Open source tools extracted from production infrastructure work.

GitHub Actions

commit-to-control — Map git commits to NIST 800-171 controls via vector similarity + LLM judge. Every PR gets a comment showing which compliance controls the change addresses, with cost tracking in dollars and satoshis. Supports OpenAI, AWS Bedrock, and Ollama. Marketplace. Blog post.

resolve-container-image — Resolve container images from explicit input, terraform state, or release branch. Prevents accidental image rollbacks during infra-only terraform applies. Priority chain with an update_images safety gate. Marketplace.

eks-pv-az — Move EBS-backed PersistentVolumes to an Availability Zone where their pod can run. Heals the volumes an EKS unpark or a nodegroup change leaves in the wrong zone. Marketplace.

terraform-plan-summary — One table for every Terraform plan on a pull request: collects the plan comments into a single summary with change icons, resources and links. Marketplace.

Terraform Modules

terraform-aws-headscale — Deploy Headscale (open-source Tailscale coordination server) on AWS. Two modules: coordination-server (Headscale + subnet router on one EC2) and subnet-router (Tailscale-only for additional VPCs/accounts). Replaced $489/mo in AWS Client VPN with a $3/mo t4g.nano. Blog post.

terraform-aws-unified-dns-v2 — Define DNS records once, create them in Route53 and Cloudflare. Format translation, NS mirroring, provider toggling via zone ID. Blog post.

terraform-eso-feature-flags — Wildcard feature flag discovery for Kubernetes via External Secrets Operator. A separate ExternalSecret with dataFrom.find walks an SSM path prefix, matches FEATURE_FLAG_* parameters, rewrites the keys, and syncs them into a dedicated K8s Secret loaded via envFrom. Per-tenant rollout without LaunchDarkly — the SSM path prefix is the namespace. Blog post.

terraform-aws-dcv-vdi — A self-hosted NICE DCV Windows desktop on EC2 that can run Docker via nested virtualization, reachable at a clean https:// URL with an auto-renewing Let’s Encrypt certificate. No ALB, no ACM, no static credentials — the instance role trusts its own ARN, so win-acme mints short-lived STS credentials for each DNS-01 challenge. Blog post.

terraform-aws-vpc-flow-logs — VPC flow logs that actually deliver. Creates the destination and its authorisation, not only the flow log: the vended-log bucket policy Terraform omits, the delivery role and log group for the CloudWatch path, and a 27-field v5 format. S3 or CloudWatch Logs, partition-aware. Blog post.

terraform-k8s-service-deployment — Deploy containerized services to EKS with CMMC Level 2 security contexts, ALB ingress, IRSA, External Secrets Operator integration, sidecar support, and feature flag discovery. Refuses latest tags. One module block per service per tenant.

terraform-aws-account-baseline — The audit, detection, cost and backup controls a new AWS account needs on its first day, in one module. Multi-region CloudTrail with log file validation in an Object Lock bucket, Config with the CIS v1.4 Level 2 and HIPAA conformance packs, GuardDuty, Security Hub, Access Analyzer, Inspector, three customer-managed keys, a budget and backups. Each fix is a few lines; the module exists for the order they must go in and the failures that look like success. Registry.

terraform-aws-organization-baseline — Service control policies that do not break the people they protect. Region restriction that keeps Bedrock working, S3 encryption rules that do not break a plain aws s3 cp, and audit protection that does not lock out your own Terraform. The first apply creates the policies and attaches none. A data-exports submodule creates the FOCUS 1.2, Cost Optimization Hub and CUR 2.0 exports (with the IAM principal of each line item) and ships DuckDB views that show model spend by caller. Registry.

terraform-aws-state-backend — Remote state for one Terraform root: a KMS-encrypted, versioned, private S3 bucket that refuses plain HTTP, plus the key that encrypts it. Locking uses the S3 lockfile, so there is no DynamoDB table. Handles the bootstrap problem of a bucket that must exist before the state that describes it. Registry.

terraform-aws-parked-page — A maintenance page for an environment you deliberately switched off. CloudFront with a viewer-request function serves every host in a zone a 503 and a short explanation — no origin, no bucket, no hourly charge — so the page outlives the load balancer the park deletes. Parking a host is then one DNS record. Registry.

Kubernetes Tooling

kwhy — Explain why a Kubernetes object keeps changing: owner chain, write managers, likely reconcilers, desired-state inputs, revert risk, and RBAC sanity checks. Built for incident response in controller-heavy clusters where manual child edits keep getting overwritten. Related post.

CLI Tools

_aws_move_outtamyway — Zero-latency shell completer for the AWS CLI. Replaces the stock aws_completer (which spawns Python on every tab) with a static zsh/bash function generated from a DuckDB catalog of the botocore API contract. 428 services, 18,115 operations, 341 waiters, 46 regions. One curl to install. Blog post.

sso-login-all — Log into all your AWS SSO orgs at once. Discovers [sso-session] blocks from ~/.aws/config, checks the token cache, and only opens browser tabs for expired sessions.

cf-wait — Wait for CloudFront invalidation to complete. Knows your sites by name — type cf-wait ferkakta.dev instead of a distribution ID. Auto-finds the latest invalidation, creates a fresh one if the last one is stale, and cf-wait all checks every site at once. Blog post.

entra-idc-federation — Connect Microsoft Entra ID to AWS IAM Identity Center with one script: SAML for sign-in, SCIM for users and groups, driven by the Azure CLI session and Microsoft Graph. Handles the two failures with useless error messages — tenant metadata with more signing certificates than Identity Center accepts, and SCIM users rejected for a missing first or last name.

buildbench — Measure builds on the target hardware, not your laptop. Launches a self-terminating spot instance, runs the build under CloudWatch Agent and sysstat at once, writes the results to S3 and shuts down. Fractions of a penny per run. Docker Desktop’s memory numbers include the VM’s overhead; size resource requests from these instead. Blog post.

docker-image-integrity-check — Detect stale Docker build cache layers. Buildx with the GHA cache can serve an old COPY layer while CI reports success; this hashes the source tree and the same files inside the built image and fails when they differ. Blog post.

microvm-dbrepl — A serverless production-database terminal on AWS Lambda MicroVMs. A browser shell inside the production network, even into a peered VPC with no tooling of its own, with every query and result recorded to CloudWatch. For a standing triage desk where you have to prove who touched what. make ready and you’re in.

Frontend

widont — Prevent typographic widows in headings and paragraphs. Replaces the last space with a non-breaking space so the final word doesn’t sit alone on a line. Originally a jQuery/CoffeeScript plugin from 2007, rewritten for modern browsers. In use on three sites.

Claude Code Skills

claude-skills — Claude Code skills for platform engineering. Each skill encodes a complete methodology for a recurring task — morning briefings, harvest sessions, scrum prep, strategic analysis. Tool-agnostic by design: the skills describe what to check and why, not which binary to use. Blog post.