Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Notebook
Operations
Run it — provisioning, patching, incidents, SLAs.
Opinion notes
Expert hands, junior judgment
Implementing AI isn't buying a tool. It's staffing a team: expert at the task, junior at the call. Why that reshapes hiring, not just headcount.
When your gateway hijacks DNS
An internal site that wouldn't load, a resolver that was never asked, and the dead-IP query that proved a 'helpful' gateway was answering DNS behind my back.
Idea notes
Why we're keeping venv, for now
I measured uv against our pin-everything dependency policy. It fits. And we're still staying on stdlib venv. The why is more interesting than the verdict.
How the agent fleet is wired, in five layers
From a typed request to a guarded action against a real system, a walk down the stack that turns Claude Code into a fleet of homelab operators: the CLI, the shared agent-core, the agents, their skills, and the actions they perform.
Teaching an AI agent to speak Technitium
Building a DNS skill for our network agent, and the two-layer permission model that hid our zones in plain sight.
Phase 2: internal DNS and the bootstrap chicken-and-egg
Standing up an authoritative internal resolver as code: split-horizon, encrypted upstreams, and the moment the new DNS box couldn't resolve its own installer.
On-demand Docker updates for when Watchtower blinks
Teaching my agent to update Docker stacks within policy: including the source-built ones that have no image to pull.
Phase 1: a golden image, and why SeaBIOS won this round
Building the cloud-init template every VM clones from. And learning the hard way that UEFI + cloud images + a serial console hides your boot failures.
Phase 0: read the house before you renovate
The first phase changes nothing. It just reads live state and proves how wrong the plan already was. Discovery is the cheapest phase and the most valuable.
Rebuilding my homelab as code, with an agent riding shotgun
Starting a phased, infrastructure-as-code rebuild of the homelab, and pairing with an AI agent that does the typing while I keep the judgement.
Hardening SSH on a fresh Ubuntu box
The five-minute baseline I apply to every new server before it goes anywhere near a network.
A Cisco ISE MAB fallback that won't lock you out
A critical-auth VLAN so a dead RADIUS server doesn't take a whole floor offline.