#reliability
Uptime, alerts, backups and recovery.
2026
What Cloudflare can still do to us
Decision recordWe moved TipBop and TyreStack to Cloudflare in a day and made it the default for everything. This is the case against that, from our own standard: five ways it fails, the limits we accepted, and four conditions that would send us back.
Who watches the alerts?
Deep diveOn 18 October we found our Slack bot tokens had died and every alert since had gone nowhere. We rebuilt the path so it is much harder to fail quietly, then spent a week learning that an alert path can also fail loudly, by paging for things nobody could fix.
Ten thousand worlds before the first real fitter
Deep diveTyreStack's scheduler had no customers yet, so before launch we built an audited oracle and threw ten thousand generated worlds of bookings, holds and late vans at it, comparing the old engine and the new one call for call.
The outage that moved us to Cloudflare
Decision recordAt 06:02 a Google Cloud zone stopped answering and took two products, both still in beta, with it. Our own review said stay and pay for high availability. By 15:45 we had left anyway. Here is the reasoning, and the objections to it.
A green health check and an empty database
PostmortemTipBop moved to Cloud Run on 17 September with a test-mode Stripe key, placeholder secrets, no data and no photos. The health check said ok the whole time. What it was checking, what it should have checked, and the two guards we added.