte Ltda.) is a software engineering and creative technology company. It builds systems, interfaces and infrastructure that are simple on the surface and rigorous underneath.

The public website is a landing page plus a notes section (an AWS study guide, the site's design system a GitHub-to-AWS OIDC CI/CD guide and Cloudflare/R2/SSL notes), available in English and Brazilian Portuguese (switchable on the page). There is no product, pricing, blog or contact form published yet; inquiries are by introduction only. Motto: "Non desistas. Non exieris."

## Principles

- Simplicity is a discipline, not a starting point.
- Fundamentals over fashion.
- Build only what is necessary, then make it excellent.
- Clarity over abstraction.

## Accountability

The site quotes an IBM internal training presentation (1979): "A computer can never be held accountable, therefore a computer must never make a management decision." Baselarte builds tools that help people decide, not tools that decide for them.

## Pages

- [Home](https://baselarte.com/): landing page describing the company, its principles.
- [Notes](https://baselarte.com/notas/): index of study notes.
- [How Linux works, visual guide](https://baselarte.com/notas/linux/): visual, exam-style guide to users and root, permissions, the file tree, commands, processes, networking, SSH, firewalls, terminal and web monitoring tools, and clearing shell history.
- [Postgres for developers, the 80/20](https://baselarte.com/notas/postgres-for-devs/): relational databases 80/20 focused on Postgres — schemas, connecting, roles and passwords, access security, CTEs and window functions, indexes, UUIDs, full-text search, grants, backups (3-2-1) and caching, with a Docker lab.
- [Databases: reads, writes, replicas and sharding (Postgres and AWS)](https://baselarte.com/notas/db-replicas-sharding/): how the WAL feeds replicas, replication lag and read-your-writes, hot standby conflicts, RDS read replicas, Multi-AZ, Aurora, RDS Proxy, partitioning vs sharding (Citus, Aurora Limitless), with a Postgres replication lab in Docker and a request traced end to end, based on the Postgres and AWS docs.
- [Database migrations: Flyway, Prisma and Alembic](https://baselarte.com/notas/db-migrations/): what migrations are and the drift problem they solve, how the tools work (history table, checksums, locking), what the database must look like before the first migration, the first migration versus incremental deltas, baselining an existing database, and side-by-side setups for Flyway with Spring Boot, Prisma with TypeScript (plus TypeORM and Sequelize) and Alembic with FastAPI and SQLAlchemy; team conflicts (duplicate versions, Alembic multiple heads) and CI checks, expand/contract for zero-downtime changes, production practices and a Flyway lab in Docker.
- [React state: Context API and Zustand](https://baselarte.com/notas/react-state/): from the official docs, prop drilling, createContext and useContext, the reducer + context pattern, Zustand stores and selectors, per-request stores in Next.js, and when to use each.
- [Idempotency: safe retries for APIs and queues](https://baselarte.com/notas/idempotency/): how to make operations safe to repeat: HTTP methods, the Idempotency-Key header, unique constraints and transactions in Postgres, queue and webhook deduplication, how to test it (including concurrency) and how to run it in production.
- [Hosting and databases for small projects and small SaaS](https://baselarte.com/notas/small-project-hosting/): practical options and prices for landing pages and small SaaS (Vercel, Netlify, Cloudflare, Hostinger, Railway, Render, Fly.io, Hetzner with Coolify, Supabase, Neon, D1), free-plan limits and who should own the domain and accounts.
- [Contracts and pricing for small web projects](https://baselarte.com/notas/small-project-contracts/): contract types, scope, one-time vs monthly, handover of domain, DNS and accounts, copyright and software assignment under Brazilian law, and how to price landing pages and small projects.
- [SEO and AI search: meta tags, JSON-LD, robots.txt, llms.txt and getting indexed](https://baselarte.com/notas/seo-geo/): a walkthrough of a full SEO and GEO setup for a small bilingual site: head tags (title, description, robots, canonical), Open Graph and Twitter Cards, hreflang, JSON-LD (Organization, WebSite, WebPage, Service, FAQPage), sitemap.xml, robots.txt for search, AI-answer and training crawlers, llms.txt and llms-full.txt, noindex pages, content an AI can read, redirects, security headers and cache, IndexNow, validation, and a plan to make a site indexable.
- [Java, Python and TypeScript in practice: Spring Boot, FastAPI and Node (environments, variables and Docker)](https://baselarte.com/notas/language-runtimes/): A practical guide to three stacks: Java with Spring Boot and Maven, Python with FastAPI and uv, and TypeScript with Node. Tools, environments, how .env, environment variables and profiles reach the program, how to run, how to clean your machine, and how to run each one with Docker. Covers JDK, Maven (lifecycle, wrapper) and Spring Boot profiles, .env import and the property precedence ladder; Python pitfalls (PEP 668, venv), uv, FastAPI dev versus run and pydantic-settings; Node type stripping, tsc, npm ci, --env-file and zod; a Compose file running all three; cleanup commands and a symptom/cause table, with official sources.
- [Node.js and TypeScript end to end: event loop, streams, env, tests, CI/CD, observability and load testing](https://baselarte.com/notas/nodejs-typescript/): A study guide for developers who specialise in JavaScript and TypeScript on both the back and the front end, with Erick Wendel (Node.js core committer, author of the node:test mock timers, creator of a JavaScript runtime built from scratch on V8 and libuv) as the reference for going deep. Covers the language (single thread, promises, errors, ESM versus CommonJS), the runtime (V8, libuv, the event loop phases, microtasks, the thread pool) with a measured ordering experiment that differs between ESM and CommonJS, a measured event-loop blocking experiment (1.5 s of CPU makes /health wait 1.36 s; a worker thread brings it back to 10 ms), streams and backpressure (868 MB versus 75 MB peak memory for a 200 MB file), TypeScript in Node (type stripping, tsc, tsconfig) and in the browser (Vite, public VITE_ variables, Web Vitals), configuration with --env-file and zod, tests with node:test and mock timers, Vitest and Playwright, Docker and graceful shutdown (node as PID 1 takes 10 s to stop without a SIGTERM handler), CI/CD with GitHub Actions and supply-chain hygiene, observability (pino, AsyncLocalStorage, OpenTelemetry, event loop delay) and performance (CPU profiles, autocannon, k6), plus a study path, cheat sheet and review questions.
- [AWS Notes — IAM, Organizations, VPC, ECS, RDS, S3 and more](https://baselarte.com/notas/aws/): interactive AWS study guide (IAM, Organizations, VPC, ECS, RDS, S3, Route 53 and more) based on the official documentation, in English and Brazilian Portuguese.
- [Cloudflare: Domain, R2, SSL and AWS ALB Notes](https://baselarte.com/notas/cloudflare/): buying and configuring a domain, R2 with presigned URLs (private/public buckets, CDN), SSL certificates and HTTPS to an AWS ALB, based on the official docs.
- [Terraform 80/20, general and AWS](https://baselarte.com/notas/terraform/): the 20% of Terraform that covers 80% of the work (workflow, HCL, state, modules, CI) plus a complete AWS walkthrough (remote state on S3, VPC, EC2, IAM, S3).
- [Docker: images, containers, Compose, networks and a smaller attack surface](https://baselarte.com/notas/docker/): Docker from zero with a runnable lab: image versus container, essential commands, Dockerfile instructions and layer cache, PID 1 and signals, Ubuntu versus Alpine versus distroless (measured sizes), multi-stage builds, reducing the attack surface (no shell, non-root, read-only, cap-drop, secrets, scanning), port mapping and the Docker firewall bypass, bridge networks and DNS by service name, volumes, Docker Compose YAML, HEALTHCHECK and depends_on, logs, docker stats and cAdvisor, troubleshooting and a cheat sheet, with sources from the Docker docs, OWASP and CIS.
- [Kubernetes from zero: concepts, security and AWS](https://baselarte.com/notas/kubernetes/): what Kubernetes is and the problem it solves, the YAML files and their security options, small progressive labs with Docker (kind), and how to run it securely on AWS with EKS.
- [Observability: metrics, p95/p99, logs and traces](https://baselarte.com/notas/observability/): what observability is, the KPIs worth measuring, why p95 and p99 beat the average, how to add Prometheus and Grafana to a project, when you also need traces and logs (Jaeger, Loki, Elasticsearch), a hands-on Docker lab, and how to run it securely in production.
- [GitHub to AWS: OIDC, Docker, ECR and ECS](https://baselarte.com/notas/github-aws-oidc/): CI/CD from GitHub Actions to AWS for develop and production with no stored keys: OIDC provider and roles, GitHub environments, a Docker image per environment, ECR and an ECS rolling update (or plain Docker on EC2 via SSM), based on the official docs.
- [ECS from zero: a to-do app behind ALB, Cloudflare and RDS](https://baselarte.com/notas/ecs-todo-app/): step-by-step ECS Fargate for people who only used EC2: private VPC, ALB with a Cloudflare origin certificate imported into ACM, TLS to the container and to RDS, Secrets Manager, task definition, service and automatic deploy from GitHub.
- [Front end and back end on AWS ECS with a Cloudflare domain and origin certificate](https://baselarte.com/notas/front-back-ecs-cloudflare/): deploying a front end and a back end as two Docker images on AWS ECS Fargate: path-based routing on one ALB (/api/* to the API, everything else to nginx serving a Vite/React build), same-origin calls with no CORS, a domain registered at Cloudflare with proxied DNS and CNAME flattening, Full (strict) SSL with a Cloudflare origin certificate imported into ACM, security groups that only accept Cloudflare, caching rules for hashed assets and index.html, a GitHub Actions matrix that deploys each image, and a troubleshooting table. The images and the local routing were run; the AWS commands were not run against an account.
- [Cybersecurity for developers: where to start](https://baselarte.com/notas/cybersecurity-for-devs/): the entry point to the security series: the map of the field (red, blue, purple team, AppSec, cloud), core concepts (CIA, STRIDE, CVE/CWE/CVSS, ATT&CK), a five-stage study path, eight portfolio projects (scanning, CI security, a home SOC with Suricata and Wazuh, Sigma rules), where to learn, certifications, ethics and law, and a 90-day plan.
- [Network attack and defence lab: scan, sniff, tunnel, firewall](https://baselarte.com/notas/network-attack-defense/): a tutorial with exercises on your own machines (Docker or home network): TCP/UDP sessions, nmap, Wireshark, SSH tunnels, WireGuard VPNs (full tunnel, no DNS leak, kill switch), a hands-on project to build your own multi-country ProtonVPN-style VPN on cloud servers (NAT, per-country profiles, leak tests), ARP spoofing and SSH brute force, and the defences: Linux firewall (ufw, nftables), fail2ban, egress filtering and monitoring.
- [Secure web apps: headers, auth and AI agents](https://baselarte.com/notas/web-app-security/): HTTPS and security headers (HSTS, CSP with nonces, building your own middleware, Next.js and Nginx), cookie attributes, stateful sessions vs. stateless JWT (access + refresh tokens), CSRF, SQL injection and XSS from the builder's side, and AI agent security (prompt injection, excessive agency, MCP risks) per OWASP.
- [Web and host attack and defence: SQL injection, XSS, shells, hardening](https://baselarte.com/notas/web-host-attack-defense/): the attack lifecycle in a Docker lab (DVWA, Juice Shop): recon, SQL injection, XSS, command injection and reverse shells, each with its defence, plus Linux host hardening and the traces the blue team sees.
- [Social engineering: attacks, defences and a phishing-simulation lab](https://baselarte.com/notas/social-engineering/): attacks and defences: Cialdini's principles, phishing, vishing, pretexting, physical tactics, red flags, email authentication (SPF, DKIM, DMARC), phishing-resistant MFA, and a Gophish simulation to run locally.
- [OWASP Top 10 (2025): how apps break and how to protect yours](https://baselarte.com/notas/owasp-top-10/): how apps break and what to do about it](https://baselarte.com/notas/owasp-top-10/): the ten OWASP Top 10:2025 risks (broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, logging and alerting failures, mishandling of exceptional conditions), each with an example of the flaw, the fix that matters, a 1-hour/week/month action plan, a single-endpoint audit activity and OWASP sources.
- [Ethical hacking: where to practise, TryHackMe and the CEH](https://baselarte.com/notas/ethical-hacking-ceh-practice/): legal practice platforms (TryHackMe, Hack The Box, PortSwigger, OverTheWire), what the EC-Council CEH is, how to prepare or use it as a syllabus, and alternatives such as Security+, eJPT, PNPT and OSCP.
- [Sign-in and authentication: SSO, OAuth, OIDC and friends](https://baselarte.com/notas/auth-sso-oauth-oidc/): authentication vs. authorization, MFA and passkeys, SSO, OAuth 2.0, OpenID Connect, SAML, LDAP and Kerberos, a full "Sign in with Google" flow, and GitHub Actions to AWS with OIDC (no stored keys), with trust policy, workflow and common errors.
- [Cryptography, keys and SSH: how public and private keys work](https://baselarte.com/notas/crypto-keys-ssh/): hashes, symmetric and asymmetric encryption, public and private keys, digital signatures, Diffie-Hellman, TLS and certificates, private keys kept on the device (passkeys), sessions after sign-in, and SSH step by step, with 16 diagrams, a cheat sheet and common errors.
- [SMTP: how email travels and how to run it securely](https://baselarte.com/notas/smtp/): what SMTP is, the conversation command by command (EHLO, MAIL FROM, RCPT TO, DATA), ports 25, 587 and 465, STARTTLS versus implicit TLS and the downgrade attack, authentication, SPF, DKIM, DMARC, MTA-STS and DANE, open relays, open-source servers (Mailpit, docker-mailserver, Stalwart, Postfix) and a Docker lab that requires TLS and a password.
- [Attention Is All You Need, explained](https://baselarte.com/notas/attention-is-all-you-need/): a plain-language guide to the Transformer paper: queries, keys and values, scaled dot-product and multi-head attention with small worked numbers, positional encoding, the encoder-decoder architecture, masking, training, results and a runnable code example.
- [Open-source LLMs and AI agents: run, connect and deploy](https://baselarte.com/notas/llm-agents-open-source/): how much memory a model needs, running open-source models with Ollama, llama.cpp and vLLM, writing a tool-calling agent loop in plain Python, connecting agent and model through the OpenAI-compatible API and MCP, and renting a GPU in the cloud securely (SSH tunnel, no public ports). Also covers Chinese open-weights models (DeepSeek, Qwen, Kimi, GLM), ready-made agents (Hermes Agent, OpenHands, Aider, Goose, Cline) and RAG with Postgres and pgvector. Eleven hands-on activities with expected results.
- [MCP: build a server on top of your API and use it from a client or an agent](https://baselarte.com/notas/mcp-server-client/): the Model Context Protocol from zero with a runnable lab: host, client and server roles, tools, resources and prompts, an MCP server as a facade over the same shared code as an existing REST API (versus an MCP server that calls the API), tool design, Zod schemas, annotations, isError versus thrown errors, stdio and stateless Streamable HTTP with Host/Origin guards and bearer auth, testing with curl and the MCP Inspector, a TypeScript client, an agent loop with Claude and human confirmation for destructive tools, registering in Claude Code (.mcp.json), the Anthropic API MCP connector, security (least privilege, prompt injection through tool results, annotations are hints) and troubleshooting, with sources from the MCP specification and SDK docs.
- [Agent harness, RAG, guardrails, skills and AGENTS.md: the system around the model](https://baselarte.com/notas/agent-harness/): what an agent harness, context engineering, AGENTS.md, Agent Skills (SKILL.md), RAG (BM25, contextual retrieval, agentic search) and guardrails (lethal trifecta, Rule of Two, hooks) are, with system design and a runnable Docker agent, based on Anthropic, OpenAI, Matt Pocock and Mitchell Hashimoto.
- [Writing skills for AI agents: SKILL.md for Claude Code, Codex and open-source agents](https://baselarte.com/notas/agent-skills/): a simple guide to the open Agent Skills format (SKILL.md): what a skill is and does (progressive disclosure, skill versus AGENTS.md, tool and subagent), how to create one step by step with a tested code review example, where Claude Code, Codex, opencode and Hermes look for skills and what each adds (disable-model-invocation, agents/openai.yaml, permission.skill, metadata.hermes), a portable .agents/skills layout with symlinks, when to split a skill by intent and by risk or move content to references/, skills by theme (code, review, security, functional requirements, tests, release), description-writing and scope rules from the specification and Anthropic's best practices, skill security controls per agent, and a lab with a spec linter and a trigger test, with official sources.
- [A private AI workspace: self-hosting Odysseus, keeping data in and giving agents access](https://baselarte.com/notas/private-ai-workspace/): how to run your own AI workspace on your computer or in a cloud of yours without sending data to third parties, using the open-source Odysseus (AGPL-3.0, FastAPI, Chroma, SearXNG, ntfy) as a worked example: the four paths data leaves by (inference, tools, telemetry, operations), a per-feature egress map from the code (model providers, web search, weather, emoji CDN, Cookbook, skills, email), network isolation with a Docker internal network and a proxy (overlay validated with docker compose config), where to run it (laptop, VPS plus GPU, GPU VM), how to reach it (SSH tunnel, Tailscale, Cloudflare Access, companion app, API tokens and POST /api/v1/chat), layers of authority for agents (roles, scoped ody_ tokens, turn contract, the post-external-content approval gate, host overlays), maturity and threat-model caveats, a lab and a checklist. States which parts were run and which were derived from reading the code.
- [Doop: an open-source design canvas where humans and AI agents design together, and how to run it](https://baselarte.com/notas/doop-design-canvas/): what Doop is (open-source, AGPL-3.0 design canvas where people and AI agents design together, an alternative to Paper.design), its architecture (Node server on port 4400 with REST, WebSocket and MCP; React client; PGlite or Postgres), how to run it locally with Bun, with Docker Compose and in a cloud (Railway, Fly or a VPS with managed Postgres, BETTER_AUTH_SECRET and BETTER_AUTH_URL, /healthz), the key environment variables, connecting Claude Code, Codex and other MCP clients (OAuth or agent keys) and care points (open signup, AGPL, backups). Based on the project README; not executed.
- [Hermes Agent: memory, skills, messaging apps, guardrails and running it 24/7](https://baselarte.com/notas/hermes-agent/): what Nous Research's open-source Hermes Agent is, its agent loop, three-layer memory (MEMORY.md, USER.md, FTS5 session search, external providers), self-created skills (SKILL.md, skill_manage), the messaging gateway (Telegram, WhatsApp, Signal and others, DM pairing), its guardrails (command approval, blocklist, container isolation, prompt-injection scanning), installation, supported LLM providers and a Docker Compose setup to keep it running 24/7 on Hostinger or AWS.
- [Kimi K2 and K3: Moonshot AI’s open-weight models](https://baselarte.com/notas/kimi-k2-k3/): Moonshot AI's Kimi models: Mixture-of-Experts, K2 (1T parameters) versus K3 (2.8T, 104B active, 1M context, hybrid linear attention), how to use them by app, API or open weights, a worked cost example, benchmarks and how to read them, and the K2/K3 licenses.
- [Marketing and sales for services and SaaS: SPIN Selling, finding leads and closing](https://baselarte.com/notas/sales-marketing/): an analysis of Neil Rackham's SPIN Selling (research behind it, the four question types with SaaS examples, a 30-minute call structure, advance vs continuation), discovery conversations (The Mom Test), an ICP and fit checklist (BANT, MEDDIC, the 40% test), researched lead sources with confidence levels (response time in HBR 2011, referrals in the Journal of Marketing 2011, the 95:5 rule, outbound, The Challenger Sale), closing with a paid pilot, LGPD notes for cold contact, and a Python funnel log, with a source for each claim.
- [Company identity and accounts: domain, email, cloud providers and access](https://baselarte.com/notas/company-accounts/): how a company registers its own domain (registrant, auto-renew, registrar lock) and sets up professional email with Google Workspace or alternatives (MX, SPF, DKIM, DMARC, role addresses as groups); how to create and run company-owned organizations on Cloudflare, AWS (Organizations, root user, IAM Identity Center), Google Cloud (Organization, folders, billing), Netlify, Vercel and Supabase; ownership rules that avoid dependence on founders' or employees' personal accounts, an account inventory, and security: phishing-resistant MFA, separate admin and break-glass accounts, least privilege, credential management, access recovery, onboarding and offboarding checklists.
- [Agency hosting and client handover: Cloudflare, Netlify, Vercel and what to deliver](https://baselarte.com/notas/agency-hosting-handover/): a default stack and host per project type for agencies (landing pages, company websites, blogs, small apps), how Cloudflare Pages, Netlify, Vercel and GitHub Pages compare for agency work (previews, forms, commercial use, transfers), the preview-approve-merge workflow, forms/CMS/analytics, client-owned versus agency-managed accounts, the handover package (domain, code, hosting, DNS, credentials, README, editor guide, analytics, privacy, acceptance) and a go-live checklist.
- [Harvard CS50: who it is for, what it teaches and how to take it](https://baselarte.com/notas/harvard-cs50/): Harvard's free CS50x intro to computer science: who it is for, the week-by-week syllabus (Scratch, C, Python, SQL, web), the weekly rhythm with check50 and submit50, how to take it and claim the free or paid certificate, the CS50 duck and AI policy, and whether it still makes sense in the AI era.
- [Learning a language a little every day: reading, listening, writing, speaking and public speaking](https://baselarte.com/notas/language-learning/): what experiments say about learning a language with short, constant study: spaced repetition and retrieval, extensive reading and the 95-98% vocabulary rule, four-step active listening, written corrective feedback, 4/3/2 speaking and shadowing, and public speaking (rehearsal, reframing anxiety, slides, the failed power-pose replication), with a 30-minute weekly routine, expected results and a peer-reviewed source for each choice.
- [Good habits: building focus, reading, exercise and study](https://baselarte.com/notas/focus-and-attention/): how a habit is formed (cue, action, reward; Lally, Gollwitzer and Sheeran, fresh start, temptation bundling) and an eight-week plan to build four good ones: a longer attention span, daily reading, aerobic exercise and study by retrieval and spacing, with expected results, a progress log in Python and a peer-reviewed source for each step; also what research says, and does not say, about "brain rot".
- [Grokking Algorithms, book notes](https://baselarte.com/notas/entendendo-algoritmos/): book notes on Big O notation, binary search, sorting, recursion, hash tables, graphs, Dijkstra, greedy algorithms, dynamic programming and k-nearest neighbours, with examples and code.
- [Software Engineering at Google, book notes](https://baselarte.com/notas/software-engineering-at-google/): book notes on time, scale and trade-offs, Hyrum's Law, testing, code review and continuous delivery.
- [AI Engineering, book notes](https://baselarte.com/notas/ai-engineering/): book notes on tokens, sampling, prompting, RAG, agents, evaluation, finetuning, inference and AI application architecture.
- [Sitemap](https://baselarte.com/sitemap.xml)