Pre-requisites

• You need to have sufficient liquid capital on hand, or at least the ability to borrow significant amounts of capital for at least a couple of days
• You are eligible and able to subscribe capital to an ISA for each tax year in which you want to carry the ISA allowance for that tax year forward
• You have a flexible ISA

How does this work?

In the general case of ISAs, the limit on the amount you can put into an ISA in a given year is £20k. That’s pretty simple - the ISA doesn’t care about how much that £20k grows to or how much you take out. If you put in £20k and realise you’ve made a massive mistake and take it back out the next day, your allowance has been used up for the year. You can’t put any more money into an ISA.

A flexible ISA works slightly differently, and more favourably (to the taxpayer, that is). What is a flexible ISA, you ask? In the words of HMRC:

A flexible ISA is an ISA whose terms and conditions allow the investor to replace, in whole or in part, cash they have withdrawn, without the replacement counting towards their annual subscription limit.

As an example, in the same situation above: where you put in £20k and then instantly remove it again, your remaining allowance remains at £20k - so you can put money back into your ISA with the very important caveat that you put the money back in the same tax year as when you took the money out.

Okay, you understand what a flexible ISA is. How do we actually use this to carry forward your allowance? Let’s look at the situation of a 5 year journey where you don’t want your capital sitting inside an ISA for whatever reason, but you want to reserve the option of dumping £100k at the end of the 5 years. In the typical situation, this is what we would do:

• 2018/19: £0k into an ISA, £20k outside
• 2019/20: £0k into an ISA, £40k outside
• 2020/21: £0k into an ISA, £60k outside
• 2021/22: £0k into an ISA, £80k outside
• 2022/23: £20k into an ISA, £80k outside

you’d be stuck with £80k left outside the ISA. However, if you’re happy doing some bank transfers across tax years, what you can do is this:

On 5 April 2019 (the end of the tax year), you temporarily put £20k into your ISA (remember the requirement of having sufficient capital) from a source of capital you have (e.g savings or magin). On the next day, 6 April 2020 (the start of the new tax year), you remove £20k from the ISA and put it back where you wanted it to be allocated (e.g savings or paying back margin).

Your ISA limit for that entire tax year (6 Apr 2019 - 5 Apr 2020) is now £40k. In fact, you should put in £40k on 5 April 2020 (e.g from savings or margin) and then take £40k back out on the next day, 6 April 2021 (the start of the new tax year) and put that back where you want it.

You repeat this where possible, temporarily tying up larger and larger amounts of capital (but only for a day) on the boundaries of the tax year to ensure that in each tax year, you retain the option of putting in all the previous year ISA limits.

Why would you want to do this?

There are a couple of reasons why you might want to do this:

1. You want to allocate all your capital to an instrument that your ISA can’t hold, but reserve the option of putting it into your ISA afterwards. As a specific example: someone who believes that paying down their mortgage faster is providing them with a better return than the stock market (given 2022/23 interest rates, this may not be as stupid as it sounds) should have an offset mortgage in which they accumulate all their capital. They should move money in and out of that offset mortgage account on the boundary between tax years to accumulate their ISA allowance and then once the mortgage is paid off, can redirect all their money to their ISA make up for past years of not filling up the ISA.
2. You’re harvesting someone else’s allowance who you’re comfortable giving them capital for a day or two but not more than that and envision becoming comfortable doing so later down the line.

The latter is the specific situation I find myself in, where I’m happy to harvest my significant others’ ISA allowance under the assumption that in the future, we’ll be combining our finances, but want to ensure that things remain seperated before then (for example before getting married v/s after getting married).

Details

1. Finding a provider that offers a flexible ISA is harder than it looks, they come with more complexity between the provider and HMRC (I presume) which is why they’re not the standard. As a starting point: Vanguard have a flexible ISA.
2. The costs for doing this should be fairly minimal. The cost for the ISA itself should be negligible if you use a percentage-based fee or fee-free provider. The cost of borrowing the capital, removing it from an offset mortage account or away from savings or any other capital allocation for a day or two should be minimal, but will grow over time.

Disclaimer

The content on this site is for informational purposes only, you should not construe any such information or other material as legal, tax, investment, financial, or other advice.

Introduction

Let me outline my setup for some context. I run a Kubernetes cluster using EKS which runs the backend, frontend and some other small services for an application I’ve built. This cluster sits on a public subnet of my VPC and my database which hosts all of the application data sits on a private subnet in RDS, comfortably nestled away from the world.

I often need access to this database, either for analytics or debugging purposes, on my local machine. This would typically call for an EC2 instance running on the same public subnet, with the appropriate security group configurations to allow it to talk to my database and let me in. Given that all of my security group configurations are done in Terraform, I don’t want to encode this ephermeral bastion into my Terraform (and I also maintain Terraform for Azure, which means more work - and I’m lazy). It just felt like the wrong level to do things at, when I had an entire EKS cluster to operate within.

I spent a good half-week searching (I’m a Kubernetes newbie) for how to implement the solution I had in my head, which was to run an SSH server on a Kubernetes pod (due to being within the VPC, had access to the RDS endpoint) and then use SSH local forwarding to connect to the server in that pod, and forward the RDS port down to my local machine. In an ideal world, I’d have been able to spin up an empty pod and run kubectl port-forward -L 5432:endpoint:5432 or something. That’s a bit of a lie – the reason that that isn’t ideal is that it requires kubectl installed on my machine (fine for me, less so for my product manager) and also means that various tools that allow a database connection to specify an ssh connection no longer work (e.g PyCharm’s database viewer).

Implementation

First off, I needed to spin a pod up that runs an OpenSSH server, preferrably with the authorized_keys baked into the image already. To do this I used this super simple Dockerfile from corbinu/ssh-server.

Step 1

Clone the repository down:

git clone https://github.com/corbinu/ssh-server.git

Step 2

Add the relevant public keys to the authorized_keys file at the root of the repository (create it if required)

echo "public_key_1" > authorized_keys
echo "public_key_2" >> authorized_keys

Modify the configuration within sshd_config to ensure that the SSH connection doesn’t time out after 1 minute (as it does by default):

ClientAliveInterval 30
ClientAliveCountMax 5

for a timeout of 30 * 5 seconds. Modify as appropriate.

Step 3

1. Build the docker image, tag it with your relevant repository tag (I use Amazon ECR) and push it to an appropriate registry

docker build -t account_id.amazon.ecr.io/repo/app-ssh-server:latest .
docker push account_id.amazon.ecr.io/repo/app-ssh-server:latest

Alternatively, you could leave it as-is and simply use the corbinu/ssh-server image from DockerHub, but will need to configure the authorized_keys by kubectl exec -it <pod-name> -- /bin/bash and editing the file directly, and will mean that you aren’t able to configure sshd_config

Step 4

Spin up a Kubernetes pod with your pre-baked image:

kubectl run app-ssh-server --image account_id.amazon.ecr.io/repo/app-ssh-server:latest --port 22 --restart Never --namespace app-maintenance

Step 5

Expose this Kubernetes pod to the outside world using a Load Balancer (your cluster must be configured to talk to some Cloud Provider to create the necessary resources):

kubectl expose pod app-ssh-server --namespace app-maintenance --port 22

Step 6

If you monitor your services with kubectl get svc -n app-maintenance, you should see a service dedicated to your pod with an external IP provisoned.

For best security practices, edit the configuration of this created service to whitelist certain IP addresses

kubectl edit svc/app-ssh-server --namespace app-maintenance

using (for example) sourceLoadBalancerRage under the spec key.

Testing

Connect to your SSH server using ssh <external-ip> and optionally forward some ports using -L or the LocalForward configuration

Pre-requisites

• You are employed and have your taxes operated under PAYE with regular monthly salary payments
• Your monthly gross salary is above the Upper Earnings Limit (UEL for National Insurance (NI). As of April 2021 this is currently £4189. This is roughly correlated with the higher rate tax threshold
• Your employer matches pension contributions holistically or anually rather than monthly
• Your employer operates a salary sacrifice scheme
• Your employer allows you to change your salary sacrifice contribution over the course of a year

How does this work?

The fact that tax works on an annual holistic basis in the UK is well-known. It doesn’t matter when or how you earn your money, it’s taxed by PAYE in as smooth a manner as possible (hello cumulative tax codes!) but reconciled anually at the end of the tax year based on the holistic income and gains then.

The kicker here is that NI is calculated per pay-period and not reconciled anually. There’s not quite the same thing as “over paying” NI in one month due to a bonus and expecting a rebate at the end of the year or in next months payslip as there is with tax.

Additionally, salary sacrifice works by reducing your salary in exchange for your employer contributing directly to your pension. In HMRC’s eyes, it’s as if you never earnt that money. The timing of this doesn’t make any difference for PAYE because the only figure that matters is your total taxable income at the end of the tax year. It does make a difference for NI, however.

The typical situation

A typical agreement between an employee and employer will have the employee agree to x% salary sacrifice as a pension contribution which is applied to each monthly payslip. As an example, take Bob who earns £96k and salary sacrifices 20% to his pension. His monthly payslip looks like:

• Gross: £8,000
• Pension contribution (SS): £1,600
• Taxable income: £6,400
• Tax: £1,512.66
• NI: £451.26 ((6400 - 4189) * 2/100 + (4189 - 797) * 12/100)
• Net: £4426.08

Had he not made any pension contributions, it would look like:

• Gross: £8,000
• Pension contribution (SS): £0
• Taxable income: £8,000
• Tax: £2152.66
• NI: £483.26 ((8000 - 4189) * 2/100 + (4189 - 797) * 12/100)
• Net: £5364.08

you can see that the salary sacrifice has reduced the tax paid substantially (all at 40%) whereas has barely impacted the amount of NI paid (most of it as 2%). This is because the NI payment drops from 12% to 2% when you cross the upper earning threshold, so you’re getting less relief.

Shuffling things around

Given that tax is paid holistically, we don’t care about the monthly tax position, it’ll sort itself out at the end of the year, but we can concentrate our pension contributions to a single (or as few as possible) month(s) to make sure that we make full use of the 12% NI relief rather than the 2%.

Bob makes a total pension contribution of £19,200. If we split that across three months instead of 12 (we need each monthly payslip to be above the minimum wage for a months full-time work), those three months look like:

• Gross: £8000
• Pension contribution (SS): £6,400
• Taxable income: £1,600
• Tax: (doesn’t matter)
• NI: £96.36

and the rest of the 9 months look like the situation above where he doesn’t make any pension contributions whatsoever.

The result

In both situations, Bob pays the exact same amount of tax (£18,152) by the end of the year but pays £5415.12 (451.26 * 12) NI by paying it monthly and £4,638.42 (483.26 * 9 + 96.36 * 3) by concentrating the contributions to 3 months.

That means Bob puts the exact same amount of money into his pension at the end of the year, pays the exact same amount of tax, but sees an extra £776.70 show up in his bank account for doing nothing other than pestering his employers HR to follow his ‘convoluted’ pension contribution strategy. This saving comes from exploiting the fact that NI is calculated per pay-period and maximising the relief at 12% from a few months rather than skimming the 2% relief every month.

Caveats

This ignores:

• employer contributions which you might be missing out on depending on how your employer calculates their matching (mine is non-contributory, so I don’t miss out on anything there)
• A cash-flow crunch, there are 3 months in which you see much less come in from your payslip which you need to conciously cover from the increased monthly payments in other months. You could also price in the time-value of money (though that is very nitpicky)
• If you choose to back-load the pension then you miss out on ‘time in the market’ and potential gains, but ensure that you remove the risk of ‘over-contributing to your pension’ early-on and removing flexibility had you been let-go or some emergency come up since pension contributions are irrecoverable
• If you choose to front-load the pension, then you gain ‘time in the market’ which is a good thing but lose out on flexibility (say an emergency comes up later in the year where you wish you could then turn your contribution down).

The last 3 points can be mitigated somewhat by spreading Bob’s three months across the tax year, but may not be possible depending on your level of pension contribution and salary (maybe only one month is enough to make your full pension contribution).

Conclusion

If the stars align just right and this works for your situation as it does mine, then this can be a nice chunk of free money for almost no work and I would definitely recommend doing it, though do have a chat with your HR department before to make sure that it’s all kosher for you.

Disclaimer

The content on this site is for informational purposes only, you should not construe any such information or other material as legal, tax, investment, financial, or other advice.

The canonical Djanago-Graphene documentation on ordering points you towards using the OrderingFilter on a custom FilterSet from django_filter to implement ordering on your API, so that you can do things like:

query {
    posts(orderBy: "-createdAt") {
        title
    }
}

to get post titles ordered in descending order of when they were created. This works okay, as long as you don’t intend to use the filtering mechanism in django-graphene/django-filter, where you can specify django-style filters that are converted automatically to GraphQL arguments for filtering:

class PostNode(DjangoObjectType):
    class Meta:
        fields = {
            "title": ["exact", "startswith", "icontains"]
        }

because as soon as you follow the documentation from django-graphene and provide the custom filterset class, you gain ordering via the orderBy, but lose the default FilterSet that django-graphene builds for your PostNode type, which contains the nice title__Exact, title__Icontains, etc… filters on it.

The solution

To fix this, I built a custom connection field, inspired from several stackoverflow answers inheriting from DjangoFilterConnectionField that you likely already use:

from graphene_django.filter import DjangoFilterConnectionField
from graphene.utils.str_converters import to_snake_case


class OrderedDjangoFilterConnectionField(DjangoFilterConnectionField):
    @classmethod
    def resolve_queryset(
        cls, connection, iterable, info, args, filtering_args, filterset_class
    ):
        qs = super().resolve_queryset(
            connection, iterable, info, args, filtering_args, filterset_class
        )
        order = args.get("orderBy", None)
        if order:
            if isinstance(order, str):
                snake_order = to_snake_case(order)
            else:
                snake_order = [to_snake_case(o) for o in order]

            # annotate counts for ordering
            for order_arg in snake_order:
                order_arg = order_arg.lstrip("-")
                annotation_name = f"annotate_{order_arg}"
                annotation_method = getattr(qs, annotation_name, None)
                if annotation_method:
                    qs = annotation_method()

            # override the default distinct parameters
            # as they might differ from the order_by params
            qs = qs.order_by(*snake_order).distinct()

        return qs

and you use it like so in your query schema:

class PostQuery(graphene.ObjectType):
    posts = OrderedDjangoFilterConnectionField(
        PostNode,
        orderBy=graphene=graphene.List(of_type=graphene.String)
    )

This differs from the StackOverflow answer in that it lets you sort by custom fields that you may have implemented on your GraphQL API, but not on your model (in my case, it was the dowmload count of a post - which isn’t stored on the model) as long as you build a relevant annotation method for it. Let’s walk through what this does:

• We call the parent DjangoFilterConnectionField’s resolve_queryset method to get the queryset with all the magic filtering taken care of already, this ensures we don’t have to do any work ourselves or re-build any logic.
• If the GraphQL query is sent without the orderBy argument then we never enter the if order block and instantly return the queryset as-is from above.
• If the GraphQL query is sent with the orderBy argument (say fieldName) then we convert this to snake case (field_name) and do the following (note: if the value is instead a list, we convert each value to snake case and do the following to each value)
• We look at the queryset for a method called annotate_{field_name} on it
  • If this method exists, we call it, expecting the result to be the same queryset-type, but with an additional annotation on it called field_name (this is what lets us do the ordering) and replace the queryset with the newly-annotated queryset.
  • If the method doesn’t exist, then we leave the queryset as-is and do continue with the rest of the logic
• We call the order_by argument on the queryset we have with the values from the orderBy snake-cased arguments provided, this works on native db fields as normal with Django and also works with any graphene fields you’ve built that have custom resolvers as long as you write a mathching annotation method on the queryset for that field.
• We also call distinct on the queryset to ensure we get sensical results, given some of Django’s quirks with order_by and ManyToMany fields.

This works as you would expect if you were ordering by a model field, say the post title, but the real beauty is in ordering on a custom field you’ve created on your GraphQL API, but not on the model, in my case the post download count. This is what the annotate_field_name method is for. My Post Manager looks like:

class PostManager(models.Manager):
    def annotate_download_count(self):
        return self.annotate(download_count=models.Count("downloads"))

which annotates my queryset with a download_count field, that I can then order against.

You’d also ideally re-use this annotation within your GraphQL resolver rather than writing any new logic. For example:

class PostNode:
    download_count = graphene.Int()

    @staticmethod
    def resolve_download_count(root: Post) -> int:
        return (
            Post.objects.filter(id=root.id)
            .annotate_download_count()
            .get(id=root.id)
            .download_count
        )

or if you want to optimise things when resolving multiple posts (e.g to list them all):

# schema.py

from .types import PostNode

class PostQuery(graphene.ObjectType):
    posts = OrderedDjangoFilterConnectionField(PostNode)

    @staticmethod
    def resolve_posts():
        return Post.objects.all().annotate_download_count()

# types.py

class PostNode:
    download_count = graphene.Int()

    @staticmethod
    def resolve_download_count(root: Post) -> int:
        return root.download_count # has been annotated from the `posts` resolver

If you’re anything like me, then you’ve got yourself a Macbook (or 2 - definitely not using my work laptop to play games, no, not me! :eyes:) and are loathe to dual boot Windows via Bootcamp or spin up a heavy VM via Parallels just to be able to play Among Us. This posts is a quick guide to get Among Us running on your laptop/computer running OSx. I’m running on the latest Catalina version and haven’t tested this with any previous versions of OSx.

1. Buy Among Us on Steam

The creators of the game deserve that sweet Steam revenue for the awesome game they’ve created. This is different to some of the other approaches out there on the web that get you to play Among Us on your Mac via Bluestacks (which frequently crashes) and uses the free Among Us mobile client via the Android Emulator.

Also… skins.

Note: You won’t be able to install Among Us on Steam, since you’re running on OSx and it’s only been built for Windows. This is okay and to be expected.

Note 2: Buying it on Steam also means that we’re likely to get the Mac client if and when the Among Us creators decide to update Among Us to have one (unlikely with all the work they have cut out for them though)

2. Download PlayOnMac

Install PlayOnMac - it’s roughly 600mb to download and installs/unzips to about 2gb, which is a little larger than what I was expecting.

From what I can tell, PlayOnMac bundles together some kind of wine emulator/client that runs on OSx - get ready for lots of windows-style dialogue pop ups, bringing back some nostalgic and decidedly creepy feels seeing it on your Macbook screen.

When opening PlayOnMac for the first time, you may get a popup (if you’re on Catalina) that will deny you access to open the application. You can get past this by going to Security in your System Preferences and clicking “Open anyway” on the “General” tab.

3. Install Windows-Steam on PlayOnMac

Launch the PlayOnMac application and press “Install” on the GUI that opens up. Open the “Games” tab on the top and search for Steam (not Among Us!). Hit install and run through the installer.

If you get anything about Wine asking you to install Gecko for “embedded HTML”, feel free to cancel - it isn’t relevant to us.

This should install Steam in /Users/<user>/Library/PlayOnMac/wine_prefix/Steam which is a virtual drive that mirrows Windows structure of Program Files (x86)/Steam/steam.exe.

4. Open up Steam

You’ll need to login to Steam, likely pasting in a security code from your email and Steam should then open up. You might see a blank screen on the Steam GUI. If you do, close Steam and exit PlayOnMac and follow the next step.

5. Fix Steam

Open up PlayOnMac again, left-click on Steam and then click “Configure” in the sidebar that pops up on the left of the GUI. In the “General” tab of the configuration editor, paste the following in the “Arguments” field: wine steam.exe -no-browser +open steam://open/minigameslist which ensures that Steam only opens the mini-Library list that is compatible with Wine.

6. Re-open Steam

Re-open Steam (by hitting “Run”) and go ahead and install Among Us, it’s a 50mb download and 200mb unzipped and installed, so should be relatively quick. You can now run the game!

Don’t forget to switch the controls from “Mouse” to “Mouse+Keyboard”.

7. Red sus

This is what it looks like (from my current profile):

To get your own, you need to create a new repository in your account with the same name as your account, so in my case, with my account name being mzjp2 I needed to create a public repository called mzjp2, accessible at github.com/mzjp2/mzjp2 with, at least, a README.md.

You can add additional files to your repository (I have a folder of svg icons located in there that I use as images in my README), but the only thing that ultimately gets rendered is the README.md. It follows the same rendering rules and follows the same Github markdown spec as all the other README’s you’re used to in any other repo.

One caveat that I ran into is that you shouldn’t use relative links in the README. For example, I had an <img src="icons/linkedin.svg"> reference in my README.md which rendered fine locally since my repository structure had icons/ and README.md on the same level and rendered fine on the README view inside the mzjp2/mzjp2 repo, but did not render well on my Github user profile. I switched to using aboslute links (pointing at Github’s user content static URL) and everything worked fine after that.

As you can imagine, people have gone wild with this new feature, building everything from a guestbook to a communal chess game on their profile. Some of the ones I’ve seen so far:

• github.com/WaylonWalker that uses Netlify’s _redirect feature to always point to his latest blog post on his README and also incorporated the clever visitor badge that I shamelessly stole.
• github.com/timburgan a Github staff member (I wonder how much time he had to play around with this :thinking:) that built a community chess tournament using buttons (to move your chess piece) that opens a Github issue prepopulated text, which triggers a Github action that updates the README.md file with the new state of the game. :clap:
• github.com/saadeghi who has the infamous Chrome dino game as a GIF playing. Minimalism, anyone?

and plenty more. If there are any interesting ones you’ve come across, feel free to ping me an email and I’d love to check it out!