Hybrid Cloud Engineer

David Woitzik

I build Azure infrastructure for environments that have to pass ISO 27001, NIS2 and KRITIS audits, and run a homelab where I find out what breaks first.

Here I publish the Terraform modules and the write-ups I wanted when I was solving the same problems: what failed, why, and the fix that held.

Read the blog Terraform modules

articles: 85; articles
free Terraform modules: 5; free Terraform modules
certifications: 2; certifications

Azure
Terraform
Kubernetes
Proxmox
Ansible
MikroTik

Latest writing

All 85 articles →

Nov 12, 2026
5 min read

Gitea Actions on k3s: Self-Hosted CI Without GitHub

Gitea Actions runs GitHub Actions-style YAML on your own hardware. Gitea and act_runner on k3s keep CI pipelines and runner resources under your control.

Kubernetes Gitea CI/CD
Nov 10, 2026
10 min read

Raspberry Pi 5 Alternatives Compared 2026

Radxa Rock 5B, Orange Pi 5 Plus and a budget N100 mini PC compared with the Raspberry Pi 5 for homelab edge workloads, and when the Pi is still right.

Hardware Homelab Review
Nov 8, 2026
9 min read

Unable to mkstemp /tmp/apt.sig: How /tmp 0755 Broke apt

A /tmp at mode 0755 left apt on my Proxmox host unable to verify signatures for two months. A week later, unattended-upgrades skipped 69 Pi updates.

Proxmox Homelab Debugging
Nov 5, 2026
9 min read

Prometheus Sizing for Homelab: RAM, Retention, and a 2Gi Limit

kube-prometheus-stack on a small k3s cluster: no memory limit took down a 4GB node, then the TSDB filled its NFS volume. The real values that fixed both.

Kubernetes Prometheus Monitoring
Nov 1, 2026
6 min read

CloudNativePG on k3s: PostgreSQL That Survives Node Failures

StatefulSets on local PersistentVolumes don't survive node failures. CloudNativePG handles PostgreSQL replication, failover and backups without Longhorn.

Kubernetes PostgreSQL CloudNativePG

Free Terraform modules

Details →

MIT licensed and published on the Terraform Registry. Each one has a write-up that explains the design decisions.

Azure Acmebot - Zero-Trust Edition

Free

Let's Encrypt automation for locked-down Azure environments. Private Link isolation, default-deny network rules, and Managed Identity, built for ISO 27001, NIS2, and KRITIS audits.

Azure Terraform ISO 27001

GitHub → Registry Write-up

Hub & Spoke - Zero-Trust Edition

Free

Zero-Trust NSGs, centralized Private DNS, and a DINE policy bypass so Azure Policy remediation does not show up as Terraform drift.

Azure Terraform Zero-Trust

GitHub → Registry Write-up

Azure Firewall - Forced Tunneling Edition

Free

Forced tunneling without the Terraform cycle error, with KMS and Azure AD bypass routes, dynamic IP Groups, and baseline FQDN policies. Drops into an existing Hub & Spoke without breaking Windows activation or Managed Identities.

Azure Terraform Firewall

GitHub → Registry Write-up

Azure OpenAI RAG - Zero-Trust Networking

Free

Isolated network layer for an Azure OpenAI RAG stack. Private Endpoints for Azure OpenAI and AI Search, automated Private DNS, and Managed Identity RBAC between them instead of shared keys.

Azure Terraform AI

GitHub → Registry Write-up

Private AKS - Zero-Trust Edition

Free

No public API server, no public node IPs, no default outbound path. Forced-tunneled egress via Route Table, private-endpoint-only ACR and Key Vault. Built to run behind your Hub & Spoke.

Azure Terraform Kubernetes

GitHub → Write-up

Free: Azure Zero-Trust Terraform Cheat Sheet

8 production-ready patterns for NSGs, Private Endpoints, Forced Tunneling, and Managed Identities. Sent to your inbox as soon as you confirm your address.