00writing

Engineering Blog

Deep-dives into cloud architecture, DevOps, and site reliability — written from production systems I own end to end.

9 posts

01Architecting a 24M Record ELT Data Platform on PostgreSQLChromium scrapers capped at 1GB each feeding a three-zone PostgreSQL warehouse, where dbt does the transformation in-database.June 18, 20262 min
02Zero-Trust at the Edge: Securing AI Telemetry over PtMP NetworksDrone and fixed-camera inference on ruggedised edge hardware, where the egress policy blocks the vendor cloud and only a WireGuard tunnel leaves the site.May 15, 20263 min
03Slashing Commit-to-Production Lead Times by 80% on AKSHelm templating, SHA-tagged images, OIDC deployment with no static credentials, and an HPA driven by queue depth instead of CPU.April 22, 20262 min
04Zero-Public-IP Architecture: Securing Azure Landing Zones with BicepA hub-and-spoke landing zone with no public IPs, private endpoints for every PaaS service, and OIDC federation replacing standing credentials.April 12, 20262 min
05Retiring Elasticsearch: Cutting Logging Costs by 80% with SQLiteAt 5-10 GB of logs a day, an ELK cluster costs more in JVM heap and shard balancing than the search is worth. SQLite FTS5 and Grafana replaced it.February 10, 20262 min
06Migrating to Azure ASE v3: Dropping p99 Latency to 120msEscaping noisy-neighbour contention on a single-tenant App Service Environment, behind Front Door, a WAF and APIM — and closing every VAPT finding on the first re-test.December 30, 20252 min
07Zero-Trust Hardening & SIEM: Remediating 26 Audit Findings Across 37 EndpointsDefault-deny WireGuard access with MFA, Wazuh and OpenSearch for telemetry, and an Ansible response that null-routes an attacking range fleet-wide in under two seconds.December 18, 20253 min
08Kernel Tuning & CI/CD: Shrinking Release Cycles from 45 to 12 MinutesWhere 45 minutes actually went: a coverage gate that runs before the build, two sysctl values, and Restic replacing SQL dumps.October 5, 20252 min
09Engineering Self-Healing AWS Pipelines: Slashing MTTR by 65%An SNS fan-out that sends degradation to an idempotent Lambda runbook for repair and to Slack for the record — with the guardrails that stop it destroying healthy capacity.July 28, 20252 min

Engineering BlogEngineering Blog

Engineering Blog