Hybrid Cloud Identity Platform
Identity, file services, and site-to-site networking for a freight operator, provisioned as code on Oracle Cloud and converged with Ansible. Branch offices reach head-office identity over an encrypted mesh, and every recurring operation — onboarding a peer, checking health, restoring a backup — is a named command rather than a remembered procedure.
Production
Provisioning and configuration are deliberately different tools. Terraform declares the cloud compute node, block storage, and network security groups; Ansible converges WireGuard and Samba from templates. Neither is asked to do the other's job badly.
The repository documents the edge of its own control. The virtual network, subnet, gateways, and routing tables sit outside Terraform state, and the README states the consequence plainly: an out-of-band console change can sever VPN routing, and apply can neither detect nor revert it.
Ordering constraints are enforced rather than merely documented. Provisioning refuses to run until the domain controller is registered as a WireGuard peer, because the playbook routes DNS, NTP, and Kerberos through that tunnel — and peer registration itself rejects duplicate entries, colliding VPN addresses, and malformed keys.
A single command runs seven checks across the node, among them a mount assertion that fails loudly if the data volume is absent and writes have silently been landing on the ephemeral root disk.
Administrator credentials are never written to disk during provisioning, even if the run is interrupted partway through.
Adding a branch office is a templated command that generates the client configuration and registers the peer, not a manual key exchange carried out by hand.