The servers, pipelines and automation everything else on this site runs
on — treated as its own ongoing engineering project, not just plumbing.
Everything is code
The whole fleet is defined as code: virtual machines through OpenTofu,
configuration through Ansible playbooks, CI/CD through a Woodpecker
pipeline that builds, tests, deploys, and health-checks every merge.
Nothing that touches production ships by hand; everything is reviewed,
merged, deployed, and validated atomically — one change at a time, each
with a point-in-time to return to.
Design principles
- Everything is code — if it is not under version control, it does not exist.
- Atomic production changes — prepare freely in parallel, land serially: deploy, validate, done, before the next change starts.
- Observability from day one — every service ships logs to the central stack, health/resource metrics, a retention policy, and a disk guard with a monitor that alerts on the coordination bus — not a config file that looks compliant.
- Verify enforcement, not presence — a config existing is not evidence it is enforced; the enforcing binary must be installed, running, and recently acted.
- Return-to-point-in-time — every server has a documented backup and replace procedure before it is ever rebuilt.
Current shape
- Shared infrastructure — virtualisation, networking, DNS, secrets management, a knowledge graph, and a coordination bus are all managed as code and monitored centrally.
- Blue/green deployment — the reverse-proxy tier runs blue and green hosts so a deploy never needs downtime.
- Central logging and monitoring — all hosts ship logs to a single observability stack; disk guards publish alerts to the coordination bus rather than only local files.