Solutions
Infrastructure guides from real-world projects.
Deep dives into DevOps challenges, infrastructure patterns, and proven solutions. Learn from work that's already live in production.
Complete SRE Stack: Monitoring, Security & Disaster Recovery
kube-prometheus-stack, Falco runtime threat detection, and Velero — full observability, security, and disaster recovery layer for Kubernetes.
Read solutionImplementing Secrets & Zero-Trust in Kubernetes
SOPS+age encrypted secrets, default-deny NetworkPolicies, and SSH hardening — complete secrets hygiene and zero-trust for a Kubernetes cluster.
Read solutionHigh Availability Kubernetes on Ubuntu for GPU-Accelerated AI Workloads
5-node bare-metal HA cluster on Ubuntu: kubeadm, 3 control planes, GPU worker (GTX 1070). Foundation for a private AI platform.
Read solutionProduction Kubernetes Networking and GitOps: Cilium, Flux CD, and Democratic CSI
Flannel → Cilium eBPF migration, Flux CD GitOps with SOPS+age secrets, TrueNAS iSCSI storage via Democratic CSI.
Read solutionPrivate AI Platform: LiteLLM, Open-WebUI, Qdrant, and RAG on Kubernetes
Fully airgapped AI stack: Ollama GPU inference in k8s, LiteLLM model router, Open-WebUI, and a Qdrant RAG pipeline over a local knowledge base.
Read solutionKubernetes AI Platform: GitOps Migration
Consolidated separate k8s repos into a single GitOps monorepo — one source of truth, faster iteration, cleaner Flux structure.
Read solutionBuilding an End-to-End GitOps CI/CD Pipeline: From Docker to Flux
Eliminated manual deployments entirely — zero-touch pipeline from Docker build through GitHub Actions CI to Flux CD auto-sync on Kubernetes.
Read solutionBuilding a Portable DevContainer Environment: A Complete Journey
Reduced dev environment setup from hours to minutes — fully reproducible DevContainer with Mise, Chezmoi, and Neovim that spins up identically on any machine.
Read solutionBuilding a Secure Arch Linux Server with Full Disk Encryption
Hardened a bare-metal server to production security standards — LUKS2 full-disk encryption, pure Wayland, zero unnecessary services, Tailscale for remote access.
Read solutionSecuring LAN Networks with pfSense and Mullvad VPN
937 Mbps throughput maintained through full VPN tunnel — network-wide traffic encryption with pfSense and Mullvad, no per-device clients, enterprise firewall rules.
Read solution