Blog

Giving developers a path to a Postgres instance with no public IP, without a self-managed bastion anyone logs into and without standing up a VPN. Uses GCP Identity-Aware Proxy TCP forwarding to a headless relay VM that runs one socat process and nothing else, no SSH keys, no OS Login, IAM gates the tunnel instead of a login. Covers the network layer and the separate, non-optional step after it: Postgres-level group authentication and privilege grants, since reaching the instance is not the same as being able to query it.

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Technical reference for Azure Communication Services Email: domain verification (SPF/DKIM/DMARC), managed vs custom domain rate limits, size and resource limits, Event Grid integration for delivery and engagement tracking, and a SendGrid comparison covering the subuser/dedicated-IP model plus a worked-out cost comparison at several volumes.

Migrating Azure Key Vault Terraform state between two repositories with separate backends. Covers cross-state terraform state mv, a resource-group mismatch caught before apply, and a method for distinguishing an in-use resource from an orphaned one.

A technical survey of sensing technologies and SLAM algorithms used to build floor plans and 3D models of building interiors. Covers ultrasound, time-of-flight, LiDAR, vision, radar, and inertial methods, with build recommendations for tiny indoor mapping devices.

End-to-end procedure for proving network reachability, TLS handshake, channel authentication, and queue authorization against a remote IBM MQ qmgr from a Cloud Run Job using pymqi and a CMS keystore.

Migrating a Kubernetes-deployed nginx proxy that dispatches HTTPS traffic by header value to a GCP global external Application Load Balancer using Internet NEGs and URL-map header matches.

Roles of GPU, CPU, DPU; CUDA programming model; NVIDIA / AMD Instinct / Intel Gaudi data-center accelerators; AMD Ryzen AI, Intel Core Ultra, Apple Neural Engine, Qualcomm Hexagon client NPUs; Jetson Orin, Coral, Rockchip edge silicon; NVLink generations.

Procedure for importing a manually deployed Cloud Run service into Terraform state. Covers the IAM binding when the runtime service account differs from the Terraform actor, lifecycle ignore_changes for CI-managed image and env vars, and the multi-container template behavior of gcloud run services update.

Industry standard and most secure way to grant developers access.

Safest way to access an RDS PostgreSQL instance via AWS SSM.

Alternative solution

Cloud specialist's continious activity.

Configure IRC client.

Persistent volumes configuration.

Migrating a shared dev/prod Terraform state into separate Azure backends without recreating resources. Covers terraform state mv between local files and remote backends, the handling of data blocks, outputs, and random_* resources, plus rollback via reverse state mv and switching the storage account or container for an existing environment.

Cost‑effective, high‑performance computing for businesses and the home.

Proxmox node configuration covering VLAN-aware bridge networking and VM IP assignment, plus FC SAN integration with a Huawei Dorado array. Includes orphaned LVM volume cleanup, ALUA multipath with the Huawei trailing-space vendor identifier, shared LVM across cluster nodes, and foreign volume group import via vgimportclone.

How to use Wireguard VPN in cloud infrastructure.

IPsec tunnels between cloud Kubernetes and On-Premise DC.

Often needed commands and tricks.

Making encrypted files and media.

Useful things for Vim CLI daily usage.

Deployment notes.

Choosing battery for radio station.