Ci-Cd
guest@6admin.io:~$ ls ~/tags/ci-cd
llmp2p: BitTorrent is back and it ships your LLMs
Distributing LLM models over BitTorrent swarms with Hub HTTPS as the safety net, verified end to end. And the GitLab incident story that followed.
One Blocking Pin, Four CVEs: The Band-Aid That Wins Is the One That Disappears
How a security audit on a Dockerized Foreman stack turned into merged contributions in Foreman core, Dynflow and Jenkins.
Jenkins on Windows Server: what not to do
A Jenkins controller on a domain-joined Windows host, the built-in node on the controller, the 8080 in the open, AD credentials in cleartext: the anatomy of a compromise chain and how to take it apart.
wimcast: building Windows images on Linux, without Windows
A PyPI-published tool that turns Windows ISOs into a Foreman-ready WIM tree, unprivileged on Linux: no Windows host, no root, no mount(2), no FUSE, no ADK. Drop-in replacement for the PowerShell pipeline it retired, with a content-addressed cache and a pinned wimboot.
Windows 11 for build machines: the wrong tool
Windows 11 client on headless bare-metal build machines in a server room: the detail of the provisioning and operational friction and why Windows Server with Desktop Experience does the same job for a fraction of the pain.
FluoBoard: my CI status light since 2019, finally open source
As early as 2019, a small Python server acted as my personal proxy between my CI pipelines and an inherited status light. The 2026 rebuild is open source: a stdlib-only server polling GitHub Actions and GitLab CI, firmware compiled by CI with a flash-overflow guard and one ASCII digit tying it all together. Episode three.
Ansible CI Toolkit v1: the year I stopped trusting my own image
The hardened sequel: ansible and ansible-lint merged into one image, Kerberos/WinRM for Windows targets, non-root, base pinned by digest, a pip constraints lock, transitive Galaxy pins and cosign signing. Built by a CHANGELOG that reads like a CVE diary.
Surviving Windows Update in the middle of a build
Disabling updates for the duration of a build, then restoring the exact prior state, under concurrency and crash-proof. Persisted ref counting and a named mutex.
Trivy, the scanner that was stealing secrets
On March 19, 2026, the tool meant to protect the supply chain became its vector. The lesson fits in one sentence: a tag is not a trust reference.
myflec: a Bash dotfiles framework for people who deploy their home directory
A loader that sources core modules first, a bare-git backup that pushes to three forges, an rsync deploy with dry-run and automatic backups and SSH identities split per project tree. My home directory framework, explained.
Which identity runs the service and who can prove it
Windows service accounts: managed accounts, least privilege and traceability of what runs under which identity.
FluoLight: rewriting an inherited Arduino firmware into something defensible
From the 475-line blocking monolith I inherited to 119 lines of protothreading: TimedAction timers, a TCP-fragmentation-proof HTTP parser, compile-time profiles with flash budgets and comments that no longer lie. Episode two of the Fluoboard saga.
One Ansible image for GitLab CI, built right from a Paris basement
Why I stopped using the official Ansible images in CI and built my own on Alpine: multi-stage venv, pinned ansible-core, collections installed at build time. Episode one: the 2022 public release of an image born much earlier, with its honest list of early sins.
Autopsy of an inherited Arduino firmware
A 475-line meeting-room light sketch: hardcoded IPs, 20-second blocking delays, recursive HTTP retries, a local buffer returned by pointer, a reset left to the watchdog. The inherited firmware I started from, dissected with permission, for what it taught me.
GitOps, the word after the practice: gitflow, GitLab CI, Terraform and Ansible
The word GitOps has been spreading for a year and I read it recognizing what I was already doing: an adapted gitflow, conventions and a GitLab CI pipeline chaining Terraform to create and Ansible to configure, with git as the only source of truth. GitOps in the broad sense and the honest part of what it is not quite.