Modern IT infrastructure, in five pillars
The framework I use to keep infrastructure sane: five pillars on four foundations, every component a CI wired to the rest.
Notebook
Software
What delivers the function — apps, APIs, SaaS, platform services.
Opinion notes
Build like you'll have to leave
Closed software earns its place, but engineer the exit. The line that matters: a moderate lock-in you can leave, a super lock-in that owns you.
Two gates in front of the website
Defense-in-depth at the homelab edge with CrowdSec: known-bad IPs dropped at the door, then an in-band WAF reads what's left. And why it's deliberately fail-open for now.
Idea notes
Could open-source IAM replace Active Directory and Entra ID?
Where midPoint plus Authentik can replace the Microsoft identity stack in a hybrid Windows/Linux shop. And where it can't. A thought experiment, not a build.
Idea notes
Why we're keeping venv, for now
I measured uv against our pin-everything dependency policy. It fits. And we're still staying on stdlib venv. The why is more interesting than the verdict.
How the agent fleet is wired, in five layers
From a typed request to a guarded action against a real system, a walk down the stack that turns Claude Code into a fleet of homelab operators: the CLI, the shared agent-core, the agents, their skills, and the actions they perform.
Skills, MCP, and where the credentials belong
A simple question (do our agents need MCP?) that quietly turned into a clearer picture of skills, MCP servers, and the identity layer sitting underneath both.
Teaching an AI agent to speak Technitium
Building a DNS skill for our network agent, and the two-layer permission model that hid our zones in plain sight.
On-demand Docker updates for when Watchtower blinks
Teaching my agent to update Docker stacks within policy: including the source-built ones that have no image to pull.