Writing
Notes from actually building this
Long-form notes on AI governance, identity, compliance as code and cloud platform engineering - written while the terminal was still open.
-
Building an AI Landing Zone on Azure - Part 1: Why every enterprise needs an AI gateway
Teams are calling LLM endpoints directly with API keys in config files and nobody knows who is spending what. Here is the landing zone I built to fix that, and why.
-
Building a Cloud-Native PKI with HashiCorp Vault
I built an HA Vault PKI on Kubernetes to sign the subordinate CA that Global Secure Access needs for TLS inspection. Vault cannot issue a certificate that is both a CA and carries Server Auth EKU, so it could not be done. Updated September 2026: Microsoft now offers a managed certificate for GSA in preview, which removes the problem entirely.
-
GitLab CI/CD for Cloudflare Pages: Automated Deployments with Preview Environments
How to set up a GitLab CI/CD pipeline for Cloudflare Pages with preview deployments on merge requests and automatic production deploys.
-
Building a Raspberry Pi5 Cluster with Talos Linux and Cilium
A small, quiet, genuinely highly-available Kubernetes cluster on four Raspberry Pi 5 boards, running Talos Linux with Cilium - the full kit list, the build, and everything that bit back.
-
Self-hosted Gitlab Runners on AKS, with Managed Identities
Self-hosted GitLab runners on AKS using Managed Identities instead of service principals - so a runner can only ever act as itself, with exactly the permissions its jobs need.
-
New Website, refactored
Moving ascode.nl off Hugo and AWS onto Eleventy and Cloudflare Pages - and why a static site that takes one command to build beat the serverless stack it replaced.
-
Shared VPC Subnet tagging
Sharing a central VPC across AWS accounts in a landing zone, and using subnet tags to keep isolated, private and transit-gateway subnets straight per account.
-
AWS Account creation, fully automated - ascode style
Vending new AWS accounts from Terraform - organisations, OUs and baseline guardrails applied automatically, so a new account is never a hand-built snowflake.
-
How to build a serverless website, in AWS
Building the first ascode.nl as a fully serverless site on AWS - S3, CloudFront, ACM and Route 53 in Terraform, with a DTAP street and GitLab CI doing the deploys.