Infrastructure Security

Server hardening, secrets discipline and guardrails that hold when someone is moving fast.

How I use it

Host hardening at provision time
Restricted access paths, key-based authentication and intrusion prevention set up as part of provisioning rather than a hardening pass scheduled for later.
Secrets discipline
Credentials kept out of version control with permissions enforced on the host, and rotation that is actually possible rather than theoretical.
Guardrails against destructive operations
Automated rules that refuse irreversible actions outright — dropping data, removing volumes, editing live configuration by hand — with tests proving the guards still fire. A documented rule is advisory; an enforced one is not.
Mail authentication posture
DMARC enforcement with SPF and DKIM aligned, monitored over time. The same record is a deliverability control and an anti-spoofing control.

Want the detail behind any of this?

I can walk through any of it in as much depth as you want.