_0389.jpg){kind=link}
Solution
Versioned infrastructure
A configuration maintained by hand grows hard to reproduce and to explain. I describe the automatable part of the infrastructure in files, with Terraform for instance, in a repository that keeps who proposed and approved each change, and I rebuild an environment to prove the description is complete.
The benefit of reviewed code
Rebuilding becomes testable
Code, artefacts and a procedure let a rebuild be run and compared. Dependence on one person shrinks, and the rehearsal shows by how much.
Some mistakes become visible earlier
The planned changes are shown before application. A port opened by accident gets caught in review rather than discovered later in a log.
The history answers for you
Who changed what, when and why comes back at every incident and questionnaire. A maintained repository provides the record without relying on memory.
In practice
- The automatable part of the infrastructure described with a suitable tool, Terraform for instance, in a repository with history and named authors
- In-scope changes go through review, with the planned modifications shown before application and urgent exceptions recorded afterwards
- Environments rebuilt from controlled code and artefacts, then compared against observable criteria; data, secrets and external dependencies remain separate concerns
- Drift detection: whatever was changed by hand outside the code shows up, instead of quietly diverging
- Expected backup and retention configuration versioned with the infrastructure, then checked against the live state
- Taking over an unversioned estate without rebuilding it: what already runs is described first, then advanced service by service
Systems involved
- Azure and Google Cloud, including their Swiss regions
- Proxmox and the hypervisors in place
- Terraform, Ansible, Git and GitHub Actions or the CI tool in place
- The backup systems whose configuration is versioned
Service lineAzure and Google Cloud →
The environments to describe
The same work, against each sector’s own constraints. Every card opens the full sector.
How it runs
Survey
What actually runs, before anything is rewritten. An honest inventory beats a target diagram that ignores three machines.
Description
The estate is imported or described without automatically applying the plan, then code and reality are reconciled. Tool-specific risks are reviewed before any action.
Review
The console stops being the normal route. Changes go through a reviewed proposal, and applying becomes a formality.
Rehearsal
A representative environment is rebuilt in an isolated scope and compared against agreed criteria. Gaps, manual dependencies and observed timings are recorded.
To go deeper
Cloud access on Google Cloud, Azure, AWS and Infomaniak
The same four decisions on four platforms, and an honest account of the gap: Infomaniak gives you Swiss residency and OpenStack portability, and gives you no inherited permissions, no device-aware sign-in rules and no expiring administrator role.
Backups: the restore test nobody runs
Rolle, 2021: the data of 5,393 residents on the darknet. A backup strategy becomes credible when recovery is tested against RTO, RPO and business impact.
Test the fit: Versioned infrastructure
Describe the context, constraints and decision you need to make. The first conversation qualifies scope, boundaries and the next useful step.
Describe the situation