Windows
guest@6admin.io:~$ ls ~/tags/windows
log0u7.hyperv: the second dynamic inventory, this time from the hypervisor
An Ansible collection on Galaxy that builds the inventory from Hyper-V itself: VMs queried over WinRM or PSRP, native Cacheable and Constructable mixins, state/host/tag groups and the design choices that differ from a DNS-based inventory.
Jenkins on Windows Server: what not to do
A Jenkins controller on a domain-joined Windows host, the built-in node on the controller, the 8080 in the open, AD credentials in cleartext: the anatomy of a compromise chain and how to take it apart.
wimcast: building Windows images on Linux, without Windows
A PyPI-published tool that turns Windows ISOs into a Foreman-ready WIM tree, unprivileged on Linux: no Windows host, no root, no mount(2), no FUSE, no ADK. Drop-in replacement for the PowerShell pipeline it retired, with a content-addressed cache and a pinned wimboot.
Scripting is not industrialising
The boundary between ad hoc scripting and an automation platform: desired state, idempotence, inventory, secrets, reporting, traceability. Windows automates very well too; the difference is not the OS, it is platform versus script.
Windows 11 for build machines: the wrong tool
Windows 11 client on headless bare-metal build machines in a server room: the detail of the provisioning and operational friction and why Windows Server with Desktop Experience does the same job for a fraction of the pain.
Clean package management on Windows: WinGet, Chocolatey, Scoop and Ansible, each in its place
Discovering and adopting Scoop for my Windows environments: shims, separation of responsibilities between package managers, Ansible orchestrating everything (winget, chocolatey, scoop and MSI/EXE through win_package) and mise per project. Environment as Code.
The cloned hostgroup that refused to save
A cloned Foreman hostgroup throws a 500 on every edit. The trail leads to a field that gains a base64 layer with each clone and in passing to a Windows administrator password stored reversibly in the database and copied into the audit logs.
Surviving Windows Update in the middle of a build
Disabling updates for the duration of a build, then restoring the exact prior state, under concurrency and crash-proof. Persisted ref counting and a named mutex.
A segfault in the JVM and an EDR at the bottom of the stack
A Jenkins controller crash-looping on EXCEPTION_ACCESS_VIOLATION, a JDK migration done with no post-mortem and an EDR DLL showing up at the bottom of every crash dump. How to read a stack honestly and confirm a cause by elimination rather than conviction.
Secure Boot and PXE: the chicken, the egg and four ways out
Booting blank Windows machines over PXE with Secure Boot on, without turning it off: the UEFI chain of trust, why snponly over ipxe and four real ways out of the enrollment paradox.
When a Chocolatey checksum breaks a whole provisioning run
A Chocolatey Community package whose vendor updated the binary without the maintainer updating the checksum and the whole Windows provisioning stops. The real subject is not the hash, it is depending on a binary you do not host.
Nginx in front of Perforce: layer-4 TLS termination and the P4 protocol
Putting nginx in TLS termination in front of a Perforce server: why the stream module and not an HTTP proxy, what the P4 protocol imposes and the keepalive and timeout tuning without which long sessions get cut on multi-hour syncs.
Portable assembly does not exist
A concrete inventory of everything that changes from one OS to another once you drop down to assembly: assemblers, executable formats, ABIs, calling conventions and system calls. Spoiler, the word portable does not survive the trip.
Nginx on Windows in front of Jenkins: the proxy, the logs and the upgrades
Nginx on Windows Server terminating TLS in front of Jenkins: the UI and the WebSocket agents in a single location, the certificate through simple-acme and above all the two operational nuisances nobody writes about on Windows, log rotation and the Chocolatey upgrade.
Which identity runs the service and who can prove it
Windows service accounts: managed accounts, least privilege and traceability of what runs under which identity.
PowerShell execution policy and what it is not
PowerShell ExecutionPolicy: what it actually protects, what it does not and the known bypasses.
Driving Windows from Ansible without leaking credentials
Ansible transport to Windows: WinRM, Kerberos over NTLM and how not to carry domain credentials in cleartext.
Hardening WinRM
WinRM hardening: transport, authentication and what to lock down before exposing Windows remote management.
Hyper-V S2D vs Proxmox Ceph: the comparison that decided it
Hyper-V + Storage Spaces Direct versus Proxmox VE + Ceph: what performance actually means, TCO and the decision for a fleet of game development studios.