DevOps

The Goal: A Reproducible Server The worst kind of infrastructure is a server that nobody fully understands anymore. Things were installed over time, configuration changed in place, and the mental model of how it all fits together lives only in the memory of whoever last touched it. If that server dies, rebuilding it requires archaeology. The goal for mve-itguard was the opposite: a fresh Debian machine should go from zero to fully operational — users created, Docker installed, runners running, services ready to deploy — with a single command that anyone with the repository and the AGE key can run. ...

The Problem Every Project Has Every project that deploys to a real server has secrets. Tokens, passwords, API keys — values that should not be publicly visible but that the application needs to run. The GitOps approach makes this harder to ignore. If Git is the single source of truth and all configuration lives in the repository, where do the secrets go? Committing them in plaintext is an obvious mistake. Leaving them outside Git means the repository is no longer the complete source of truth — some knowledge lives only in someone’s head or in a separate system. ...

GitOps Is a Principle, Not a Tool When people talk about GitOps, Kubernetes quickly enters the conversation. FluxCD, ArgoCD, Helm — the ecosystem is rich, and the tooling handles a lot of the heavy lifting. The platform continuously watches the repository and reconciles the cluster state to match what Git declares. But the underlying principle has nothing to do with Kubernetes specifically. GitOps is simpler than that: Git is the single source of truth. No change happens outside of Git. Automation applies what Git declares. ...

The Problem with Commercial Solutions When I started thinking about home security cameras, the obvious path was a commercial solution — Ring, Nest, or one of the dozens of cloud-connected systems on the market. Plug it in, create an account, and you’re done. I did not go that route. Not because it is difficult to set up, but because of what it implies: your video footage lives on someone else’s server, your access depends on a subscription, and if the company changes its pricing or shuts down, you lose everything you built around it. ...

Fist conplete containerise Python application In the context of the KubeCraft course, I needed to create a complet containerise Python application from scratch. The course is focus on the DecSecOps implementation, note the Python part. Pre-require The first step to have a nice DevSecOps environnement is the team work. I will be the only one who use this project, but in reality a hole team will need to have access and modify some piece of the application. First think in mind when you have IT project and team work, you think about Git. Even you haven’t a team to work with, use Git is a nice way to have log of your work and explain why the application don’t work after a modification, and be able to come back to a secure version. ...

KubeCraft Course After completing the first Kubernetes course, where I deployed a basic K3s cluster on Rancher Desktop, I moved to the next level: a homelab course focused on building a fully GitOps-based K3s cluster on a Debian VM, hosting real self-hosted applications exposed to the internet. What to Expect at the End? The final goal is to deploy a self-hosted Linkding application accessible from the internet using a custom domain name. ...

When 2 GB of RAM Broke My Dev Environment One of my first real breakthroughs in learning Linux happened when I started working seriously with containers. At first, I struggled with the Docker CLI. It felt abstract and sometimes unintuitive. But the more I learned about Linux — processes, namespaces, cgroups, filesystems — the more containers started to make sense. Containerization is not magic. It is Linux. Understanding that changed everything. ...