Blog

Giving developers a path to a Postgres instance with no public IP, without a self-managed bastion anyone logs into and without standing up a VPN. Uses GCP Identity-Aware Proxy TCP forwarding to a headless relay VM that runs one socat process and nothing else, no SSH keys, no OS Login, IAM gates the tunnel instead of a login. Covers the network layer and the separate, non-optional step after it: Postgres-level group authentication and privilege grants, since reaching the instance is not the same as being able to query it.

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Technical reference for Azure Communication Services Email: domain verification (SPF/DKIM/DMARC), managed vs custom domain rate limits, size and resource limits, Event Grid integration for delivery and engagement tracking, and a SendGrid comparison covering the subuser/dedicated-IP model plus a worked-out cost comparison at several volumes.

Migrating Azure Key Vault Terraform state between two repositories with separate backends. Covers cross-state terraform state mv, a resource-group mismatch caught before apply, and a method for distinguishing an in-use resource from an orphaned one.

A technical survey of sensing technologies and SLAM algorithms used to build floor plans and 3D models of building interiors. Covers ultrasound, time-of-flight, LiDAR, vision, radar, and inertial methods, with build recommendations for tiny indoor mapping devices.

End-to-end procedure for proving network reachability, TLS handshake, channel authentication, and queue authorization against a remote IBM MQ qmgr from a Cloud Run Job using pymqi and a CMS keystore.

Migrating a Kubernetes-deployed nginx proxy that dispatches HTTPS traffic by header value to a GCP global external Application Load Balancer using Internet NEGs and URL-map header matches.

Roles of GPU, CPU, DPU; CUDA programming model; NVIDIA / AMD Instinct / Intel Gaudi data-center accelerators; AMD Ryzen AI, Intel Core Ultra, Apple Neural Engine, Qualcomm Hexagon client NPUs; Jetson Orin, Coral, Rockchip edge silicon; NVLink generations.

Procedure for importing a manually deployed Cloud Run service into Terraform state. Covers the IAM binding when the runtime service account differs from the Terraform actor, lifecycle ignore_changes for CI-managed image and env vars, and the multi-container template behavior of gcloud run services update.

Giving developers access to a private Cloud SQL instance without static IP allowlists or shared passwords. Covers the Cloud SQL Auth Proxy TLS 1.3 tunnel, IAM Database Authentication with Google Workspace identities, engine-specific database flags, and Terraform for the instance, users, and project-level bindings.

Deploying a FortiGate NGFW VM from the Azure Marketplace with a two-arm WAN/LAN design. Covers Terraform for the subnets and NSGs, a UDR routing AKS egress through the firewall, a VIP for inbound HTTPS, asymmetric routing settings, and the SNAT policy on the LAN to WAN path.

Reaching a private RDS PostgreSQL instance from a developer laptop with no static password, no bastion login, and no VPN. Combines AWS SSM Session Manager port forwarding to a headless target with IAM Database Authentication, where the IAM token replaces the DB password. Covers the Terraform to enable iam_database_authentication on the RDS instance and the SQL grants to bind IAM identities to Postgres roles.

Building a self-managed NGFW for PCI-DSS compliance as an alternative to Azure Premium Firewall at $1300 per month. Compares FW and NGFW capabilities across layer 7 application awareness, IDS/IPS, identity-based policy, malware scanning, and TLS inspection.

Using az monitor to measure CPU, memory, and IO utilization on an Azure Database for PostgreSQL Flexible Server, then deciding whether to downscale a Standard_D2s_v3 SKU based on the observed headroom.

Bringing up the Intel IPU3 CIO2 and ImgU camera pipeline on Debian 12 for a Dell Latitude 7212 Rugged Extreme Tablet. Covers the libcamera plus PipeWire userspace stack that replaces the uvcvideo path, kernel module loading, IPU3 firmware, and verification with v4l2-ctl.

Configuring WeeChat on Debian to connect to Libera Chat over TLS. Covers SASL and NickServ authentication, storing passwords with /secure, autojoin, and tunneling the connection through Tor.

Kubernetes canary deployment patterns: running v1 and v2 pods side by side with traffic split by replica count, header-based tenant targeting via Istio VirtualService and NGINX Ingress annotations, backward-compatible schema changes for shared databases, and rollback via traffic shift.

How cert-manager issues Let's Encrypt certificates in Kubernetes: the Certificate to CertificateRequest to Order to Challenge lifecycle, the temporary HTTP-01 solver pod, Service and Ingress, the internal self-check, and finalization back to a TLS Secret. Covers both HTTP-01 and DNS-01 ClusterIssuer setup.

Recovering a Kubernetes PersistentVolumeClaim stuck in Terminating state. Covers inspecting pvc-protection and external-provisioner finalizers, DeletionTimestamp, ClaimRef mismatches, and the field-selector query that surfaces the Pod or volume attachment still holding the mount.

Migrating a shared dev/prod Terraform state into separate Azure backends without recreating resources. Covers terraform state mv between local files and remote backends, the handling of data blocks, outputs, and random_* resources, plus rollback via reverse state mv and switching the storage account or container for an existing environment.

Notes on running a Raspberry Pi 4 Model B as a lightweight ARM homelab node or travel dev machine. Covers the closed-firmware boot chain (bootcode.bin, start4.elf, kernel8.img), config.txt, ZRAM and swap tuning, encrypted boot, remote builds, and ARM container images.

Proxmox node configuration covering VLAN-aware bridge networking and VM IP assignment, plus FC SAN integration with a Huawei Dorado array. Includes orphaned LVM volume cleanup, ALUA multipath with the Huawei trailing-space vendor identifier, shared LVM across cluster nodes, and foreign volume group import via vgimportclone.

Practical VPN setups across cloud platforms: OpenVPN with AWS VPN Gateway, Azure VPN Gateway, and Debian 12, an OpenVPN client on a GitHub Actions macOS runner, WireGuard between cloud infrastructure and clients, and a FortiGate scenario.

Reference of frequently used psql meta-commands and SQL queries against pg_roles, pg_catalog, and information_schema for listing databases, roles, schemas, tables, and privileges.

Building IPsec S2S tunnels between an Azure workload (Linux VM or VNet) and an on-premise datacenter behind a Mikrotik router. Covers Strongswan on the Azure VM, IPTables for SNAT variants, Azure VPN Gateway with LAN and SNAT scenarios, plus the ports and protocol numbers (ESP 50, AH 51, UDP 500, UDP 4500) that must clear every hop.

Everyday kubectl and Helm reference on Debian 12. Covers apt repository setup for both tools, Helm chart operations such as values export and chart archive unpack, and other snippets I reach for from muscle memory.

Three encryption workflows: building a Java PKCS12 truststore with keytool for a Kubernetes app talking to remote IBM MQ (using distinct trustedCertEntry aliases that keytool needs but OpenSSL cannot set), encrypting an SD card, and encrypting individual files with GPG.

A Python-based notebook exploring apartment investment in Avsallar, Turkey. Covers scraping listings from a local agency website with requests plus BeautifulSoup, dataset collection notes from Telegram channels and real estate agencies, and the trade dynamics that make transaction prices differ from advertised ones.

Personal daily-use Vim reference: open/save/close, selections, motions, buffers and splits, search and replace, sessions, key mapping, gvimrc, code completion, plugins including AI-oriented ones, custom commands, and scrolling.

Wiring an Apache Airflow deployment on Kubernetes to load connections and variables from HashiCorp Vault via the Kubernetes auth method. Covers per-environment Vault ACL policies, the VaultBackend Helm values, and the mapping between Airflow Variables/Connections and Vault KV secret structure.

Two topics on batteries. Reading Linux laptop battery state from /sys/class/power_supply and configuring i3status to display current full capacity instead of design capacity. Sizing a battery for a portable radio station based on power draw and duty cycle.