In any job or role, white or blue collar, skilled or unskilled, you always have a period of feeling like an impostor at the beginning. You can have all the skills your industry requires but you never have the “domain knowledge” that each organisation comes with. That takes time.

The good news is that I’m finally at that good point in this current contract. Now, it’s 4 months into the 6 month contract - but it’s welcome all the same. I was having a rough time for a while there, particularly as I was having the bad luck of choosing some toxic work tickets that other people I can only guess were avoiding. Those were nightmares.

But in this last sprint I think I’ve closed something like 8 tickets with some spectacularly complex fixes like upgrading the entirety of our AWS Control Tower, fixing a LONG standing bug with a Lambda mysteriously never working on our workload accounts, and getting DEEP into some particularly gnarly AWS Service Control Policies (SCPs).

In the new sprint from tomorrow, I’ll be checking a handful of other Lambdas to ensure the recent Python runner upgrade didn’t break them.

That said

I’ve got 71 days left in this contract. I need to know by 60 days whether they’ll want to renew me or it’s off to market I go. The job market is rough currently so I can’t afford to be messed around.

Hopefully they will renew me though. I like these people and the work - and - it would be good to ride out the job market storm somewhere safe for a while.

And just some random notes

• New business cards ordered! It’s very rare to give them out, but I like having them. I updated the design to remove the Twitter address, and to add all the weird titles my industry likes. Otherwise, these are much like my old ones. Ultra thick paper with a green color between the two sides:

• I was quiet last week as I finally migrated my entire email stack off Proton Mail to my own self-hosted mail server on docker-mailserver. I’m in the process of writing that up.

• We just got back from a long weekend in Scotland with a quick detour through the Lake District. Had a lovely time. Did a bit of hiking, sat around in our hot tub, ate good food, and had fun with the family. Here are some pictures I took:

Last Friday was better at work for reasons I can’t put my fingers on. Made some good progress connecting our production Keycloak to Azure AD and restricting who can login based on an AD group in an Enterprise Application. So - neat to learn how to do that.

I then realised that I couldn’t log into Grafana-Loki as my non-AD user was already inside it - which I fixed by just giving up and deleting the user database. And Rancher wasn’t setup to use open id at all! Fixed all of that and moved back onto installing WAF into the Staging and Production environments, which got approved in various meetings last week.

Next Contract?

I’ve got 45 days left on my current role with no particular idea whether the actual client wants to renew me. However - today brought a possible return to one of my favourite contracts - Tesco Bank! They’ve sold a lot of their services to another bank and their continuity project’s gone far higher in priority so it could be an opportunity to get back to working in a positive, respectful environment. Fingers crossed!

Weekend Hacking

Completely finished rebuilding both my AWS servers into a common containerised platform running in a single Spot instance. The final piece was getting my Git server instance in place. I still haven’t imported the old server’s export. For anyone interested, I’ll do a more in depth explanation when I build my Cloud Cauldron blog - but it basically looks like this:

• A dedicated VPC, and EC2 Spot instance spun up with Terraform (OpenTofu) running a Debian 12 AMI but encrypted.

• Root volume is small and remains mostly untouched. Only enough changes to the root volume to enable it to reboot without needing any configuration changes.

• All important persistent data and configuration lives on a separate encrypted volume mounted at /volume. This gets backed up via a snapshot from AWS Data Lifecycle Manager.

• Update: I’ve open sourced all the Terraform/OpenTofu to create it all here.

• Everything important is running as a Docker container via Docker Compose. There are 5 major Docker containers that need to remain up:

  • certbot: Mostly sleeping for 12 hours at a time but then checking for certs that need to be renewed
  • nginx: Powers all the static and tool sites.
  • php: Has the same mounts as nginx and runs any PHP needed
  • mariadb: Powers any needed mysql/mariadb databases.
  • gitlab: powers Gitea separately. nginx reverse proxies it.

• All Powering These Sites:

  • A Wordpress site powering a personal archive. (nginx and php)
  • bocan.dev - A 1 page CV site. (just nginx)
  • cfunder.me - A personal URL shortener. (nginx and php)
  • My personal blog (nginx and hugo), and tooling hidden underneath:
    • A personal photo gallery powered by Piwigo.
    • A webapp that gives quotes and advice.
    • My self hosted Nextcloud engine.
    • A time dashboard I built to amuse myself.
  • My business site (just nginx) - but soon to be my business blog (nginx and hugo)
  • My family tree site (just nginx)

• There are 3 crontab jobs executing commands inside the docker containers:

  • Every 15 minutes, exec into php and update my TTRSS site to get check RSS feeds.
  • Every 31 minutes, exec into php and run the Nextcloud cron processing.
  • Every 5 minutes, use Git to pull all configuration from GitHub, then exec into the Hugo container and generate the static blogs.

• Issues I still need to fix:

  • The Terraform state is local on my laptop.
  • The Github repo that controls all of the content stores the web certificates so I can’t make it public.

Superbowl

As per my usual, I got in a load of beer and cider and nachos, made some queso, heated up some chilli, and put on my Dallas Cowboy’s jersey ready for the Superbowl. The game was frankly a bit boring but it’s always an experience.

Commute

• Up at 6am. Out of the house by 6:30. On the train at 6:45. In London by 7:30 and into a black cab.
• Noted like 10 sets of media outlets broadcasting outside of Buckingham Palace. Bloody vultures.

Work

• Sooo, I ended up apologising to my team lead for getting passive aggressive in chat. Which was fair, as there was nothing passive about it! 😁
• I was sure to tell him that I get quite frustrated at last minute changes to long established plans, and that the appearance of it all with his not attending meetings is that he’s out of the loop. He seemed to accept that and agreed to have weekly or twice weekly one-to-ones. Should we need to? No. But I’ll take the small win.
• The topic changed to the tooling we use. Terraform / OpenTofu being my preference - which I don’t think he’s ever going to accept - but we have a meeting with senior corporate people tomorrow to discuss. And I’ve already raised the issue with them directly. We’ll see how that goes.
• And finally, the WAF drama from yesterday is totally up in the air again. They may decide to go with Cloudflare. I don’t know or care as both solutions are good. And at this stage I just want someone to make a choice.

After Work

• Found out our consultancy supplier was going around claiming I said that Terraform was going to be forced. A misunderstanding?
• Also found out that the consultancy supplier is pushing for a few of us to not be renewed. They really don’t like being challenged and held to account! Didn’t upset me at all. Please don’t threaten us with a good time! :-D

Gaming

• I managed to get past a bit I was stuck on in Baldur’s Gate 3. Namely the battle with Cazador, the secret was to bring Astarian, but leave him high up on the stairs until the last second.
• Coming out of that fight, and after a long rest, I decided to take on Raphael and his 666hp in his House of Hope. That battle was epic. The music! OMGs. Raphael actually sings!

Work

• Calling this a bad day would be an understatement.
• Our team lead isn’t able to make our morning standup sessions, nor sprint planning, nor sprint retros, nor end-of-day catchup.
• He won’t communicate or answer questions on Teams.
• Him and our project manager regularly try to discredit me and two other team members in meetings.
• His own work is invisible for the more part. We don’t know what he does day to day or why.
• Probably due to the lack of communication, he’ll wait until we’ve spent days working on tasks before canning them publicly.
• Today, he did it to me yet again after I worked at the weekend to get an Azure WAF running in development, they suddenly asked for it not be put into production. Then had the nerve to ask me to come into the office and discuss it for no particular reason. Great. I’ll spend £170 to come in for one meeting, waste 3 hours commuting, and talk to no one else in the office outside of Teams - all so they can try to make me lose my temper and give them something to complain about.
• The missus noted that I’m too old for this shit - and I agree - but I do hate letting them win. It’s wearing me down mentally and physically.

The Blog

• This whole web server and blog are now running in a handful of containers running via docker-compose, on a AWS EC2 Spot server that could shut down at any moment. But when it is recreated, it should rebuild everything automatically.
• Even better, all the configuration is stored in a GitHub repo that’s pulled every 5 minutes so I can control everything with Git.