Two sanitized IaC samples

Why these exist

The Selected Work section claims AWS network configuration under OpenTofu and standardized Linux hosts under Ansible. That's the kind of claim that's easy to write and hard to believe without something to read. These two samples answer the obvious follow-up — how deep is the IaC really? — by being the code, not a description of it.

They're deliberately small. Each does one job, does it idempotently, and is written to be understood in one sitting rather than to impress with size. Both are tested and both run their own linting and CI, because "it's in version control" and "it actually works" are different claims.

ansible-linux-baseline

An opinionated, incrementally-adoptable security baseline for a fresh Debian or Ubuntu server. Point it at a box that just finished its OS install and it brings the host to a known-good state: admin users with SSH keys, a hardened SSH daemon, sane network/kernel sysctl settings, automatic security updates, and a persistent, size-capped journal.

The problem it solves. Every new server starts the same way — password SSH on, root login allowed, no non-root admins, nothing patching itself, logs gone on reboot. Fixing that by hand is easy to get almost right and easy to do slightly differently each time; that drift is what bites six months later. This turns "the way we set up a server" into one reviewable, re-runnable definition.

Design choices worth knowing:

• Won't lock you out. Password auth is disabled by default, but the role refuses to apply that unless an admin key is present, and it creates users before it hardens SSH. The safe path is the default path.
• Drop-ins, not edits. SSH, sysctl, journald, and unattended-upgrades are configured with files in *.conf.d/ directories rather than rewriting the distro's own config — upgrades stay clean and the footprint is obvious.
• Validated before applied. The sshd config is checked with sshd -t and sudoers with visudo -cf before being put in place, so a bad template can't leave a broken daemon.
• Six independent toggles. Each section can be turned off, so the role can be adopted one piece at a time.

Tested with Molecule against a Docker container: converge applies the role, verify asserts the outcomes (hardened sshd -T output, the admin user in its group, live sysctls, unattended-upgrades present, persistent journald). CI runs yamllint, ansible-lint, and the full Molecule suite.

opentofu-aws-vpc

A small, readable AWS VPC module: a VPC with public and private subnets spread across availability zones, an internet gateway for public egress, and optional NAT gateway(s) for private egress. It does one job well — it's the module you'd actually read before running it, not a forty-variable framework.

The problem it solves. Almost every AWS environment starts with the same networking boilerplate, and hand-written it's a few hundred lines that are easy to get subtly wrong: a missing route-table association, a NAT gateway in the wrong subnet, public subnets that don't actually assign public IPs. This encodes that layout once, correct by construction, so a new environment is a dozen lines of inputs instead of a page of resources to copy-paste and mis-edit.

Design choices worth knowing:

• Index-aligned lists. Subnet, CIDR, and AZ share an index, so the layout is easy to reason about.
• Cost-aware default. single_nat_gateway defaults to true — a NAT gateway is one of the quietest line items on an AWS bill; flip it off for per-AZ resilience.
• No provider inside the module. It declares its provider requirements but configures no provider block, leaving the caller in control of region, credentials, and aliases — the standard for a reusable module.
• Validated inputs. Bad CIDRs or an empty AZ list are rejected at plan, not mid-apply.

Tested in CI with tofu fmt -check, tofu validate on both the root module and the runnable example, and tflint — none of which needs AWS credentials.