Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Notebook
Security
Protect it — hardening, least privilege, detection, evidence.
Opinion notes
The CyberArk you don't have to buy
Completing an open-source identity stack with governance and privileged access — and why an AI coding agent finally makes it cheaper than CyberArk.
Nobody holds an SSH key here, including me
A private CA as the single SSH trust root: short-lived certs for humans (SSO+MFA), 10-minute ones for machines, and host certs that kill known_hosts TOFU.
Idea notes
The confused deputy comes for your AI agents
When an orchestrator agent delegates to a sub-agent, it can quietly hand over a token that does far more than the sub-agent should. Here's the token-chain risk, IBM and Red Hat's Kagenti blueprint, and a zero-trust pattern you can run without re-platforming onto Kubernetes.
Two gates in front of the website
Defense-in-depth at the homelab edge with CrowdSec: known-bad IPs dropped at the door, then an in-band WAF reads what's left. And why it's deliberately fail-open for now.
Idea notes
Could open-source IAM replace Active Directory and Entra ID?
Where midPoint plus Authentik can replace the Microsoft identity stack in a hybrid Windows/Linux shop. And where it can't. A thought experiment, not a build.
When your gateway hijacks DNS
An internal site that wouldn't load, a resolver that was never asked, and the dead-IP query that proved a 'helpful' gateway was answering DNS behind my back.
Giving an AI agent the keys, safely
Wiring our identity agent into a secrets manager without handing it the kingdom: read-only by default, segregation of duties, and writes you have to mean.
Skills, MCP, and where the credentials belong
A simple question (do our agents need MCP?) that quietly turned into a clearer picture of skills, MCP servers, and the identity layer sitting underneath both.
Hardening SSH on a fresh Ubuntu box
The five-minute baseline I apply to every new server before it goes anywhere near a network.
Why my homelab lives behind VLANs
Segmentation isn't just an enterprise checkbox. Here's how I split a single Proxmox node into safe zones.
A Cisco ISE MAB fallback that won't lock you out
A critical-auth VLAN so a dead RADIUS server doesn't take a whole floor offline.