Article
Lessons from Replacing a Legacy VPN with ZTNA
Practical lessons from an enterprise ZTNA deployment: foundations, staged migration, policy automation, legacy applications, change management, and measurement.
Articles
Implementation notes, architecture decisions and lessons learned across identity, security, cloud platforms, networking and automation.
Featured article
A practical starting point
More articles
Newest first
Showing all 36 articles.
Article
My 18KB Homepage Weighs 42KB
A design review measured this site's homepage at 18.1KB. Re-measured cold two weeks later, it was 42KB — partly from changes to the page, and partly from the largest single item on the page, an analytics script that in-page measurement reports as zero bytes.
Article
Writing About Work You Cannot Describe
Most of what I learn professionally cannot be published as it stands. The method I use to separate the transferable lesson from the confidential artifact, why redaction is the wrong tool, and the checklist that enforces it.
Article
Auditing an Accessibility Claim I Had Not Earned
This site claimed WCAG 2.2 AA. I had scanned two pages out of thirty-four. Extending the sweep to every route in both themes found nineteen failures on one page, and two more that only exist at phone width.
Article
When Prompt Caching Costs More Than No Caching
Prompt caching bills writes at a premium and reads at a discount, so a cache that never reads back is strictly more expensive than not caching at all. How I found one deployment doing exactly that, and what made it visible.
Article
An Encrypted Linux Engineering Workstation
Building an Ubuntu engineering laptop where the disk encryption, credential storage and boot behaviour are decisions rather than defaults: TPM2-backed LUKS unlock, a separate encrypted work volume, and an honest account of what each choice does and does not protect.
Article
A Fail-Closed VPN on an Appliance-Class Device
Building a WireGuard tunnel with a real kill switch on a device with no package manager and a read-only root: the bootstrap paradox, the unit-ordering typo systemd accepts silently, and why a watchdog that heals a fault also hides it.
Article
Renaming a Linux Account Without Losing Access
A username rename looks like one command and touches a dozen things. What a Linux account is actually referenced by, how to change it remotely without locking yourself out, and why changing the UID is a different job entirely.
Article
What Microsoft Applied Skills Actually Test
I completed 30 Microsoft Applied Skills in ten days. The interesting part is not the number — it is what a lab-based assessment measures that a certification exam cannot.
Article
Building a Better Cloudflare Gateway Block Page
How I used a Cloudflare Worker to enrich Gateway blocks with policy, device, user, category and Cloudflare One Client context while keeping the page resilient and secure.
Article
A Multi-Cloud Zero Trust Lab, Built in Terraform
How I built a repeatable AWS, Azure and Google Cloud lab to explore Cloudflare Access, Gateway, WARP routing, device posture and external evaluation as one integrated Zero Trust system.
Article
Cloudflare DNS Ad Blocking with Terraform
I used Terraform to fetch public domain feeds, turn them into Cloudflare Zero Trust lists and enforce them with a Gateway DNS policy that remains reviewable as code.
Article
Gating Cloudflare Access on Training Completion
Authentication proves identity, but it does not prove a user has met a business requirement. I used Cloudflare Access External Evaluation, Workers and D1 to add training compliance to the access decision.
Article
Making Cloudflare Access Denials Actually Useful
A custom Cloudflare Access denial page can turn a generic block into useful identity, device, posture and network diagnostics without exposing sensitive control-plane details.
Article
Zero Trust Allow Lists with Workers KV
A small Cloudflare Worker can provide a controlled front end for Gateway allow-list changes while KV supplies recovery, synchronization and operational visibility.
Article
Audit GitLab CI/CD Drift with PowerShell
A practical PowerShell workflow for inventorying GitLab projects, collecting only CI-relevant files and identifying copied pipeline drift.
Article
Verified Backports Across GitLab Repos
How I turned successful sandbox pipelines into narrow, reviewable GitLab merge requests without allowing automation to rewrite source repositories blindly.
Article
A Safe GitLab CI Sandbox for Repo Changes
How to mirror GitLab repositories into an isolated group, preserve release history and prevent test pipelines from affecting production.
Article
Versioned GitLab CI/CD Components
A practical migration path from repository-owned pipeline copies to versioned GitLab CI/CD components with controlled inputs and upgrades.
Article
How I Standardised CI/CD Across 37 GitLab Repos
How one broken release job became a repeatable audit, sandbox, verification and backport workflow for a mixed GitLab repository estate.
Article
Lessons from a First Container Deployment
From WSL2 and container health checks to DNS caching and deployment tooling, the practical lessons I learned taking a simple application from source code to a running service.
Article
From Manual Container Deployment to GitLab CI/CD
A practical approach to container CI/CD: prove the build, registry and deployment path manually, then automate the same operations with GitLab.
Article
Maintainable PowerShell Automation
A practical standard for PowerShell that makes production automation predictable, testable, supportable and safe to change.
Article
Idempotent PowerShell Backup Automation
How to design backup automation that converges configuration safely, proves each run, controls retention and keeps restore testing separate from job success.
Article
Managing Device Posture as Code
How to model, validate and deploy Cloudflare device posture checks as reusable configuration without coupling policy intent to environment-specific object IDs.
Article
Reliable PKI Maintenance Automation
A safe pattern for automating PKI inventory, expiry monitoring, CA health checks, maintenance evidence and certificate lifecycle tasks without hiding risk.
Article
SAML SSO with Microsoft Entra ID
A practical implementation sequence for SAML SSO in Microsoft Entra ID, including claims, assignments, certificate lifecycle, testing and rollback.
Article
Secure Infrastructure Delivery Pipelines
A practical DevSecOps pipeline for infrastructure changes: validate early, protect credentials, inspect plans, approve risk and retain deployment evidence.
Article
Troubleshoot AD Lockouts with PowerShell
Use events 4740 and 4625 together to move from 'the account keeps locking' to a timeline that identifies the source device, logon type and stale credential.
Article
Find Missing AD Subnets with Netlogon
NO_CLIENT_SITE entries in Netlogon logs are useful evidence that client networks are not mapped cleanly to Active Directory sites. PowerShell can turn the logs into a subnet-hygiene report.
Article
Browser vs Network-Centric Zero Trust
Enterprise browsers move enforcement into the user session. Network-centric Zero Trust still owns critical controls such as DNS, routing and non-browser traffic. The interesting architecture is often the combination.
Article
Designing Zero Trust for Failure
Zero Trust is not resilient just because it is cloud-hosted. Identity, posture, policy, tunnels, DNS and SaaS authentication all create failure domains that need deliberate recovery paths.
Article
Dynamic Cloudflare Lists from Provider IPs
A practical pattern for consuming AWS/Azure network feeds, calculating desired state and safely synchronising Cloudflare Zero Trust lists with PowerShell.
Article
Cloudflare WARP Configuration as Code
When private sites and DNS exceptions multiply, WARP device-profile configuration becomes data. Source control can become the input and PowerShell the generator.
Article
How I Passed CISSP and CCSP First Time
The study approach I used for CISSP and CCSP: ISC2 official material, instructor-led training, practice questions, Pete Zerger's Last Mile resources, and more than 20 years of practical experience.
Article
Safe Cloudflare Zero Trust Pipelines
As Zero Trust policy grows, the engineering problem shifts from configuring a dashboard to safely compiling, validating and deploying policy across environments.
Article
Why IP-Based Egress Steering Does Not Scale
Static IP and subnet rules become fragile when SaaS platforms and CDNs move underneath you. Domain-aware egress policy aligns network controls with application intent.