Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Notebook
Field notes
Real findings from the work and the homelab — what I'm building, breaking and fixing along the way.
Nobody holds an SSH key here, including me
A private CA as the single SSH trust root: short-lived certs for humans (SSO+MFA), 10-minute ones for machines, and host certs that kill known_hosts TOFU.
Two gates in front of the website
Defense-in-depth at the homelab edge with CrowdSec: known-bad IPs dropped at the door, then an in-band WAF reads what's left. And why it's deliberately fail-open for now.
When your gateway hijacks DNS
An internal site that wouldn't load, a resolver that was never asked, and the dead-IP query that proved a 'helpful' gateway was answering DNS behind my back.
Giving an AI agent the keys, safely
Wiring our identity agent into a secrets manager without handing it the kingdom: read-only by default, segregation of duties, and writes you have to mean.
How the agent fleet is wired, in five layers
From a typed request to a guarded action against a real system, a walk down the stack that turns Claude Code into a fleet of homelab operators: the CLI, the shared agent-core, the agents, their skills, and the actions they perform.
Skills, MCP, and where the credentials belong
A simple question (do our agents need MCP?) that quietly turned into a clearer picture of skills, MCP servers, and the identity layer sitting underneath both.
Teaching an AI agent to speak Technitium
Building a DNS skill for our network agent, and the two-layer permission model that hid our zones in plain sight.
Phase 2: internal DNS and the bootstrap chicken-and-egg
Standing up an authoritative internal resolver as code: split-horizon, encrypted upstreams, and the moment the new DNS box couldn't resolve its own installer.
On-demand Docker updates for when Watchtower blinks
Teaching my agent to update Docker stacks within policy: including the source-built ones that have no image to pull.
Phase 1: a golden image, and why SeaBIOS won this round
Building the cloud-init template every VM clones from. And learning the hard way that UEFI + cloud images + a serial console hides your boot failures.
Phase 0: read the house before you renovate
The first phase changes nothing. It just reads live state and proves how wrong the plan already was. Discovery is the cheapest phase and the most valuable.
Rebuilding my homelab as code, with an agent riding shotgun
Starting a phased, infrastructure-as-code rebuild of the homelab, and pairing with an AI agent that does the typing while I keep the judgement.
Hardening SSH on a fresh Ubuntu box
The five-minute baseline I apply to every new server before it goes anywhere near a network.
Why my homelab lives behind VLANs
Segmentation isn't just an enterprise checkbox. Here's how I split a single Proxmox node into safe zones.
A Cisco ISE MAB fallback that won't lock you out
A critical-auth VLAN so a dead RADIUS server doesn't take a whole floor offline.