Drupal South 2025

This post is a digitization of the hand-written notes I took during Drupal South this year. My colleagues and I were lucky enough to attend this year thanks to amazee.io who were a gold sponsor of the event.

I often self-describe as "not really a Drupal guy". Yet, there are a wide array of topics covered at Drupal South. I managed to squeeze quite a lot value from the two days I attended.

disclaimer

This is a digitized version of the personal notes I took while attending a conference. I don't want to devalue any of the presentations I saw. Please get in touch if there are any issues with what I've published here. Otherwise, opinions are my own, etc.

🧚Hey! Listen!

Also, this is still a work in progress! Its taking me a bit longer to finish. Keep an eye on the changelog and "last updated" date.

Key / legend

While making notes I gave each talk a little "tag" to refer to. Some of the talks I saw are not mentioned here. I wanted to focus on the talks which I extracted the most value from. Here's the tag system I came up with:

🔥

Hella valuable talk/concepts. Directly useful and I will apply things I learned.

👌

Interesting, thought provoking - but perhaps less actionable.

✨

Validating! We're on the right track. Our peers are experiencing the same challenges and solving the same problems.

💬

Side notes about public speaking. Things I noticed about the act of giving the talks.

The talks (day 1)

Keynote: Humanising technology

🔥 | 👌

Nicola Nye opened the conference with a thought-provoking talk. She urged everyone in the room to consider the tools we are creating. And to do our part to help steer them back toward benefiting real actual humans.

We live in this slice in time where humans have started to lose our identity and position as targets of tech. Bots are now building content for other bots so that humans can use bots to make stuff that is worse for humans. We're all-in on short-term gains. We rarely stop to think about the deeper consequences of our actions.

When thinking about humanising tech, I don't only consider LLMs. The broad and ongoing effects of blitzscaling, enshittification, and Web3 are all dehumanising.

Profits over people, hey.

And what can we do about this?

As developers we have the tools at our finger-tips to make deeper decisions around tech. The things we choose to signal-boost ultimately do effect humanity.

💬Sidenotes

Have a back-up person to keep the talk and Q&A running to shedule.

All this nourishing mental massaging. Yet, Nicola still managed to drop "tax billionaires", "disability tax" and "project management triangle" into the mix. Nicola is great.

Dude, where's my users?

🔥 | 👌

Next I caught Emily Mills. Her talk was about becoming "user research detectives". As a Batman fan, I can get behind this theme!

This one was all about finding clues and gainging insight into user behaviour. Are people rage-quitting? Why? at what point in the experience? Did something break or is the content just at the wrong reading age?

UX is never really "done".

She suggests tools like Hemingway¹, Wave, Clarity (Microsoft), and the humble feedback form. We can use them to gather metrics about what is happening for real users. Then we can use the insights to improve the experience over time.

Emily gave a good example of a UX pattern for a feedback form.

Was this page helpful?

Options: Yes or No.

• If "Yes": collect the "yes" result and say thank you.
• If "No": collect the "no" result. Spawn a web-form. Collect a description of the issue.
  • Align back to other collected data.
  • Prioritise the low-effort / big-wins.

We collect the no result in case the user has no time or is too frustrated to fill out the full feedback form. Many "No" responses can indicate general issues with an entire experience. We can then look more closely for clues on the page.

warning

1. The feedback widget should be unobtrusive and loaded near to the footer, or in a sidebar. People who are experiencing a frustration will seek it out. Otherwise it should feel removed from the page.
2. Expect a higher quantity of negative feedback than positive. This should be framed a good thing, as this is the quality data. Negative feedback should never be used to punish employees for performance. Instead we should use it to gain insight and understanding and improve accordingly.

Bonus: Here's a Figma template I found which includes some of the UI mentioned here.

Automating Attendance: How Georgia Tech Built an RFID Check-In System in Drupal

👌

Jimmy Kriigel built a check-in system for students attending events at Georgia Tech. The students use their "Buzz Card" (student ID) for lots of things already. Things like dorm-room access, printing access, and parlance through various security systems. It would solve an ease of access issue, provide useful telemetry and make it easy for the students - if they could use the same card for event access.

Jimmy shares the R&D journey of sourcing USB-C readers that act like keyboards, which emulate web-form submissions. Literally, a successful scan of the card = a carriage return keystroke.

The form collects only the necessary data required to a check a student into an event. It complies with the privacy terms and conditions of the University on a whole.

Once the data arrives it is securely stored, and retrievable through Dropbox (enterprise edition).

💬Sidenotes

If you want to use a looping animated GIF in your presentation, try not to place it next to important information - instead, place it between slides, to avoid inducing motion sickness.

The talk was a great reminder that web technology can be brought into the physical world. I was reminded of working on the front-of-house ticket advancing system at NGV. There a series of raspberry pi's with a button press would send messages to a full-screen Chrome kiosk. It assisted punters by letting them know which kiosk was free, given that for large shows - the queue can bend around corners and make visibility difficult to determine.

A colleague imagined extending something similar to University open day attendees - perhaps with a QR code on a page, although that could introduce similar barriers that require a fallback, I suppose.

Avoiding CSS crime scenes

Tina Reymann breaks down common pitfalls in CSS and shares practical strategies to keep styles clean, scalable, and maintainable.

Fewer crime examples than anticipated. Mostly information to back the use of modular design systems, creating living style guides, and the use of atomic design and standards for organising code like BEM (which I've been using since 2015), SMACSS, OOCSS, CUBE, HECS etc.

Strategy for dealing with CMS injected divs

When working on a decoupled Drupal website, for whatever reason, it is not uncommon to expect a certain piece of markup, and receive something very close but with a random DIV injected where it isn't necessarily wanted/required.

I picked up this tip, which I have previously solved other ways.

Setting the stray div to display: contents sort of bypasses its control as a block scope entity. The same can be achieved using CSS subgrid. Here's an example I made on Codepen.

See the Pen Untitled by Michael Gale (@miclgael) on CodePen.

Additionally I picked up some useful info about the new pesudo selectors, :not(), :is(), :has() and :where().

I learned that :not increases specificiy, but when combined with where(), the additional specificity is cancelled out. e.g. :where(:not(.active)).

💬Sidenotes

Add breadcrumbs or page counter/total to the footer of slides, so the audience can keep track of the progress.

I don't think I've run into a situation where the specificity has been a problem, but its good to have a quick-fix ready for when it inevitably does.

The talks (day 2)

Hashes and Nonces and Violations, Oh My!

🔥

Michael Strelan breaks down CSP and how to create allow-lists and define permissions for various external scripts (and other assets) which can help prevent XSS.

What is a Content Security Policy?

Here's how I always wish CSP were explained to me, via an ELI5 adapted from a reddit comment.

1. Websites can load stuff. This we know.
2. Sometimes, people trick websites into loading bad stuff. (RXSS)
3. A CSP is a header sent to the user's browser when they ask for a page.
4. The CSP tells the browser what the site should be allowed to load and what its not allowed to load.
5. For example, the CSP might say "Hey, don't allow inline scripts to load." or "Only allow X, Y and Z scripts and nothing else"

We can use nonces and hashing algorithms to ensure the content of a script is exactly what we expect.

As a very simple example, if you were to go and grab a jquery embed script in 2025, you may notice the integrity attribute is attached.

<script
  src="https://code.jquery.com/jquery-3.7.1.min.js"
    integrity="sha256-/JqT3SQfawRcv/BIHPThkBvs0OEvtFFmqPF/lYI/Cxo="
    crossorigin="anonymous">
</script>

The value of the integrity is a hash that matches the content inside the script itself.

If jquery ever lost control of their domain, and a bad actor changed the content of the script remotely - it wouldn't be allowed to execute because the content of the script no longer matches hash in the integrity attribute.

Its a very clever way to bring additional security to your website. But as usual, it comes with maintenance costs. A CSP brings a similar type of responsibility up to a more centralised, manageable place.

"Don't install Honey"
‐ Michael Strelan

It sounds straightforward but there are many difficult aspects to implementing a CSP. Michael mentions a few edge cases:

• What if your website relies on hundreds of scripts (or other enforcable content sources)?
• What if your content team need to add new sources?
• Sometimes a script will load more scripts onto a page. What if one source has dependent sources?
• What if the content of a script changes, but it is a legitimate change - like a security update?
• How do we figure out what our websites are even using?

To answer the last question, we can set CSP to use the Report-Only directive.

With reporting activated, browsing the website with Developer Tools open will yield lots of warnings and error messages - this could be a good way to manually collect information about a single page.

But there's a slightly better way to gather the info. Setting up a CSP endpoint for the report to be posted to, allows collection of metrics over-time - which while not 100% accurate, will be a much more reliable method than manually visiting pages and inspecting data. CSP endpoints can be custom, or there are SAAS options, e.g. report-uri.com.

I have always wanted to create my own CSP endpoint as it is something I wasn't able to figure out when I was at NGV. Maybe some day sigh *

More info at content-security-policy.com/

Onboarding with Vortex

✨

I would love to claim Alex Skrypnyk as one our own. Alex restored my faith in DevOps as a concept as I have come from some extremely "wild west" approaches in the past.

Great scaffolds for new projects lead to great outcomes. Doing things well up-front takes away the fear of doing good work only for things to not work out. This is something I learned very early in my career: Always know how you're going to test and deploy the thing. Otherwise known as "bringing the pain forward". If only I'd known 15 years ago how much better things could be. I digress.

Alex has been working on Vortex, "a project template" for Drupal. The features of Vortex are quite deep, and Alex's talk was a high level overview about each step. In lieu of infinite time, I'll just do a basic feature dump below.

💧 Drupal
    ✅ Based on drupal-composer/drupal-project
    ✅ Drupal 11
    ✅ Configurable webroot
    ✅ Pre-configured settings
    ✅ Custom module scaffold
    ✅ Custom theme scaffold
    ✅ Tests scaffold
    ✅ Configuration for admin modules: Environment indicator, Shield, Stage file proxy
    ✅ Configuration for Search API (Solr)
    ✅ Configuration for caching (Redis)
    ✅ Configuration for antivirus (ClamAV)
🐳 Docker services
    ✅ Nginx
    ✅ PHP
    ✅ MariaDB
    ✅ Solr
    ✅ Redis
    ✅ ClamAV
    ✅ Chrome
🏨 Hosting
    ✅ Acquia
    ✅ Lagoon
    🚧 Platform.sh
💻 Local development
    ✅ Docker Compose + Ahoy
    🚧 Lando
    🚧 DDEV
🏗️ CI/CD
    ✅ Circle CI
    ✅ GitHub Actions
    🚧 GitLab CI
    🚧 Azure Pipelines
🛠️ Tooling
    ✅ Behat + Drupal extension + Behat Screenshot + Behat steps
    ✅ ESLint
    ✅ PHP Parallel Lint
    ✅ PHPCS
    ✅ PHPMD
    ✅ PHPStan
    ✅ PHPUnit
    ✅ SASS Lint
    ✅ SASS
    ✅ Twig CS Fixer
    🚧 Pa11y
⚙️ Workflow
    ✅ Database from CURL, FTP, container image, hosting provider
    ✅ Pull request template
    ✅ Release drafter
    ✅ PR auto-assign
    ✅ PR auto-label
    ✅ Deployment notification to email, GitHub, Jira, New Relic
    ✅ Automated dependencies updates (Renovate)
📖 Documentation
    ✅ Your project README.md
    ✅ Your project documentation
    ✅ Vortex documentation
🧪 Vortex
    ✅ Unit test coverage for scripts
    ✅ Functional test coverage for workflows
    ✅ Integration test coverage for deployments
    ✅ Vortex updates
    ✅ Basic installer
    ✅ Advanced installer CLI UI
    🚧 Advances installer Web UI
    🚧 Automated project setup
    🚧 Project dashboard

Taken from https://vortex.drevops.com/getting-started/features/

Vortex also features a very nice TUI. 😄

Deep Telemetry with eBPF and Rust

Nick Schuch gave an incredibly interesting talk about fixing low-level performance bottlenecks and how using multiple tools at different steps of the way led to the creation of https://github.com/skpr/compass

The main thing I extracted from this talk was an appreciation for the tools that other members of the community dedicate themselves to.