Application network infrastructure
mazenet designs, deploys and operates the layer every application quietly depends on — identity, secrets, private networking, and the observability that tells you when any of it moved.
| Service | Host | State |
|---|---|---|
| Rauthy | production-auth-01 | live |
| Headscale | production-net-01 | live |
| Kanidm | — | on hold |
Practice
No platform to buy and no retainer for babysitting dashboards. The work is building the thing, handing over the code that describes it, and staying on for the parts that need judgement.
Network, identity and secret topology decided before the first server exists — with the trade-offs written down, not discovered in an incident.
OpenTofu and cloud-init own first boot; Ansible converges what runs on it. Every host reproducible from an empty cloud account.
Prometheus, Loki and Alertmanager on a plane of their own, backed up off-site, with alert rules that ship with their own tests.
New tools get a real trial on a real host, then a written verdict. Kanidm lost to Rauthy on forward-auth; the host is gone and the reasoning is in the repo.
Stack
Core infrastructure for mazenet.org — the services every product depends on, and nothing product-specific.
| Stack | Service | Host | State |
|---|---|---|---|
| vault | Vaultwarden | production-vault-01 | live |
| auth | Rauthy | production-auth-01 | live |
| auth | ntfy | production-auth-01 | live |
| net | Headscale | production-net-01 | live |
| lab | Infisical | lab-infisical-01 | live |
| home | Observability plane | hmsrv01-observe-01 | live |
| idm | Kanidm | — | on hold |
The console reads state straight from Prometheus and the tunnel edge — no separate inventory to drift.