Writing
Notes from actually building this
Long-form notes on AI governance, identity, compliance as code and cloud platform engineering - written while the terminal was still open.
-
Microsoft 365 Security as Code — Part 3: Running Microsoft365DSC on Linux
Microsoft365DSC was built for Windows, but our pipeline runs on Linux. This is how I made the apply step work without the Windows engine: a small parser for the compiled configuration, a careful Exchange Online session, and the permission problem that looked like a code problem.
-
Microsoft 365 Security as Code — Part 2: One benchmark, four tools
No single tool reaches every setting in the CIS Microsoft 365 benchmark. This is the order in which I choose a tool for each control, a worked example of a setting that no tool exposes, and why the code lives in several repositories with several identities.
-
Microsoft 365 Security as Code — Part 1: Before you write any code
The CIS Microsoft 365 Foundations Benchmark has 160 recommendations, and writing the code is the easy part. These are the decisions that have to come first: which profile you sign up to, what is in scope, what 'done' means, and who accepts the exceptions.
-
Building an AI Landing Zone on Azure — Part 5: Turning tokens into euros
Raw usage records are not a bill. This is the rate card as data, cost computed at query time, the cached/cache-write/reasoning token nuances, and the report that gave finance a monthly AI bill per cost centre.
-
Building an AI Landing Zone on Azure — Part 4: Metering every call
The usage pipeline behind the AI gateway: APIM to Event Hub to a Function App to Cosmos DB, managed identity end to end.
-
Building an AI Landing Zone on Azure — Part 3: One front door for many models
How a single, VNet-injected API Management instance becomes the only way to reach Azure OpenAI and Mistral OCR, with policy fragments as composable building blocks and an identity per hop.
-
Building an AI Landing Zone on Azure — Part 2: The platform underneath
Before the gateway and the metering there is a private AKS cluster, a hub-and-spoke network and a GitOps setup where no application ever holds a secret. This is how that foundation is put together.
-
Building an AI Landing Zone on Azure - Part 1: Why every enterprise needs an AI gateway
Teams are calling LLM endpoints directly with API keys in config files and nobody knows who is spending what. Here is the landing zone I built to fix that, and why.
-
Building a Cloud-Native PKI with HashiCorp Vault
I built an HA Vault PKI on Kubernetes to sign the subordinate CA that Global Secure Access needs for TLS inspection. Vault cannot issue a certificate that is both a CA and carries Server Auth EKU, so it could not be done. Updated September 2026: Microsoft now offers a managed certificate for GSA in preview, which removes the problem entirely.
-
GitLab CI/CD for Cloudflare Pages: Automated Deployments with Preview Environments
How to set up a GitLab CI/CD pipeline for Cloudflare Pages with preview deployments on merge requests and automatic production deploys.
-
Building a Raspberry Pi5 Cluster with Talos Linux and Cilium
A small, quiet, genuinely highly-available Kubernetes cluster on four Raspberry Pi 5 boards, running Talos Linux with Cilium - the full kit list, the build, and everything that bit back.
-
Self-hosted Gitlab Runners on AKS, with Managed Identities
Self-hosted GitLab runners on AKS using Managed Identities instead of service principals - so a runner can only ever act as itself, with exactly the permissions its jobs need.
-
New Website, refactored
Moving ascode.nl off Hugo and AWS onto Eleventy and Cloudflare Pages - and why a static site that takes one command to build beat the serverless stack it replaced.
-
Shared VPC Subnet tagging
Sharing a central VPC across AWS accounts in a landing zone, and using subnet tags to keep isolated, private and transit-gateway subnets straight per account.
-
AWS Account creation, fully automated - ascode style
Vending new AWS accounts from Terraform - organisations, OUs and baseline guardrails applied automatically, so a new account is never a hand-built snowflake.
-
How to build a serverless website, in AWS
Building the first ascode.nl as a fully serverless site on AWS - S3, CloudFront, ACM and Route 53 in Terraform, with a DTAP street and GitLab CI doing the deploys.