Edy-Auth
Self-hosted authentication for every other service here. Pluggable providers, per-realm registries, a configurable chain of factors, and e-mail sign-in that derives the password in the browser.
Edward Skarke · infrastructure & identity
Infrastructure that explains itself.
A working estate of identity, provisioning, directory and virtualisation services — each one built to be run, inspected and handed over, not just demonstrated. The same engineering is available as consulting, including moving an estate off VMware — and the ideas behind it are drawn, sheet by sheet, in the drawing set.
Executive summary
Five value streams, one estate
Each strip is the short version. Open it for what delivers it and what it is built on. The first one has the video.
01 · IdentityWho is asking decides access — never which network the packet arrived on.
Edy-Auth in 90 seconds: narrated, captioned, drawn as vectors. Download the MP4
Edy-Auth is a small, self-hosted identity server that every service here delegates sign-in to. It runs a configurable chain of factors — password, one-time code, WebAuthn, client certificate, YubiKey or a Windows domain — and hands the application back a verified identity and roles. The application never sees the password, and there is one place to revoke a session or read the audit trail.
Node 22 · SQLite · TLS · OIDC-capable — the two integration contracts
02 · EnrolmentA machine becomes a fleet member from bare metal, reproducibly — inside an enclave, not on the edge.
DHCP, DNS, the iPXE chain and TFTP live in a deployment automation enclave and never face the internet. What crosses a boundary is a customised image over HTTPS. The Windows 11 netboot here — UEFI Secure Boot, TPM 2.0, answer-file driven — boots exactly the way a real deployment would.
Edy-Proxy enclave services · Netboot — automation engagements
03 · TrustKeys, certificates and revocation that propagate on their own.
Per-device certificates from an internal authority with no trust-on-first-use, mutual TLS between services, an overlay as the only path between sites, and routing and firewall policy generated from what a node is entitled to. Public certificates stop at the public listener; everything behind it trusts only the internal CA. The same idea works inside a single subnet with no network change at all — rulesets generated from entitlement and delivered to every host by group policy — which is how it was done across a global Windows estate.
Drawn on sheet S-01 · Built on: cockpit-wireguard, cockpit-headscale — zero trust architecture
04 · EvidenceWhat was verified, what was refused, and what an attacker could still do — written down.
Security-event capture that reaches a SOC pipeline instead of a local log; reviews that record the findings left standing and why; dashboards that put ownership, patch state and capacity for thousands of systems on one screen. A green tick is not evidence. At fleet scale that means self-contained collectors and a pipeline that reduces before the SIEM indexes — proven at 80,000 managed endpoints on an AppGate-based zero-trust, cloud-managed endpoint deployment, where the dashboard already knew what the user would have been asked.
Drawn on sheet S-02 · Built on: cockpit-secrets (its own red-team review)
05 · ContinuityRestore proven by restoring; cutover with the rollback defined first.
Migration in waves with a rollback before each one, backup proven by restore, and operational-readiness gates before anything is called done — the discipline behind delivering three hundred-plus servers for merger close-outs, and behind every VMware exit planned here. The same discipline designed a first multi-site SAN with journaled replication and rehearsed failover, moved a petabyte between sites, and remapped a 100,000-link namespace in waves with a rollback written before each one.
Drawn on S-03, S-04 and S-06 · How a migration runs
Hedging your betsEvery dependency is a bet. Keep the exit priced in.
Leveraging APIs to build capabilities instead of paying millions more for vendor
features
— that line has been on the profile for years, and it is the whole policy.
Hypervisor, cloud, identity, tooling: each is chosen so the estate can change its mind.
VMware alternative work where “stay” is an allowed answer; identity and network services
that run in your own enclave rather than as a subscription you can be locked out of; and
skills held at the level of the model, not the vendor — the same IPAM design whether the
product is Microsoft, NetBox, Infoblox or BlueCat.
From the drawing set
Sheet S-01 — segmentation at the host
One of 6 drawings. Entitled traffic passes; anything else is refused at the host, inside a subnet nobody had to re-address. Open the set for the rest, a present mode and a printable copy.
Catalog
Services
Eight things that run here.
Edy-Proxy
Presented as Edy-Secure-Net: the network access and security enforcement layer — zero trust, threat response, load balancing and traffic management. Network services in Go. On the public edge: TLS with ACME, reverse proxy, external DNS — and nothing else. Inside the deployment automation enclave: DHCP, DNS and the iPXE chain, with images customised and delivered over HTTPS so TFTP never leaves the enclave. ARP-change monitoring throughout.
Edy-Secure-Net — Edy-Proxy as a network access and security enforcement layer — in 90 seconds: zero trust, threat response, load balancing and traffic management. Narrated, captioned, drawn as vectors. Download the MP4
Netboot Deployment
Unattended Windows 11 over PXE — UEFI Secure Boot, TPM 2.0 emulation, answer-file driven, with the iPXE chain that actually survives being loaded as a UEFI NBP.
Samba AD Lab
A five-controller Active Directory domain with joined clients, for testing replication, group policy and cross-realm trust without touching anything that matters.
Cockpit Extensions
Two plugins: a System Tuner that reports and applies host tuning, and a Remote Desktop console that speaks the Guacamole protocol over a Cockpit channel — no Tomcat, no extra port.
Virtualisation
KVM guests on an isolated NAT network with libvirt DHCP and DNS deliberately disabled, so the lab is served by Edy-Proxy instead and boots exactly the way a real deployment would.
Container Estate
Two independent podman scopes — a rootful estate for services that need real, routable addresses, and a rootless scope for everything that does not. Managed through Portainer.
This Catalog
The site you are reading. Server-rendered, signs you in through Edy-Auth, and hosts the collaboration workspace where projects are put out for proposal.
Open source
12 published projects
Cockpit plugins for WireGuard, Headscale, system tuning, password safes and remote desktop; a containerised Active Directory lab; and a long tail of PowerShell and Python tooling. Source, and the documentation that explains it.
Consulting
14 ways to engage
Headlined by VMware alternative consulting — assessment, pilot, migration and operation of KVM, Proxmox, oVirt, XCP-ng, Hyper-V and container platforms — alongside micro-segmentation at the host, fleet telemetry, compliance baselines, storage and continuity design, migration, remote access, directory and identity, network services and automation.
About
Edward Skarke
Senior infrastructure and security engineer, with more than twenty-five years in IT and cybersecurity. The work is Linux and Windows platform engineering: host management tooling, directory and identity services, network services and remote access, and the automation and documentation that let somebody else operate the result.
Everything described on this site runs on the estate it describes — the catalog, the identity service in front of it and the network services behind it are the same stack the consulting is about.
The employers and dates live on LinkedIn; the capabilities and track record are summarised here, and the ideas are on the drawing set.
Collaboration
Put a project out for proposal
Register a piece of work, publish it when it is ready, and collect proposals from signed-in collaborators.