Bringing Cloudflare in from the cold
Everything on AWS here runs on credentials that last minutes. Cloudflare I'd been clicking by hand, and bringing it in meant living with a long-lived secret and making it as small as I could.
Categories
24 pages
infrastructure
The reusable AWS building blocks I lean on, all public: Terraform modules and tooling for bootstrapping an account, enforcing a security baseline and managing KMS-backed signing keys. Built for my own use, and yours.
The lock I took off
That morning I put a lock on a bucket. By teatime I'd taken it off for good, because it guarded the risk I'd already covered and locked in the ones I hadn't.
The runner fleet that scales to zero
The homelab finally ran out. Not disk this time, capacity. So the overflow went to AWS, on the condition that it costs nothing when nobody's pushing.
Wire up an AWS billing alarm before the surprise
Setting up an AWS billing alarm before you need one, with a KMS gotcha in the middle that stops the alert ever reaching you.
The security service I had to switch off
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
Two bugs that taught me the rules
Two CI and infrastructure bugs with one shape: a GitLab job with no rules block skips merge requests, and an import block runs only once.
Reviewed, then applied
Closing the plan-versus-apply gap in infrastructure CI by applying the saved plan artifact rather than quietly re-planning at apply time.
One graph, not micro-stacks
Why an infrastructure repo stays one OpenTofu graph rather than splitting into per-concern stacks: the engine enforces ordering for free.
CI you include, not copy
Copied .gitlab-ci.yml files drift out of sync. How GitLab CI/CD Components let a repo include and version-pin a shared pipeline instead.
One image for the whole toolchain
Baking OpenTofu, tflint and trivy into a single version-pinned CI image, and publishing the scanned tarball with crane to avoid a kaniko rebuild.
