Named systems. Honest parts.
The practice runs on five internal systems — botanical codenames, all New England natives. Each separates an agnostic core from its clients: the current implementation is always the first client, never the product. And where a system stands on someone else's platform, it says so by name.
Cloud platform
A Terraform-managed AWS estate, root module down — VPC across two AZs, ECS Fargate behind an ALB, RDS, WAFv2, KMS. Plan on PR, apply on merge, OIDC-only. Plainly: it's AWS, run the way it should be run. The value is the posture.
Provisioning
Role-based, idempotent provisioning that turns a fresh Linux box into a configured infrastructure workstation — one command, four target profiles. It's Ansible under the hood; ours is the roles, the profiles, and the discipline.
Observability
Dashboards live as JSON and apply by Terraform on merge; one declarative Alloy collector per host. Built on Grafana Cloud — Mimir, Loki, Grafana — and we say so. What's ours is the git discipline: if it isn't in the repo, it doesn't exist.
Log capture & archive
Per-source collectors shipping full-volume logs — DNS, flows, TLS handshakes — to Axiom for 30-day search at $0/month. Fluent Bit ships, Axiom stores; betula is the persistence, the packaging, and the GitOps around both.
Agent fleet
A self-hosted pool of headless coding agents. Drop a job on the NAS, an idle worker claims it, does the work in a clean checkout, opens a PR. It never merges. Today's workers run Claude Code; the queue doesn't care.