Friday Fixes: The Blog Was Paying for Readers Who Never Logged In

(Editorial note: I migrated to entirely local AI. No cloud models or tokens anymore. All work summarized below, and blog posts starting with this one, were done by DeepSeek v4 Flash Next Coder running on a dual-node DGX Spark cluster.)

The Vercel dashboard said the blog was using about 95 percent of the account’s Fluid CPU over a month. Most of my readers never open an admin panel. They read a post and leave. So the bill did not add up.

I went looking for the work the blog was doing that nobody asked for, and I found three jobs running for every single reader. Then the week kept going and the same pattern showed up everywhere. The Draft Readiness polish stopped a checklist from failing good posts. The lint cleanup stopped noise from hiding real errors. A RustDesk setup refused to connect because the client and server disagreed about who they were.

Every fix this week was the same move. Stop doing work that does not need doing.

The Blog Was Paying Server CPU for Static Readers

The first culprit was a content security policy nonce. The blog built a fresh CSP nonce per request in middleware, and the root layout read that nonce through headers().

// middleware.ts: the old way
const nonce = crypto.randomUUID()
res.headers.set("Content-Security-Policy", csp(nonce))
 
// layout.tsx
const nonce = await headers().get("x-nonce") // forces this route dynamic

That one header read turned every public HTML route dynamic. A static post became a server function call, so a plain reader paying for a page view was spending server CPU. The homepage made it worse with live comment and view-count work.

I moved the CSP to a static header in the Next config, removed the nonce reads from the root layout and the JSON-LD component, and put the homepage back on incremental static regeneration with a five-minute revalidate window.

// next.config.ts: the new way
headers: async () => [
  { source: "/(.*)", headers: [{ key: "Content-Security-Policy", value: staticCsp }] }
]
// homepage: export const revalidate = 300

The tradeoff was real. Dropping the nonce means inline scripts are allowed again so the bootstrap, theme script, and JSON-LD can run. A stricter version with hashed CSP is possible later. The urgent fix was to stop turning every blog view into Fluid CPU.

Middleware Was Doing Too Much Per Request

The same middleware that built the nonce also handled admin auth and markdown negotiation, and it matched nearly every route. Even cacheable public pages paid middleware overhead just to attach a header. Next 16 had also flagged the middleware convention as deprecated in favor of a proxy.

// old matcher: matched almost everything, did 3 jobs
matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"]
 
// new proxy.ts: narrow, one job per path
matcher: ["/admin/:path*", "/api/:path*", "/posts/:slug*"]

Moving auth out of the broad middleware needed care. Admin pages and protected API routes still gate themselves, while public analytics and MCP routes authenticate or rate-limit their own way. Smoke tests confirmed admin redirects unauthenticated users and protected settings still returns a 401.

Every Visitor Was Pinging the Admin Session Check

The third job was the sneakiest. Public post cards render small admin controls, and those controls called the auth check on mount for everyone. A visitor with no admin cookie still triggered a check, and on the homepage that meant duplicated checks across many cards.

// useIsAdmin: the new gate
const hasAdminCookie = document.cookie.includes("admin_session")
if (!hasAdminCookie) return false   // normal visitor does nothing
// only a browser with the cookie asks the server

That removed one server round trip per post card for every reader. The auth route also stopped caching the result with a no-store header.

The cookie check is not security. It is a cheap client-side gate to avoid unnecessary server calls. Authorization still happens server side where it matters.

The Bakeoff Winner Got a Human Merge Pass

The homelab thread this week was the Draft Readiness Checklist. DeepSeek won the bakeoff on the Spark pair, but the other three contestants surfaced ideas worth keeping. Strix caught edge cases the winning implementation missed.

I kept DeepSeek’s compact shape as the base and folded in the best concepts from the other runs.

// helper stayed dependency-free
// no gray-matter: that would drag server YAML parsing into the browser
function parseFrontmatter(raw: string) { /* tiny parser */ }

The admin edit page stopped storing derived draft state in React state, and touched JSX labels avoid the comment-text lint rule.

The gotcha was the obvious answer not being the right one. Pulling in gray-matter would have dragged server-oriented YAML parsing into the browser bundle, so the helper stayed dependency-free and I wrote a small frontmatter parser instead.

The Repo Finally Lints Cleanly Again

The Draft Readiness work surfaced a debt that had been building. Full lint exposed 47 errors and 6 warnings, most of them not logic bugs. Strict React and Next rules were catching patterns that had accumulated across the admin UI.

I fixed the mechanical issues directly. Admin labels became explicit strings, the login back-link uses the proper link component, the prompt preset loader got a typed settings shape, and the unused Open Graph binding was removed. For a few existing patterns where the rule was technically right but the broader refactor would be unrelated, I added narrow file-level disables with a comment explaining why.

// narrow, commented disable for a real browser-API pattern
// eslint-disable-next-line react-hooks/exhaustive-deps -- theme detect

The repo went from 53 lint problems to zero, with the type check and build passing. Full lint cleanup is not the same as full architectural cleanup, so I left the deeper refactors for their own pass.

A RustDesk Key Mismatch That Was Not a Key Mismatch

The last fix was remote access. A RustDesk client refused to connect to my self-hosted server with key mismatch every time.

The key field is the remote machine’s ID, not a cryptographic secret, and I had copied the right value. The client still refused because it had generated its own key pair on first run. That identity did not match the server’s, so the two sides disagreed on who was connecting.

The fix was to give the client the server’s identity instead of letting it keep its own. I replaced the client key files with the server’s and restarted.

# replace the client key pair with the server's identity
printf '%s' '<server public key>' > ~/.rustdesk/id_ed25519.pub
printf '%s' '<server private key>' > ~/.rustdesk/id_ed25519
chmod 600 ~/.rustdesk/id_ed25519

The terminal made it harder by mangling the long base64 strings on paste, so I stopped routing them through the shell and wrote the files directly.

Key mismatch meant exactly what it said. Two different identities. The fix was to make them the same.

The theme that ties all of this together is subtraction. The blog stopped charging readers for CPU they did not use. Middleware stopped running where it was not needed. Visitors stopped pinging an auth check that did not apply to them. The checklist stopped rejecting posts that were fine. The lint pass stopped hiding real errors behind a pile of noise. A key mismatch resolved once the client agreed to be who the server expected.

The next question is what other work is still running because nobody asked whether it needed to.

By the Numbers

• 95 percent of Vercel Fluid CPU the blog consumed over the month before the fix
• 3 per-request jobs eliminated on public routes
• 53 lint problems the repo started with
• 0 lint problems after the cleanup
• 47 errors and 6 warnings in that original lint run
• 4 contestants whose Draft Readiness ideas made the merge pass
• 1 dependency-free frontmatter parser written instead of importing server YAML tooling
• 3 final checks green after the lint cleanup, lint, tsc, and build