Bringing Cloudflare in from the cold
Everything on AWS here runs on credentials that last minutes. Cloudflare I'd been clicking by hand, and bringing it in meant living with a long-lived secret and making it as small as I could.
Tags
14 pages
OpenTofu
The runner fleet that scales to zero
The homelab finally ran out. Not disk this time, capacity. So the overflow went to AWS, on the condition that it costs nothing when nobody's pushing.
Sign your own binaries with go-tool-base, part 2: a signing key in AWS KMS
Stand up a production signing key in AWS KMS with Terraform, so the private half is generated inside KMS and can never be exported.
The security service I had to switch off
A fresh AWS account cannot enable GuardDuty or Security Hub without a subscription, so the security baseline failed on the account it protects.
Two bugs that taught me the rules
Two CI and infrastructure bugs with one shape: a GitLab job with no rules block skips merge requests, and an import block runs only once.
Reviewed, then applied
Closing the plan-versus-apply gap in infrastructure CI by applying the saved plan artifact rather than quietly re-planning at apply time.
One graph, not micro-stacks
Why an infrastructure repo stays one OpenTofu graph rather than splitting into per-concern stacks: the engine enforces ordering for free.
CI you include, not copy
Copied .gitlab-ci.yml files drift out of sync. How GitLab CI/CD Components let a repo include and version-pin a shared pipeline instead.
Why I hand-rolled every module
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
