Decisions
A transparent log of technical decisions I've made while automating and securing infrastructure. Each entry documents the context, alternatives considered, and the reasoning behind the choice.
7 decisions documented
Centralising Fleet Logs in Graylog Instead of Per-Host FilesLogs lived on each machine in local files under their own rotation, read only reactively after something had already gone wrong. Correlating an issue across more than one host mean...Read decisionSelf-Hosting File Sync on Nextcloud with Object Storage as PrimaryFiles lived wherever was most convenient—managed cloud providers chosen by default rather than on purpose—which meant handing data and its retention to a third party. Self-hosting...Read decisionAdopting OpenClaude as a Coding AgentA growing share of day-to-day work—automation scripting, infrastructure-as-code, and small development tasks—benefits from an AI coding agent that can read a repository, run comman...Read decisionChoosing OpenBao and Vaultwarden for Secrets ManagementSecrets for machine-to-machine communication and personal/shared credentials were scattered across configuration files and informal channels, without a consistent way to rotate or...Read decisionDeploying FreeIPA for Centralised Identity ManagementUser and host identities were managed inconsistently across systems, with no single source of truth for accounts, groups, or DNS records tied to hosts.
Read decisionAutomating Certificate Issuance with ACME Instead of Manual RenewalTLS certificates across managed machines were issued and renewed manually, which meant renewals were easy to miss and created recurring outage risk when certificates expired unnoti...Read decisionAutomating BlueCat DNS Configuration with AnsibleDNS records across the university infrastructure were maintained manually in the BlueCat DNS management platform, making changes slow, inconsistent, and hard to audit across the In...Read decision