Blog

Giving developers a path to a Postgres instance with no public IP, without a self-managed bastion anyone logs into and without standing up a VPN. Uses GCP Identity-Aware Proxy TCP forwarding to a headless relay VM that runs one socat process and nothing else, no SSH keys, no OS Login, IAM gates the tunnel instead of a login. Covers the network layer and the separate, non-optional step after it: Postgres-level group authentication and privilege grants, since reaching the instance is not the same as being able to query it.

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Technical reference for Azure Communication Services Email: domain verification (SPF/DKIM/DMARC), managed vs custom domain rate limits, size and resource limits, Event Grid integration for delivery and engagement tracking, and a SendGrid comparison covering the subuser/dedicated-IP model plus a worked-out cost comparison at several volumes.

Migrating Azure Key Vault Terraform state between two repositories with separate backends. Covers cross-state terraform state mv, a resource-group mismatch caught before apply, and a method for distinguishing an in-use resource from an orphaned one.

End-to-end procedure for proving network reachability, TLS handshake, channel authentication, and queue authorization against a remote IBM MQ qmgr from a Cloud Run Job using pymqi and a CMS keystore.

Procedure for importing a manually deployed Cloud Run service into Terraform state. Covers the IAM binding when the runtime service account differs from the Terraform actor, lifecycle ignore_changes for CI-managed image and env vars, and the multi-container template behavior of gcloud run services update.

Migrating a shared dev/prod Terraform state into separate Azure backends without recreating resources. Covers terraform state mv between local files and remote backends, the handling of data blocks, outputs, and random_* resources, plus rollback via reverse state mv and switching the storage account or container for an existing environment.

Proxmox node configuration covering VLAN-aware bridge networking and VM IP assignment, plus FC SAN integration with a Huawei Dorado array. Includes orphaned LVM volume cleanup, ALUA multipath with the Huawei trailing-space vendor identifier, shared LVM across cluster nodes, and foreign volume group import via vgimportclone.