Open source
Open source, and yours to keep
Plenty of infrastructure companies describe themselves as open source. Fewer will write down what that means in terms you could hold them to. This page is the attempt.
My pledge
I deliver, you own 100%
This is the part of the site I would most like to be judged on. Each of these is a specific, checkable commitment rather than a value statement — if I break one, you can point at it.
Everything in your repository
Pipelines, manifests, Terraform, dashboards, alert rules, runbooks. Committed to repositories you own, under a licence you pick. Nothing lives only on my machine or in an account I control.
Open-source components only
Every tool I put into production is open source and self-hostable. Where a managed service genuinely is the right answer, I say so and you decide — but the default is software you can read.
No metering, no seats, no hosts
I charge for days worked. Nothing I build bills you for growing, and no component sends data back to Helius or counts your servers.
Handover is included
Documented architecture with the reasoning, runbooks per alert, and a working session where your team drives. Not an upsell, not a final invoice line.
The exit clause
You can end the engagement at any time. There is no notice period, no exit fee and no migration project. Everything keeps running, because none of it needs me to run.
Upstream where it helps
Fixes and tooling that are generally useful go back to the projects they came from, or get released standalone — with your permission, and never containing anything of yours.
I recommend the same stack I run myself. When a piece I needed did not exist, I wrote it and released it as open source. Software that runs as root on your servers should be software you can read.
Why there is no proprietary layer
The commercial logic of a closed layer is obvious: it makes leaving expensive, which makes renewal easy. It works. It is also the reason so many teams are running infrastructure they cannot fully inspect, paying per host for the privilege, and quietly dreading the day the licence terms change.
I have been the engineer on the receiving end of that, and the experience is what shaped this. When an agent runs as root on every machine you own, "trust us" is not an acceptable answer to what it does. You should be able to read it, build it, and replace it.
So the business here is my time, not access to something. That has a real trade-off, and it is fair to name it: I cannot show you a slick platform with my logo on it, and I do not have recurring licence revenue smoothing out the months. What you get instead is infrastructure that keeps working when the invoices stop, which I think is the better deal for you and an honest one for me.
The practical test is simple. A month after I stop working with you, is anything degraded? If the answer could be yes, I have built the wrong thing.
The difference
Most infrastructure consulting sells you a dependency
It is what happens when the deliverable is access to a platform rather than working code in your repository. Here is the difference, in terms you can check.
A dashboard you log into, owned by someone else
Configuration in your repository, running on your hosts
Open-core: the useful features sit behind the paid tier
One tier. The whole thing. There is no upgrade to sell you
Priced per host, per seat, per gigabyte ingested
Priced per day of my time. Your growth is not a billing event
A closed agent running as root that you cannot audit
Open-source components you can read, build and fork
Handover is a paid add-on, scheduled indefinitely
Handover is the deliverable. Runbooks included, not invoiced
Leaving means a migration project
Leaving means I stop showing up. Everything keeps running
Stack
Every tool on this list is open source
Not a coincidence and not a marketing angle — it is the constraint I work under. If a problem can only be solved with a closed product, I will say so and you decide. It has not come up often.
Linux & kernel
- eBPF
- aya
- bpftrace
- LSM
- systemd
- perf
- strace
Hardening & access
- nftables
- iptables
- fail2ban
- Pritunl
- WireGuard
Configuration & provisioning
- Puppet
- Ansible
- OpenTofu
- Packer
- cloud-init
- Debian
- Rocky Linux
Orchestration
- Kubernetes
- Helm
- Docker
- Podman
CI/CD
- GitLab CI
- GitHub Actions
Observability & detection
- Zabbix
- Prometheus
- Grafana
- OpenTelemetry
Web & data
- Nginx
- OpenResty
- Lua
- MySQL
- Percona
- PostgreSQL
- Redis
Languages
- Rust
- Python
- Bash
Self-hostable · auditable · yours to keep
Tell me what is broken
A short description is enough. Within one business day I will tell you what I think the problem is, roughly how long it takes, and whether you need me at all. Sometimes the honest answer is no.