Opinion notes
AI is humanized compute
AI isn't a new domain, it's compute grown up enough to act. Treat it like staff: a broad junior, always inside a human accountability tree, carrying its own papers.
Notebook
From the notebook .
Field notes, ideas, opinions and the occasional detour — short, practical writing on networking, security, infrastructure, the homelab and whatever else I'm tinkering with.
Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Idea notes
The shape of identity in a business
Identity is the control plane for who and what can do what. The trick to keeping it sane: nest accounts into groups and roles, and never pin a permission on a user.
Opinion notes
The CyberArk you don't have to buy
Completing an open-source identity stack with governance and privileged access — and why an AI coding agent finally makes it cheaper than CyberArk.
Nobody holds an SSH key here, including me
A private CA as the single SSH trust root: short-lived certs for humans (SSO+MFA), 10-minute ones for machines, and host certs that kill known_hosts TOFU.
Opinion notes
Build like you'll have to leave
Closed software earns its place, but engineer the exit. The line that matters: a moderate lock-in you can leave, a super lock-in that owns you.
Opinion notes
Expert hands, junior judgment
Implementing AI isn't buying a tool. It's staffing a team: expert at the task, junior at the call. Why that reshapes hiring, not just headcount.
Idea notes
The confused deputy comes for your AI agents
When an orchestrator agent delegates to a sub-agent, it can quietly hand over a token that does far more than the sub-agent should. Here's the token-chain risk, IBM and Red Hat's Kagenti blueprint, and a zero-trust pattern you can run without re-platforming onto Kubernetes.
Idea notes
Own the baseline, rent the bleeding edge
Token prices are heading for a real-cost reckoning. The way through is the one we use for compute: own the AI baseline, burst for the bleeding edge.
Two gates in front of the website
Defense-in-depth at the homelab edge with CrowdSec: known-bad IPs dropped at the door, then an in-band WAF reads what's left. And why it's deliberately fail-open for now.
Idea notes
Could open-source IAM replace Active Directory and Entra ID?
Where midPoint plus Authentik can replace the Microsoft identity stack in a hybrid Windows/Linux shop. And where it can't. A thought experiment, not a build.
When your gateway hijacks DNS
An internal site that wouldn't load, a resolver that was never asked, and the dead-IP query that proved a 'helpful' gateway was answering DNS behind my back.
Idea notes
Why we're keeping venv, for now
I measured uv against our pin-everything dependency policy. It fits. And we're still staying on stdlib venv. The why is more interesting than the verdict.
Giving an AI agent the keys, safely
Wiring our identity agent into a secrets manager without handing it the kingdom: read-only by default, segregation of duties, and writes you have to mean.
How the agent fleet is wired, in five layers
From a typed request to a guarded action against a real system, a walk down the stack that turns Claude Code into a fleet of homelab operators: the CLI, the shared agent-core, the agents, their skills, and the actions they perform.
Skills, MCP, and where the credentials belong
A simple question (do our agents need MCP?) that quietly turned into a clearer picture of skills, MCP servers, and the identity layer sitting underneath both.
Teaching an AI agent to speak Technitium
Building a DNS skill for our network agent, and the two-layer permission model that hid our zones in plain sight.
Phase 2: internal DNS and the bootstrap chicken-and-egg
Standing up an authoritative internal resolver as code: split-horizon, encrypted upstreams, and the moment the new DNS box couldn't resolve its own installer.
On-demand Docker updates for when Watchtower blinks
Teaching my agent to update Docker stacks within policy: including the source-built ones that have no image to pull.
Phase 1: a golden image, and why SeaBIOS won this round
Building the cloud-init template every VM clones from. And learning the hard way that UEFI + cloud images + a serial console hides your boot failures.
Phase 0: read the house before you renovate
The first phase changes nothing. It just reads live state and proves how wrong the plan already was. Discovery is the cheapest phase and the most valuable.
Rebuilding my homelab as code, with an agent riding shotgun
Starting a phased, infrastructure-as-code rebuild of the homelab, and pairing with an AI agent that does the typing while I keep the judgement.
Hardening SSH on a fresh Ubuntu box
The five-minute baseline I apply to every new server before it goes anywhere near a network.
Why my homelab lives behind VLANs
Segmentation isn't just an enterprise checkbox. Here's how I split a single Proxmox node into safe zones.
A Cisco ISE MAB fallback that won't lock you out
A critical-auth VLAN so a dead RADIUS server doesn't take a whole floor offline.