Services
Four areas. Two of them are kernel work — the security and performance problems that only become tractable below the application. The other two are the platform that has to hold still underneath. Each page describes the problem it solves, the approach, and the concrete artefacts you end up owning. If none of these fits, I will say so and suggest someone better suited.
Kernel & Linux
Kernel & Linux
Platform
Platform
Where to start
A fixed-price look at your Linux servers: what runs, what is reachable, how they are hardened, and what to fix first. A good first step whether you need one change or a longer engagement.
What you keep
Fixed price: if it takes longer, that is my cost. If you continue, the fee is credited against the next project.
Delivery pipeline
Seven stages from commit to production. Drag the handle or use the arrow keys to see what happens at each one — and what it costs you when that stage is missing.
Drag, click a stage, or use ← → keys
A push to a branch triggers everything. No manual button, no "remember to also run the deploy job" — the git history is the source of truth for what should be running.
Deploys depend on someone remembering a sequence of steps.
on:
push:
branches: [main]
pull_request:Reproducible builds with real caching. The same commit produces the same artefact, and the cache keys are derived from lockfiles rather than guessed, so a cache hit is actually correct.
Forty-minute builds that re-download the internet every run.
- uses: actions/cache@v4
with:
path: ~/.cargo
key: cargo-${{ hashFiles('Cargo.lock') }}Unit and integration tests run in parallel against ephemeral dependencies spun up as services. A failure names the test and prints the relevant log, rather than dumping 2000 lines and letting you search.
A red build nobody can diagnose, so it gets re-run until it passes.
services:
postgres:
image: postgres:17-alpine
options: >-
--health-cmd pg_isreadyDependency and image scanning, plus an SBOM generated and attached to the artefact. The gate fails on new high-severity findings, not on the pre-existing backlog — otherwise everyone learns to skip it.
You find out about the CVE from a customer’s security questionnaire.
- uses: aquasecurity/trivy-action@master
with:
severity: 'HIGH,CRITICAL'
ignore-unfixed: trueThe artefact is signed with a keyless workflow identity and pushed to the registry. Production only admits images whose signature it can verify, which makes "how did that get deployed?" an answerable question.
Any image that reaches the registry can reach production.
- run: |
cosign sign --yes \
${REGISTRY}/app@${DIGEST}Progressive rollout with health gates. Traffic shifts a slice at a time, and the rollout aborts itself if error rates move — so a bad release is a non-event rather than an incident.
All-or-nothing deploys, and rollback is a manual scramble.
strategy:
canary:
steps:
- setWeight: 10
- pause: { duration: 5m }
- setWeight: 50The deploy annotates your dashboards and the alerts know which release they belong to. When something degrades three hours later, the first question — "what changed?" — already has an answer.
Correlating an incident with a release becomes archaeology.
- run: |
curl -XPOST "$GRAFANA/api/annotations" \
-d "{\"tags\":[\"deploy\"],\"text\":\"$SHA\"}"Frequently asked
Including price, and how to end the engagement.
Most clients start with a Linux security review: 3 days for up to 10 servers, EUR 4,800 excl. VAT, ending in a written report you keep. If you continue, I credit the fee against the next project. After that it is either a fixed-scope project with a written quote, or a retainer for an agreed number of days a month. I do not take open-ended time-and-materials work without a scope, because it is bad for both of us.
Yes, and that is usually the point. I am not interested in replacing a working setup for the sake of my preferences. If you already run GitLab, or Nomad instead of Kubernetes, or a managed database, we work with it. I will tell you plainly if I think something is a genuine liability, and then it is your call.
You do, entirely. Everything lands in your repositories under a licence you choose. Nothing I deliver is a closed product: no proprietary agent, no control plane, no component that stops working if you stop paying me. Blackbox Linux, my own open-source agent, is never a condition of an engagement. If a piece of your work is generally useful, I may ask to release it as open source separately. That is a request, never a condition.
Because I have been on the wrong end of the alternative. Closed agents you cannot audit, per-host pricing that punishes you for growing, and vendors who change the licence once you are committed. Open-source components mean you can read what runs on your servers, host it yourself, and replace me without replacing your stack.
Not as a primary on-call rotation — I am one person, and pretending otherwise would be dishonest. What I do is build the alerting and runbooks so your own team can handle on-call alerts with confidence, and act as an escalation contact during agreed hours on a retainer.
The least that lets me do the work — usually a named account with scoped permissions, never a shared root credential. Access is revoked at the end of the engagement and I will remind you if you forget. I do not copy production data to my machine; if I need realistic data for testing we generate or anonymise it.
Your first email and my reply are free. The Linux security review has a fixed price of EUR 4,800 excl. VAT; if it takes longer, that is my cost. Larger projects are quoted in writing at a day rate of EUR 1,600 excl. VAT, and you approve the quote before any work starts. Email me a rough description and I will reply with a price and an estimate of how many days it takes.
You say so. There is no notice period and no exit fee. Handover is part of every engagement, not an upsell: documented architecture, runbooks, and a session where your team drives while I answer questions. The test is whether everything still runs a month after I stop. It does, because none of it depends on me.
A short description is enough. Within one business day I will tell you what I think the problem is, roughly how long it takes, and whether you need me at all. Sometimes the honest answer is no.