Engineering articles
Field notes from our software and network engineers — Kubernetes, subscriber access, DNS, NBN integration and network automation for Australian ISPs, network operators and enterprises.
16 September 2026 · 8 min read
Thanos on S3: years of Prometheus metrics, one global view
Extending Prometheus with Thanos and S3: sidecars shipping blocks to a bucket, store gateway and querier for a single pane across sites, compactor downsampling for multi-year retention, HA deduplication — and when VictoriaMetrics is the simpler answer.
14 September 2026 · 7 min read
Grafana Loki on S3: logs without the Elasticsearch bill
Running Loki with an S3 object-storage backend: TSDB index and chunks in one bucket, compactor-driven retention, label discipline, simple-scalable read/write targets — and why it beats an Elasticsearch cluster for operator log volumes.
8 September 2026 · 7 min read
S3 event notifications and time partitioning that ages well
Designing S3 data layouts for the long haul: event notifications through EventBridge or SQS, hive-style dt= time partitioning, event-time vs arrival-time, lifecycle rules and the small-files problem — with an ISP flow-records example.
27 August 2026 · 7 min read
SQS vs Kinesis: competing workers, fan-out, and when each wins
SQS gives you one queue with competing workers — each message processed once. Kinesis gives you a log every consumer group reads in full, in order, with replay. Confusing the two is the most common queueing mistake we see; here's the decision rule.
12 August 2026 · 7 min read
DynamoDB single-table vs multi-table design, honestly
Single-table DynamoDB design is preached as dogma. Here's what it actually buys, what it costs your team, and a decision rule that has survived production: hot-path item collections earn a single table; everything else usually doesn't.
16 September 2026 · 9 min read
A REST backend for RADIUS on DynamoDB: auth, authorization VSAs and accounting
Replace rlm_sql with a thin REST service on DynamoDB: FreeRADIUS calls one endpoint for authentication and authorization, gets vendor-specific attributes (Cisco AVPair, Mikrotik-Rate-Limit) back to shape the session, and streams accounting into a table designed for the write rate.
16 September 2026 · 9 min read
FreeRADIUS as an identity source: signing JWTs from RADIUS events
How to turn a FreeRADIUS server into a token issuer: a Python hook signs short-lived RS256 JWTs on authentication and accounting events, and internal APIs verify them offline with a public key — no shared database. Plus when to graduate to Ory Hydra or Keycloak.
10 September 2026 · 8 min read
Network provisioning automation with NETCONF, YANG and Ansible
Moving Cisco and Juniper networks from CLI change windows to configuration as code: NETCONF/YANG, Ansible, candidate configs, validation and safe rollback.
3 September 2026 · 8 min read
NBN integration for RSPs: automating the path from serviceability to activation
What NBN integration really involves for an Australian RSP: serviceability qualification, order lifecycle, status webhooks, error handling and provisioning automation.
20 August 2026 · 8 min read
High-performance DNS for ISPs: anycast resolver design
Designing ISP-grade DNS resolvers: anycast with BGP, Unbound and Knot Resolver tuning, cache strategy, DoH/DoT, and the monitoring that keeps QPS honest.
30 July 2026 · 7 min read
Zero-downtime deployments on Kubernetes, done properly
Probes, PodDisruptionBudgets, rolling update tuning and connection draining — the complete checklist for Kubernetes deployments that never drop a request.
9 July 2026 · 9 min read
Running FreeRADIUS on Kubernetes: subscriber AAA at scale
Deploying FreeRADIUS on Kubernetes for ISP subscriber authentication: UDP traffic, source-IP stability, accounting pipelines, scaling and monitoring.
18 June 2026 · 8 min read
Bare-metal Kubernetes for ISPs and network operators
How to run Kubernetes on bare metal in an ISP environment: MetalLB in BGP mode, Multus for VLAN-attached workloads, node topology and storage choices.