Each of these is grounded in something that has
been built and published — the links go to the source.
Zero trust architecture
Access decided by identity and posture, never by which network a packet arrived on. Per-device certificates from an internal authority with no trust-on-first-use, mutual TLS between services, an overlay (WireGuard or Headscale) as the only path between sites, and routing and firewall policy that is generated from what a node is entitled to rather than hand-kept. The estate this site runs on is built that way: nodes enrol with a one-time bundle and a pinned root, a node with no firewall policy refuses to serve, and public certificates stop at the public listener while everything behind it trusts only the internal CA.
identity-centric accessmTLS / internal PKIWireGuard / Headscalesegmentationleast privilege
Built on: cockpit-wireguard (opens in a new tab), cockpit-headscale (opens in a new tab), lin-ad-lab-with-cockpit (opens in a new tab)
Cybersecurity engineering and operations
Twenty-five years of defending Windows and Linux estates, applied to the unglamorous parts: hardening baselines and privileged-access design, secrets management that keeps keys off shared paths, replication of trust material with revocation that actually propagates, security-event capture that reaches a SOC pipeline instead of a local log, and incident-style reviews that write down what was verified, what was refused and what an attacker could still do. Assessments, remediation plans and the engineering to carry them out.
hardeningsecrets managementSOC / event pipelineincident reviewcompliance-ready evidence
Built on: cockpit-secrets (opens in a new tab), cockpit-os-tuner (opens in a new tab), linux-cockpit-remote-desktop-guac (opens in a new tab)
Linux host management tooling
Cockpit is a good console and a better platform. I build plugins for it that read first and write only where writing is justified — no build step, no bundler, no CDN, and a documented install-versus-deploy separation so a development checkout and a production install are never confused for one another.
CockpitsystemdpodmanPython / Shell
Built on: cockpit-os-tuner (opens in a new tab), cockpit-secrets (opens in a new tab), cockpit-wireguard (opens in a new tab)
Remote access: WireGuard, Headscale, RDP
Tunnel and mesh design, routing and NAT policy, client provisioning, and control-plane operation for headscale tailnets — plus browser-delivered remote desktop into Linux hosts that does not put a broker on a public port.
WireGuardHeadscaleGuacamoleNAT / routing
Built on: cockpit-wireguard (opens in a new tab), cockpit-headscale (opens in a new tab), linux-cockpit-remote-desktop-guac (opens in a new tab)
Active Directory, identity and PKI
Directory design and rehearsal on disposable labs: multi-controller domains, group policy, sites and services, FSMO and replication, DNS, and Kerberos-backed authentication for Linux members. Alongside it, an internal certificate authority and the issuance, renewal and trust distribution that make it usable.
Samba ADKerberosLDAPSinternal CA
Built on: lin-ad-lab-with-cockpit (opens in a new tab)
Network services: proxy, DNS, DHCP, firewall
Reverse proxying and load balancing with TLS termination, split internal and external DNS, DHCP and address management, firewall policy, and the replication that keeps a fleet of nodes agreeing with each other. This site is served through exactly that stack.
reverse proxyDNSDHCP / IPAMTLS
Automation and reporting
PowerShell and Python automation for people who have to operate the result: modules rather than scripts, reports that render themselves, service and port monitoring, and unattended operating-system deployment over PXE for Windows and Linux.
PowerShellPythonPXE / iPXEreporting
Built on: MGMT (opens in a new tab), PS_Port_Monitor (opens in a new tab), HtmlReport (opens in a new tab)
Security review of administrative tooling
A second pair of eyes on the consoles that hold your keys: threat model, hazard register, and an adversarial pass over the privileged surface — who the server believes you are, what a client-side check is really worth, and what remains true of an attacker on a good day. The findings are written down, including the ones left standing and why.
threat modellingred teamleast privilege
Built on: cockpit-secrets (opens in a new tab)