Table of Contents

• Introduction
• The Problem: A Ticket for a Question
• Enter ldapsearch
• Why a Web UI on Top of It?
• The Architecture
• Setting Up the LDAP Client
• Searching Users and Groups
• Groups With Thousands of Members: Ranged Retrieval
• Running It
• Security Considerations
• Reflections
• Conclusion
• References

Here we are, one more ticket for a question that has a one-line answer.

Introduction

Every infrastructure person knows the scene. You need to know if a colleague is in a group, or who is in a group, or in which OU an account lives. You have no access to the domain controller, no AD console, no RSAT. So you open a ticket, wait for someone to read it, and get back a screenshot two days later.

Table of Contents

• Introduction
• From One NUC to Five Sites
• The Real Problem Isn’t Compute, It’s Memory
• Docs as Code, With Rules
• The Layout: Where New Things Go, Decided Once
• Templates: the Only Way New Hosts Look Like Old Hosts
• Runbooks Instead of “I Remember How I Did This”
• STATUS.md: the One File That Tells the Truth
• The Migration Folder: Rigor Where It’s Easy to Cut Corners
• Sysadmin via MCP: Claude Remote Agent, With Guardrails
• Reflections
• Three Questions for Your Own Docs
• Does This System Have a Name?
• Case Study: Watching the Agent Actually Use These Docs
• Conclusion

Table of Contents

• Why a Fallback at All
• Picking the Hardware
• Flashing OpenWrt
• The LTE Interface: qmi and the Vodafone APN
• Multi-WAN with mwan3
• An Emergency Wi-Fi AP
• The LuCI Dashboard, in Practice
• Conclusion
• Reflections

Here we are. In Italy, and we all know how it goes: it works today, tomorrow who knows.

Why a Fallback at All

I live in the countryside outside town, more farmland than periphery really, so I already count myself lucky to have FTTC at all. Mine is saturated and picks up crosstalk (diafonia) from neighboring pairs, which means the sync rate wanders and, every so often, the line just drops for hours.

Table of Contents

• The Problem
• Naaa… the alternatives
• The Pipeline
• The ai-analysis Job, Commented
• Downloading Results, Bundling the Source
• The Empty Report
• Downloading Artifacts, Watching the Run
• The AI Scripts
• The Report That Caught the Bug
• The Full Results, as an Example
• The Numbers
• Security Considerations
• Monitoring and Observability
• Conclusion
• Reflections

Here we are.

My debug/test API, pytbak, runs a proper CI: unit tests, linting, a Docker build, Trivy scanning, Checkov, a Kubernetes syntax check. Nothing exotic, just the usual pile of gates everyone bolts onto a pipeline these days. And every single one of them talks a different language. Trivy prints CVE tables. Checkov spits out a SARIF file and rule ids that mean nothing unless you’ve memorized them. kubectl describe gives you a wall of Kubernetes internals. pytest just wants you to count green dots. Each of these is perfectly readable, as long as you already speak that tool. Stack them all in one Actions log and you basically get a bunch of people talking over each other, none of them talking to you, unless you already know exactly where in the wall of text to look.

Table of Contents

• The thing I did not want to do
• Enter gh-aw
• Five workflows, one that runs itself
• How a run is wired
• The workflow file, in full
• PR #8: a hidden proxy endpoint
• What the run looked like
• The review it posted
• A finding is a challenge, not a verdict
  • The rate-limiter that is not a bug
  • The blocklist claim that is wrong in a detail
  • The firewall that fails silently
• Asking it to fix something, without letting it
• Pairing it with cybersecurity skills
  • How the agent picks its skills
• What the framework gets right
• Security considerations
  • The trust boundary, drawn
  • The prompt-injection threat model
  • Turning it off
• Cost and observability
• Conclusion
• Reflections
  • Why an LLM here, and not just more CI
  • The gaps that still bother me
  • What is still missing

Well, here we are: I wanted a second reviewer on every pull request, a sanity pass on every failed pipeline, and a monthly security sweep, and I was not willing to hand a language model a write token to get any of it.

Table of Contents

• Introduction
• The Police Uniform Analogy
• The Problem
• The Architecture
• The Proxy Worker
• Security Considerations
• Conclusion

Here we are.

Introduction

I love Cloudflare. I use it for all my projects. The free tier is generous, the API is clean, and the developer experience is miles ahead of competitors. If you’re building anything on the internet, Cloudflare should be your first stop.

But here’s the thing: Cloudflare’s trusted reputation can be used against you.

Table of Contents

• Introduction
• The Problem: A PDF Is Not an Interface
• The Architecture: From Contract to Skill
• Part One: What the App Must Be
  • Example 1: A Health-Check Clause Becomes Four Endpoints
  • Example 2: “No Root” Becomes a securityContext Block
  • Example 3: “No Persistent Data in a Container” Becomes Three Manifests
  • Example 4: A Four-Layer Image Hierarchy Becomes a Dockerfile and a Tag Strategy
• Part Two: What the App Must Say
  • Example 5: “Logs MUST Be JSON on stdout” Becomes a Logger and a Field Contract
  • Example 6: A Three-Tier Metrics Rule Becomes an Annotation and a NetworkPolicy
  • Example 7: “MUST Send Traces to a Collector” Becomes an SDK Init and an Egress Policy
  • Example 8: “Alert on Trends, Not Numbers” Becomes a Recording Rule and an HPA
• Part Three: Where the App Lives
  • Example 9: A Naming Convention Becomes a Derivation Rule
  • Example 10: “Never Commit a Plain Secret” Becomes Vault or AWS Secrets Manager
  • Example 11: “The Management Port MUST NOT Be Public” Becomes Three Absences
• Part Four: How the App Ships
  • Example 12: “No Human Tampering With the Artifact” Becomes a CI Workflow With Teeth
  • Example 13: Terraform Guardrails Become a Module Call You Cannot Widen
  • Example 14: “MUST Be in the Service Catalog First” Becomes Labels and a Generated Entry
• The Real Speedup: Building Something the Contract Never Anticipated
• How to Make Skills Actually Respected: The Gate
• From a Working App to a Platform Citizen
• Does the AI Actually Comply?
• Security Considerations
• Download the Skills
• Conclusion
• Reflections

Well. Every platform team eventually writes the same document: a PDF (or a Confluence page pretending to be one) that says what an application must do before it’s allowed to run on the shared cluster. Containerized. Non-root. Health endpoints on a specific port. No plain secrets in Git. It’s correct, it’s thorough, and almost nobody who needs to follow it has actually read it end to end.

Table of Contents

• Introduction
• The Question Nobody Answers
• The Dataset: 27 Sessions, 61 Days
• Where the Money Actually Goes
  • Cache Read Is the Bill
  • The Whale Session
  • Head and Tail
• The Model Mix Problem
• Output Compression: The Lever Everyone Reaches For First
• The Velocity Half of the Question
  • km/l Is Not the Metric. km/€ Is.
  • The Efficiency Gap Between People
• A Framework for Getting the Data
  • Step 1: Parse Your Own Logs
  • Step 2: The Ticket Protocol
  • Step 3: The Metrics That Matter
• From Measurement to a Development Framework
  • Rule 1: One Ticket, One Session
  • Rule 2: Route the Model to the Task
  • Rule 3: Compress the Output
  • Rule 4: Build Skills, Not Prompts
• The Maturity Path
• The Honest Caveats
• Conclusion
• Reflections

Here we are. Every conversation about AI in engineering right now runs on vibes. It’s faster. It’s cheaper. It’s transformative. Ask for a number and the room goes quiet.

Table of Contents

• Introduction
• The Problem With Urgency
• The Safe Zone Framework
• The Case: Algolia Usage Exporter
  • Before / After
  • How It’s Built
  • The Skill Framework: Three Skills, Not One Prompt
  • From API Schema to Natural-Language Contract
  • What It Exposes
  • Numbers That Weren’t Visible Before
• Why the Pattern Replicates
• The Honest Challenges
  • AI Amplifies Whatever Maturity Already Exists
  • Tech Debt Doesn’t Disappear
  • Creating Is Easy. Deploying on Shared Platform Isn’t
  • Ownership Is Still Informal
  • The Escalation Risk: Safe Today, Critical Tomorrow
• A Maturity Model, Not a Tech Roadmap
• Security Considerations
• Conclusion
• Reflections

Here we are. I recently put together an internal presentation on introducing AI into business processes, and the hardest part wasn’t the technology. It was convincing people to look in the opposite direction of where they instinctively point AI.

Table of Contents

• Introduction
• The Problem: Verbose Agents Cost Real Money
• Enter Caveman Mode
• The Question I Actually Wanted Answered
• Method: Mining 27 Session Logs
• The Results, Per Model
• Where the Money Actually Goes
• How Big Were These Sessions, Really?
• The Fable 5 Shift
• From a Homelab Toy to an Enterprise Line Item
• Reflections
• Conclusion

Strange… an AI assistant that talks less should cost less. Obvious, right? I wanted a number, not a vibe.