Skip to content
Théophile Diot.
fren
Navigation menu
All work

Private platform engineering

Infrastructure engineering / 2026-present

A four-host private platform run as code, with 69 in-scope Compose stacks, bounded automation, observability, and tested configuration invariants.

Role
Owner and operator
Contribution
Designed and operate the private platform described here.
Evidence type
Dated private snapshot
91Services under managementDefined across 69 Compose stacks; 22 project stacks excluded
83/83Images digest-pinnedVersion and manifest digest, no :latest
28Config invariants testedTwo repo-wide analyzers, wired as pre-commit hooks
01

The problem

The costly failures were silent: dynamically allocated addresses reclaiming pinned slots after restarts, bind-mounted files staying on old inodes, and sign-in routes selecting the wrong provider. The configuration could still render cleanly while the running system was already wrong.

Logical roles across a four-host platform
Conceptual. It connects responsibilities without assigning a service, identifier, count, exposure, or role to a physical machine.
Boundaries, outermost first
Conceptual. It shows the boundary pattern, not a topology, an inventory, or an exposure map.
  1. 01Public edgeRequests meet inspection and routing before reaching workloads.entry
  2. 02Identity and policyOperator access and automation are evaluated before execution.control
  3. 03Service planeEach workload joins only the networks it needs.internal
  4. 04Evidence planeLogs, metrics, and traces describe active state.observe
  5. 05Recovery planeBackups are verified separately, and off-host restore defines success.restore
02

Decisions

  1. Treat Compose as a dependency graph: pin released images by version and manifest digest, document startup order, and keep live authority explicit.

    CostEvery image update becomes a deliberate edit. Nothing moves forward on its own, including security updates.

  2. Turn network allocation and sign-in routing incidents into two tree-wide analyzers backed by 28 unit tests.

    CostThe analyzers only catch the failure classes already understood; a new class stays invisible until someone writes its analyzer.

  3. Put production automation behind scoped identities, typed API routes, command allowlists, signed reviews, 46 allow and deny cases, and two network guards.

    CostRoutine work now has to pass the guards, and a legitimate change can be refused by them.

  4. Route logs, metrics, and traces through one collector; define backup verification and off-host restore as explicit acceptance work.

    CostRecovery is stated as written verification criteria rather than a single availability figure, which is harder to summarise.

03

Outcome

Known network and sign-in misconfigurations now fail before commit, while the automation surface is exercised through positive and negative tests. Three-signal telemetry is configured, and recovery has written verification and restore criteria instead of an uptime claim.

04

Evidence and scope

Looking for a collaborator?

Share the work and its constraints. I reply by email.

Send a message