Devops
guest@6admin.io:~$ ls ~/tags/devops
Project 8: a cloud where the only authority is signed git history
A decentralized cloud platform with no controller, no quorum and no token: nodes join a Yggdrasil mesh, pull their desired state from a Radicle repository, verify every commit signature and converge locally. The architecture, the Rust port and the bootstrap day that fixed twenty bugs.
Trace-first: when observability wants to take us back to logs
Can traces replace much of application logging? And if so, why is OpenTelemetry now deprecating its span events API in favor of the Logs API? Between simpler APIs, signal correlation and architecture choices, the question deserves better than a turf war.
MyVim: the DevOps IDE that is only 640 lines, because the manager does the rest
My editor config as a plugin: one file per plugin, linters scoped by buffer content (kubeconform only on apiVersion, actionlint only on workflows), filetypes nobody ships (cloud-init, terragrunt), OSC52 over SSH and a secrets file that never gets committed. The dogfood epilogue of the vim series.
Scripting is not industrialising
The boundary between ad hoc scripting and an automation platform: desired state, idempotence, inventory, secrets, reporting, traceability. Windows automates very well too; the difference is not the OS, it is platform versus script.
Clean package management on Windows: WinGet, Chocolatey, Scoop and Ansible, each in its place
Discovering and adopting Scoop for my Windows environments: shims, separation of responsibilities between package managers, Ansible orchestrating everything (winget, chocolatey, scoop and MSI/EXE through win_package) and mise per project. Environment as Code.
Linux is just the kernel
A useful bit of pedantry about what Linux actually is, then the substantive point: the layers people use to rank sysadmin profiles measure the distribution, not the system and the kernel stays the common denominator.
Driving opencode behind an SSH tunnel, with direnv
The logical sequel to my ssh and git config: a direnv .envrc that brings up a self-healing SSH tunnel per project, routes opencode and a coding agent to a remote gateway and opens a SOCKS5 for the browser and proxychains. Non-blocking, throttled and always exit 0.
Your DNS zone is already an inventory: the log0u7.dns collection
An Ansible dynamic inventory built from DNS records, without zone transfers: TXT manifests, SRV records, DNS-SD (RFC 6763) and naming patterns, resolved in parallel. Plus the reverse converter that turns any inventory into a BIND zone.
A Backup Without a Restore Test Is Decoration
You don't know whether your backup works until you've restored it. The git clone as a free backup, multiple remotes, Restic/Borg/rclone for the rest and why Btrfs/ZFS snapshots are not backups.
Doing internal ACME without begging the AD CS team
Step-ca, acme2certifier or OpenBao? Three families and the choice depends first on what you already run, then on who must remain the issuer.
Terraform creates, Ansible configures
Why IaC and configuration management do not overlap, why Terraform alone only holds in a strictly immutable model and how remote-exec is the signal that you have crossed the line.
fnox and age: encrypted secrets in my repos, no server
fnox, the secrets manager by the author of mise, encrypts secrets straight into the repo with age: a versioned fnox.toml, explicit keys, no secrets server to maintain. A late-2025 discovery.
mise: one static binary for all the tool versions
I adopted mise in 2024 to manage per-project tool versions: one Rust binary, asdf's .tool-versions compatibility, per-directory activation that does not crawl and an end to hand-rolled versions in every repo.
Docker Swarm to Kubernetes: why I abandoned Swarm
Swarm works well for small deployments. But no rootless, no CSI, no autoscaling and a MACVLAN pinned to a single node: the four walls that forced the migration.
Scale-to-zero: Sablier wakes Swarm and Kubernetes on demand
Sablier wakes a sleeping container when someone knocks at the reverse proxy, then scales it back to zero. Scale-to-zero on Docker, Swarm and Kubernetes, with the real Traefik config, the two strategies and the true price of handing it the Docker socket.
SSH in 2021: what thirteen years changed since the 2008 series
This blog's SSH series ended in 2013 with PKCS#8. Here is the 2021 version, complete and secure: Ed25519, FIDO2 keys, certificates, sshd hardening, Include and Match, ProxyJump and multiplexing. What 2008 did hopefully, 2021 does with primitives.
3factor: the architecture that removes state from the API
3factor is an architecture pattern, not a framework: realtime GraphQL, reliable eventing and async serverless, with one central idea, removing state management from the API layer.
Chaos engineering: breaking things for real, but not just any way
Chaos engineering is not sabotage: it is a controlled experiment, with a measured steady state, a hypothesis, real faults injected and a bounded blast radius. History, principles, tools and an honest fit for modest infrastructure.
Twelve-Factor App: the Heroku method that survived containers
Adam Wiggins's twelve factors, written for Heroku in 2011, remain the best checklist for shipping an application as a service: config in the environment, stateless processes, dev/prod parity, logs as event streams, then their translation into containers and Kubernetes.
The R.A.C.H.E method: Rapid Application Conception and Heuristic Extreme-programming
Rapid Application Conception and Heuristic Extreme-programming: the satirical method from the International Institute of La RACHE formalises what everybody already practises, with an eight-word post-it to scope the project and a FAQ that tells the truth.
DevOps, a word for what I was already tinkering with
The word DevOps is starting to circulate and I recognise in it what I was tinkering with at my own small scale: ssh and a CSV, git and bash hooks, gitolite on top. What it brings to mind and the honest part about why the wall never bothered me much.
Puppet: my first modules, or moving from the ssh loop to declaring
After my bash scripts and my CSV inventory, Puppet: the install/config/service triad, $::operatingsystem selectors and require/notify chains. What declaring brings to the ssh loop.
Magic SysRq: the sysadmin's crutch
The kernel SysRq key, the REISUB sequence and why it is the last thing you do before pulling the plug.
Root or not root
Su, sudo and the question of who gets to do what on a shared system.