DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
Teleport instead of a VPN: audited access to servers, Kubernetes, and databases
Teleport solves a different problem than NetBird or Cloudflare Tunnel: they give you network access, Teleport gives you audited access to a specific resource. We cover short-lived certificates instead of SSH keys and kubeconfig, session recording with tsh play, and resource-level RBAC — then wire up access to a test Kubernetes cluster with tsh kube login.
-
Database schema as code: Atlas on top of CloudNativePG instead of hand-rolled migrations
GitOps closed the diff-review gap for manifests and infrastructure, but most teams still change their database schema by hand. A look at Atlas's declarative approach: diff instead of a migration chain, a CI gate, and the AtlasSchema CRD on top of CloudNativePG.
-
Guardrails for AI SRE agents: automating remediation without losing control
AWS DevOps Agent and Azure SRE Agent have been GA since March 2026, and neither pushes production changes without human confirmation. Here's how to design an approval gate on top of your own incident pipeline: three levels of autonomy, a narrow executor instead of direct cluster access for the agent, and what to log for audit.
-
Sidecar-free service mesh: Cilium Service Mesh next to Istio Ambient
Cilium Service Mesh handles mTLS and L7 routing on the eBPF datapath with no separate proxy components at all — unlike Istio Ambient, which drops the sidecar but keeps ztunnel and waypoint. We compare the architectures, the honest limitations, and turn on mTLS in a cluster that already runs Hubble.