# Infrastructure as Code > Selected work demonstrating this service. - [Enhanced data security by implementing 1,000 RBAC rules for developers, application instances, PostgreSQL, MS SQL, and other Linux servers, preventing unauthorized access; documented with Ansible automation.](https://engineer.company/portfolio/enhanced-data-security-by-implementing-1-000-rbac-14/) - [Provisioned Azure infrastructure as code with Bicep — Container Apps, PostgreSQL Flexible Server, Front Door/WAF and networking — across the development, staging and production environments.](https://engineer.company/portfolio/provisioned-azure-infrastructure-as-code-with-bicep-container-68/) - [Configured database backup retention as infrastructure‑as‑code, then audited the recovery position and documented the restore procedure — naming the remaining gaps rather than leaving them to be found during an incident.](https://engineer.company/portfolio/configured-database-backup-retention-as-infrastructure-as-code-72/) - [Built the company's own infrastructure as 19 Ansible playbooks and 34 roles across 12,065 lines of YAML, converging a live host to a declared state with every play idempotent.](https://engineer.company/portfolio/built-the-companys-infrastructure-as-code-108/) - [Ran the whole company on one 512 MB single‑core host — a git forge, a web server serving seven domains, Tor, two alternate‑protocol servers, backups and intrusion banning — by treating 464 MB of usable memory as the binding architectural constraint.](https://engineer.company/portfolio/ran-the-whole-company-on-one-512mb-host-109/) - [Hardened SSH to 24 asserted directives with three‑stage validation — the candidate file, the assembled config, then the daemon's own read‑back — after the read‑back caught the running server silently overriding two of the twenty‑four.](https://engineer.company/portfolio/hardened-ssh-with-three-stage-validation-111/) - [Built encrypted off‑host backups on restic with retention pruning, an integrity check and a monthly automated restore drill, then audited the recovery position and wrote down the gaps rather than leaving them to be found during an incident.](https://engineer.company/portfolio/built-encrypted-backups-with-a-monthly-restore-drill-114/) - [Built dead‑man's‑switch monitoring that pings only while memory and disk are healthy, so a degraded host raises an alert by going silent — and caught six variable names saying "free" where the check correctly measured "available", an order of magnitude apart on a 464 MB box.](https://engineer.company/portfolio/built-dead-mans-switch-monitoring-115/) - [Made check mode tell the truth across the whole platform after finding six probes deciding on a value the host never gave, because Ansible's command module reports success under --check while skipping the command entirely.](https://engineer.company/portfolio/made-ansible-check-mode-tell-the-truth-116/) - [Added a preflight play that runs the same code as the converge against operator‑local secrets in about a second, after a half‑applied production run died on its ninth task with the swap settings already written to the live host.](https://engineer.company/portfolio/added-a-preflight-play-for-secrets-117/) - [Reconciled a 20‑record DNS zone declaratively against the Cloudflare API with separate audit and BIND‑export entry points, and turned the CDN proxy back off on privacy grounds after building it.](https://engineer.company/portfolio/reconciled-a-dns-zone-declaratively-118/) - [Cut systemd sandbox exposure across every unit this platform installs — a dead‑man's‑switch service from 9.6 UNSAFE to 1.5, an internet‑facing git forge from 8.3 EXPOSED to 1.5 — and added a converge‑time parser check after finding a misspelled directive silently ignored in three unit templates.](https://engineer.company/portfolio/cut-systemd-sandbox-exposure-across-every-unit-119/) - [Deployed the company's own git forge on Soft Serve, private by default with no web panel and its SSH port bound to loopback behind a jump host, and made the landing page in front of it a build artefact of the main site rather than a hand‑kept copy.](https://engineer.company/portfolio/deployed-the-companys-own-git-forge-121/) - [Automated the provisioning of a second server on a second cloud provider, creating the firewall before the machine so it is born behind one, with both providers' firewalls written directly against their REST APIs to avoid a third‑party collection.](https://engineer.company/portfolio/provisioned-a-second-server-from-code-123/) - [Split the four per‑host operational secrets after establishing that two hosts sharing one dead‑man's switch alert less than two switches, not more, and that a shared backup passphrase makes two hosts one repository.](https://engineer.company/portfolio/split-every-operational-secret-per-host-125/) - [Rehearsed the forge‑side CI hook and found two defects unreachable by reading the file: a fallback that put an unresolvable argument on the hook's input, and git's own environment variable following the gate into the checkout and turning 19 tests red.](https://engineer.company/portfolio/rehearsed-the-forge-side-ci-hook-151/)