Services

Why us?

We are brave. Someone has to open the pipeline nobody has touched since its author left, the cloud account with no owner, the Terraform state that stopped matching reality two years ago. That is the work we take.

We are a small shop, which means you talk to the people doing the work. We do not sell a rewrite of everything. We find out what is actually running, put it under version control, and hand it back in a shape the next person can read.

What we do

GitLab

GitLab is where our work lives: repositories, CI/CD, container registry, environments and releases. We build pipelines that are boring on purpose - readable, reusable across projects, and fast enough that nobody is tempted to skip them. That includes runner setup and scaling, dependency updates with Renovate, and getting review apps and deployments to behave the same way in every project.

AWS

AWS is our default target. Accounts and organisation structure, networking, IAM that follows least privilege instead of hoping for the best, compute from EC2 to ECS to Lambda, RDS, S3 and CloudFront. We also do the unglamorous parts: cost review, tagging that survives an audit, and turning off the things nobody has used since the proof of concept.

Terraform and OpenTofu

Everything gets created by code. We write and maintain Terraform and OpenTofu modules, keep state where it belongs with locking that works, and untangle drift when the console has been used "just this once". If you are moving from Terraform to OpenTofu, we have done that migration and can do yours.

HashiCorp Vault - zero trust

Static credentials in CI variables are a slow-motion incident. We deploy and run Vault so secrets are short-lived and issued on demand: dynamic database credentials, cloud credentials per pipeline job, PKI for internal certificates, and encryption as a service. Applications and pipelines authenticate as themselves, get exactly what they need, and lose it when they are done.

NetBird

Private access to internal systems without a VPN concentrator to maintain and without opening things to the public internet. We roll out NetBird as a peer-to-peer overlay network with identity-based access rules, so who can reach what is a policy you can read, not a firewall rule nobody remembers writing.

Grafana stack

Dashboards, logs, metrics, traces and alerts, self-hosted or on Grafana Cloud. We instrument what you run, ship it with Alloy, store it in Loki, Prometheus/Mimir and Tempo, and build alerts that page a human only when a human is actually needed. Then we sit with your team and make sure the dashboards answer the questions they get asked at three in the morning.

These come up in our work regularly, just not as the main event: Google Cloud Platform and Microsoft Azure, GitHub Actions and Azure DevOps pipelines, Kubernetes and Helm, Ansible for the machines that are not going anywhere, and Docker image builds that do not take twenty minutes.

Not sure which of these you need?

That is a normal place to start. Write to info@segfault-labs.dev and describe the problem, not the solution.