Infrastructure architect — enterprise IT, AI, and the systems underneath
I design and run the infrastructure that enterprises depend on: virtualization platforms, networks, identity, and increasingly the AI systems layered on top of them. This site is where I write it down properly — the reasoning, the configuration, and the failure modes that only show up in production.
Most of what I publish comes out of work I have actually shipped. Where I am uncertain, I say so.
Retrieval-augmented generation demos beautifully and fails quietly. The gap between a notebook that answers questions about ten PDFs and a system that serves an entire organisation is not model quality — it is retrieval...
The CCR2004-1G-12S+2XS occupies an unusual position: twelve SFP+ ports and two SFP28 ports in a 1U chassis, at roughly a fifth of the price of the equivalent from a mainstream vendor. I have run a pair for eight months a...
Proxmox VE has moved from homelab curiosity to a genuine vSphere alternative, and Broadcom's licensing changes accelerated that considerably. But a Proxmox cluster designed like a vSphere cluster will disappoint you in s...
This lab builds a working Active Directory environment on Hyper-V: two domain controllers, a member server, and a client, on an isolated network. It is the foundation for practising Group Policy, certificate services, re...
Multihoming with BGP is the point where enterprise networking stops being configuration and starts being policy. The protocol is simple; the failure modes are political, and they usually surface at 3am during a partial u...
"Zero trust" has been marketed into near-meaninglessness. Underneath the vendor material is a genuinely useful principle: stop granting access based on network location. Being on the corporate LAN should confer no more p...
Most "PostgreSQL is slow" tickets are an indexing problem, and most indexing problems come from adding indexes by intuition rather than by reading the plan. This is the method I use, and the specific index types that sol...
Terraform makes it easy to create infrastructure and surprisingly hard to keep a large codebase maintainable. The problems show up around the eighteen-month mark: modules nobody dares change, state files that take twenty...
"The calls are bad" is the least actionable ticket in unified communications. Bad how? For whom? In which direction? Almost every VoIP quality investigation that drags on for weeks does so because nobody separated the sy...
ZFS has a reputation for being complicated. It is not — it has a small number of decisions that are permanent, and a larger number that are trivially changeable. Knowing which is which is most of the skill. The permanent...
·6 min read
4K
Recent comments
Multi-page tables are genuinely hard and I do not have a clean answer. What has worked best is detecting the continuation by matching the column structure, stitching the fragments back together before chunking, and then...
Exactly that. Three nodes with size=3 works and plenty of people run it. The issue is what happens *during* a failure: lose one node and you have two copies with nowhere to place a third, so you are running without redun...
That is by far the most common cause I see. The frustrating part is that the symptom looks nothing like a network problem — you get a node reset with no warning and the logs after reboot tell you very little.
`journalct...
It is such an easy one to miss because the policy reads correctly in isolation. Deny non-compliant devices — obviously right. It is only when you trace the user journey that the deadlock appears.
Same class of problem a...
Good addition. The planner has to *prove* the query predicate implies the index predicate, and it cannot do that with a parameter whose value it does not know at plan time.
Generic vs custom plans matter here too — with...