The controls between my AI agents and the systems they touch: VLANs, unprivileged containers, scoped AppRole tokens, contributor-only Git access, mandatory secret scans, and fixed automation templates.

The useful part of an AI coding agent is not the first hour. It is whether the work still has direction after the context fills up. A few plain files and clear verification gates make the difference.

A backup job that finishes is only the first link. Recoverability depends on consistent capture, validation, retention, an independent copy, and a restore test.

SSH keys are straightforward once authentication and authorization are treated as separate problems. Add access carefully and keep a way back in.

The migration was the easy part. Year two is templates, Vault, self-hosted CI, and a second network tier. That is the accretion that turns a hypervisor into a platform.

How route reflectors, EVPN/VXLAN, dual transport, and CIN models work, why enterprises use them, and when simpler designs may be better.

Markdown notes synced phone to PC with Syncthing, summarized and semantically searchable by a local LLM. No subscriptions, nothing in the cloud.

I swapped a 2020-era ESXi box over to Proxmox and moved TrueNAS CORE to SCALE in one afternoon, with a USB stick as the whole rollback plan.

Before mirroring my repos to GitHub, I audited every place a credential could hide. Found a few. This is what the pass looked like.

Custom raycast suspension in Unity, no WheelCollider. The one-system architecture lesson, and the launch-into-orbit bug that came down to initial conditions.

Rod knock killed the 2.5. What went into sourcing a clean M54B30, why the rod bearings stayed untouched, and the while-it’s-out list that makes a swap last.

The rebuild rule: the tool is not allowed to flatter me. Verified fills, buy-and-hold benchmarks, and a loss autopsy for every losing trade.

A firewall bracket nobody sells, printed in an afternoon. CAD is the skill; the printer is just the output device.

WireGuard gets me into the lab from anywhere through one UDP port. The real lesson is what the tunnel shouldn’t excuse behind it.

Running my own GitLab means backups, upgrades, and runners are my problem. That’s the point. GitHub stays as the mirror.

Spreadsheet IPAM fails the moment two people edit it. A small Flask tool where Python makes the decisions and Ansible touches the devices.

Telegraf, InfluxDB, and Grafana in Docker. Numeric OIDs over MIBs, dashboards provisioned from git, and a diagnosis story about sparse graphs.

Ansible pulls the configs, vault encrypts them, git keeps the history, Semaphore runs it on schedule. NetBox tells everyone what exists.

My 2960G predates most of the tools trying to manage it. Legacy SSH crypto, paramiko pins, and the other gotchas of automating old IOS.

Custom TradingView indicators grew into a full Python platform: an S&P 500 scanner, honest backtesting against buy-and-hold, and a paper-trading bridge.