Notes on infrastructure that is supposed to run unattended.
I write about designing and running IT environments: from Windows Server and virtualisation, through automation, to Kubernetes and GitOps. Practical, from the point of view of the person who has to keep it running afterwards.
Topics
All topicsKubernetes and GitOps
Container platforms run declaratively: cluster, networking, data, and deployment from a repository.
Automation
Ansible, playbooks, workflows and ITSM integrations. Repeatability instead of heroics.
Windows Server
Active Directory, Hyper-V, Group Policy and everything that still runs on Windows in real companies.
Observability
Logs, metrics, alerts. What to collect, what to ignore, and how not to drown in data.
CI/CD
Pipelines, image builds, releases. From commit to running application with no manual steps.
Networking
Segmentation, DNS, firewalls, load balancing and links. The foundation nobody remembers until it fails.
Security
Privileged accounts, hardening, email, endpoints. Security as a property of the environment, not a product.
Backup and recovery
The 3-2-1 strategy, RPO and RTO, restore tests. A backup is worth exactly as much as its last successful test.
Email and Microsoft 365
Exchange Online, filtering, quarantine, sender authentication. The one service every employee sees.
Endpoints
Group Policy, endpoint management tools, updates, standardisation. Hundreds of machines, one target state.
Latest posts
All postsA playbook that survives team turnover: structuring roles, variables and secrets
A playbook written by one person works exactly as long as that person stays at the company. A few structural rules that let the next administrator understand it within an hour.
Network segmentation in a small company: how many VLANs is too many
A single flat network is simple until the first incident. Five segments are enough for most organisations, provided that policy stands between them and not just a VLAN number.
Alerts that do not wake you at night for nothing: thresholds, deduplication and escalation
Two hundred alerts a day means nobody reads any of them. How to design alerts so that each one requires action, and the one at three in the morning is actually worth it.
Privileged accounts in Active Directory: a tiering model without a full PAM rollout
You do not need to buy a privileged access management system to stop logging on to workstations with a domain administrator account. Three tiers, separate accounts and a few Group Policy settings are enough.
Principles I work by
Declarative, not manual
The state of an environment should follow from a repository, not from a sequence of clicks. If something cannot be recreated from code, it is not finished yet.
Observability first
Before I optimise or fix anything, I want to know what is happening. Logs, metrics and alerts are designed together with the system, not after the first outage.
Simplicity as a requirement
Every component is a maintenance cost for years. I add a layer only when it solves a real problem that cannot be solved more simply.