Hybrid Cloud Engineer & Infrastructure Automation.
I'm a Hybrid Cloud Systems Engineer specializing in Azure, Terraform, and Zero-Trust network architecture. By day I design production infrastructure - here I publish the hardened templates and deep dives I wish existed when I needed them.
Currently focused on compliance-ready infrastructure blueprints for ISO 27001, NIS2, and KRITIS environments.
A Logic App Standard booted into an HTTP 403 at every restart, and the portal designer only showed a generic error. Root cause: a private Storage Account needs four Private Endpoints - blob, file, queue, and table - not just the two that look obvious. Here's the postmortem and the Terraform that prevents it.
Read →Velero's daily backup reported 'Completed' for weeks without ever capturing PVC data. The k8s manifests were there, but Postgres, Vaultwarden, and Paperless data was completely missing. Here's how defaultVolumesToFsBackup fixes it and why velero backup describe is the only real verification.
Read →How a single Authelia instance protects Proxmox, PBS, Grafana, ArgoCD, Headscale, and 20+ web apps with OIDC — CNPG-managed Postgres, Redis sessions, hmac_secret in Vault, and a Traefik ForwardAuth middleware that gates every request.
Read →Atlantis was running inside k3s, managing the same Proxmox VMs it ran on. When bpg/proxmox issued a qmshutdown for a non-live-update attribute, it killed the Atlantis pod that was executing the apply. Here's the structural hazard and the fix.
Read →8 production-ready patterns for NSGs, Private Endpoints, Forced Tunneling, and Managed Identities. Sent to your inbox instantly.
