infrastructure-as-code
Keeping the repository, not the machine, as the source of truth about a system.
-
The Whole Estate in One Article: How Every Layer Fits Together
Each layer of a self-hosted platform is well documented in isolation, but nothing describes the order they have to arrive in or why getting that order wrong fails weeks later rather than immediately. This article walks the full dependency chain from bare metal to self-hosted model serving, and demonstrates the ordering discipline with a runnable Compose file.
-
Testing Infrastructure Code by Executing Its Real Expressions
A test that reimplements an Ansible expression's logic in Python proves two independent implementations agree today, not that the shipped expression is correct, and the two can drift apart while both keep passing. This article renders the actual expression through Ansible's own Templar and filters, using a recursive dict merge as a concrete case where a hand-written paraphrase gets it wrong.
-
Runtime Configuration for an Angular Container Without Rebuilding
A frontend that reads its backend URL from an environment variable at build time needs a full rebuild for every deployment target, which defeats the point of building an image once. This article generates the frontend's runtime configuration from a container-start entrypoint instead, with a complete Dockerfile and compose setup that proves one image serves two different backends without being rebuilt.
-
Building the Dry-Run Path First, and Testing That It Sends Nothing
A dry-run flag added after the real logic is written tends to fall out of sync as the real path grows new side effects nobody remembers to gate. This describes structuring a tool so planning and execution are separate from the start, and writing a test that proves dry-run mode sends nothing.
-
A Single-Writer Rule for Configuration Held in Redis
When several services can write the same Redis key, a read after a write can return someone else's value and nobody owns the truth. This walks through a lease-and-version pattern that makes one process the only writer, with a complete Python example a reader can run on a laptop.
-
Infrastructure as Code with Ansible: Making a Host Reproducible from the Repository
Infrastructure as code only works if the repository is the single source of truth for a host's configuration, and that discipline is easy to state and easy to break under pressure. This walks through why partial coverage buys almost none of the benefit, why idempotence is the actual product rather than a nice property, and ends with a complete Ansible role, run against a throwaway container, that a reader can use to watch drift get corrected.
-
Managing a Shared DNS Zone Through a Replace-Everything API
Many registrar and DNS provider APIs expose only "replace the whole zone", with no way to add or remove a single record, so naive automation that computes its desired records and pushes them deletes every record it does not know about. This builds a read-merge-write client with an ownership marker that tells apart managed and unmanaged records, backed by a small local test server so the whole pattern can be run and verified without any real registrar.
-
Provisioning a Single-Board Computer as an Industrial Edge Node
Turning a bare carrier board into a working edge node is usually a manual sequence someone follows from memory, and it differs subtly between board revisions in ways the checklist never mentions. This builds an Ansible role that detects the board at runtime, loads revision-specific settings, and applies a common baseline, tested against a throwaway container so the logic can be verified without any real hardware.
-
Configuration Precedence: Docker Secrets, Kubernetes Secrets, Environment, .env, Default
A service that reads configuration only from environment variables forces every deployment target to shoehorn secrets into that one mechanism, and nothing in the code says which value wins when two sources disagree. Here is a small, tested resolver with a fixed precedence order, and the tests that prove it behaves the same in Compose, in Kubernetes and on a laptop.
-
Deploying Docker Compose from Ansible Without Shelling Out
Wrapping docker compose up in an Ansible command task gets a stack deployed but throws away everything Ansible is for: real change detection, check mode, and a diff you can trust. Here is how to deploy the same stack through a module that actually understands compose state, with a full working example.
-
Ansible Role Idempotence: Why a changed=0 Run Is the Only Proof You Have
A role that reports changed on every run has stopped detecting drift, and nothing in Ansible's exit code tells you so. Here is how that happens module by module, and how to make the second run's changed=0 an automated check rather than something you eyeball.
-
Migrating the SSH Port Mid-Playbook Without Locking Ansible Out
Changing sshd's port during provisioning severs Ansible's own control connection unless the validation, restart, connection update and firewall change happen in the right order. Here is that order, and the two guards that make it safe to re-run.