Hybrid Cloud Engineer & Infrastructure Automation.
I'm a Hybrid Cloud Systems Engineer specializing in Azure, Terraform, and Zero-Trust network architecture. By day I design production infrastructure — here I publish the hardened templates and deep dives I wish existed when I needed them.
Currently focused on compliance-ready infrastructure blueprints for ISO 27001, NIS2, and KRITIS environments.
Deploy a production-grade monitoring stack on bare-metal k3s: Prometheus, Loki with Garage S3 storage, Promtail on edge nodes via Ansible, SNMP monitoring for MikroTik, and Grafana SSO via Authelia OIDC — all GitOps-managed.
Read →A two-node recursive DNS stack with ad filtering, automatic config sync, and transparent failover — fully managed with Ansible.
Read →capabilities.drop: [ALL] and runAsNonRoot: true passed schema validation cleanly. Within minutes of merge, nine containers — including both Postgres instances backing Paperless and Nextcloud — were down. Here's the failure analysis, why a manual kubectl fix got silently undone, and the lesson for any blanket securityContext change.
Read →Migrating Jellyfin off k3s onto a GPU-passthrough LXC meant pointing a Service at an external IP. The EndpointSlice looked completely correct via kubectl — Service existed, endpoint listed right — but Traefik 404'd every request. A second, unrelated gotcha surfaced in the same migration: a PVC silently shared by reference across two unrelated files.
Read →8 production-ready patterns for NSGs, Private Endpoints, Forced Tunneling, and Managed Identities. Sent to your inbox instantly.
