(in case you were wondering: yes, this page was served from inside that AS.)
A FreeBSD-shaped person doing Linux things for a living.
I run my own Autonomous System (AS201379) on the public internet, peer at LocIX, FogIXP and EVIX, and host basically everything I use on FreeBSD jails. By day, Senior Consultant at Red Hat, working on RHEL, Ansible, FreeIPA and Keycloak.
The infrastructure behind this page, in case you were wondering.
Public-internet IPv6-first network
2a06:9801:1c::/48The hobbyist parallel internet
FreeBSD jails on ZFS, inside AS201379
What customers actually pay me for
IPv6 first, IPv4 grudgingly
If I do it twice, it gets a playbook
Consulting across the Red Hat infrastructure stack: RHEL, Ansible Automation Platform, FreeIPA / IdM, Satellite and Keycloak. Engagements range from automating RHEL fleets and building execution environments, to rolling out enterprise identity with IdM and Keycloak, to hardening environments that have to pass real audits. I deliver hands-on across the full lifecycle, from the first whiteboard session to the playbook that survives 3 AM.
Implementing Red Hat solutions at customer sites: Ansible Automation Platform rollouts, RHEL fleets, FreeIPA / IdM, Satellite for content lifecycle, Keycloak for SSO. The work that taught me most of what I know about scaling automation past the proof-of-concept stage.
200+ RHEL servers in a healthcare context, with everything that implies: tight change windows, GDPR for actual patient data, and very little tolerance for cleverness. Built out the Ansible automation that ran the fleet, ran Kubernetes for the containerised apps, and learned the difference between an outage and an incident.
Internal IT operations for a healthcare and pharmacy software group: networks and Linux systems that the business ran on, with internal stakeholders rather than customers on the other end. Same company I had started at, incidentally: Pro-Medisoft became awinta after a merger, and awinta later renamed itself Noventi. Same building, three letterheads. This is the job where I picked up Ansible early enough that the docs still fit on one page, and where I started replacing every shell-script-and-cron contraption I found with playbooks.
Backend Java for an online pharmacy serving 10K+ users a day. Wrote a lot of code, broke a lot of code, and started developing strong opinions about how the box underneath the JVM should behave. That second part eventually won.
Promoted out of the apprenticeship into running a small Java team building eCommerce for healthcare clients. First time I had to care about other people's code reviews, deadlines, and three-day debugging sessions. Useful, not always fun.
Three years of German Fachinformatiker apprenticeship: Java, databases, and the full Berufsschule routine. The years where I figured out that computers were going to be the job, not the hobby that pays the bills.
A few of them are even on the public internet.
An Ansible connection plugin I wrote so you don't have to run sshd inside every FreeBSD jail. SSHs to the host, then jexecs into the jail. The way you'd do it manually, just automated.
# inventory
web-jail ansible_connection=jailexec \
ansible_jail_host=jailbox.example.com
My own Autonomous System on the public internet. Four FreeBSD edge routers, FRR, IPv6-first, peering at LocIX, FogIXP and EVIX, direct BGP with Hetzner. Documented on the blog in four parts (so far).
A small German-speaking Mastodon instance I run for friends and the local tech crowd. Multi-jail FreeBSD setup, documented on the blog. Tooting since 2022, still here.
Same prefixes, different planet. A stub AS in the DN42 hobbyist mesh: MikroTik border, three WireGuard peerings, FreeBSD bastille jail running PowerDNS authoritative for chofstede.dn42.
A Forgejo deployment running entirely on rootless Podman + Quadlets, fronted by Traefik. The setup I run for my own git, written up so others don't have to repeat the pain.
50+ long-form posts on FreeBSD, BGP, jails, Ansible, ZFS, identity management. Pelican-generated, served by nginx in a jail, inside AS201379. The thing this whole setup actually exists for.
Long-form notes from the lab. Mostly FreeBSD, BGP, and infrastructure I'd want to read about myself.
Registering AS4242422539, three WireGuard peerings on a MikroTik border, and a FreeBSD bastille jail running PowerDNS authoritative for chofstede.dn42.
Read Article →A fourth FreeBSD edge router at iFog, a direct BGP session with Hetzner on FogIXP, and bringing the home LAN into the /48 via an iBGP-speaking MikroTik.
Read Article →Two completely independent uplinks on one server, using FreeBSD's dual-FIB routing tables and pf's rtable / reply-to directives. Zero confusion, eventually.
Read Article →Running RHEL on ZFS root is not supported. I did it anyway. Here's how this cursed configuration came to be, why you shouldn't replicate it, and what the proper alternative looks like.
Read Article →Mail: info@hofstede.it. PGP key on Keyoxide. I usually answer within a day or two.
Peering: peering@hofstede.it (see the AS201379 page for policy).