I Built the Thing

My Pi-hole showed talk.google.com blocked 32,000 times, and I had no idea why.

By that evening I’d traced it to ten Sonos speakers, put both DNS servers under version control, hardened them to key-only SSH, stood up a sync container, walled the smart-home gear off from my laptops with firewall rules, and geo-blocked 11 countries at the gateway.

I was a network engineer once, long enough ago that none of it survived.

My view has been that people who sell technology without ever having built it tend to oversell it. So I built the thing. I built it in my actual house, where that firewall carries my family’s notifications and the security cameras, and one wrong move kills the music in every room.

The mystery

32,000 blocks against a single hostname is a fight.

Ten Sonos units were reaching for Google’s push servers, getting a wall, and trying again. Harder. Block something your devices genuinely need and the traffic gets louder.

Diagnosing that came down to knowing what a retry storm looks like from the outside, and being willing to consider that the blocklist doing its job was the problem. Almost no typing involved. The storm stopped that night, which is how I know the read was right.

Version control before convenience

Before changing anything, I put both DNS servers in git. I did it to answer one specific question: if either box died tonight, could I rebuild it from nothing?

That question separates someone who administers a system from someone who merely has one. I’ve watched enterprise teams fail it on infrastructure worth far more than my house.

The sync container came out of the same question. Two DNS servers only help you if they agree, so something has to keep them in step without me remembering to do it.

Where a mistake is permanent

Then I moved to SSH keys and turned off password login.

This is the one step where a mistake sticks. Get it wrong and the box keeps running, perfectly healthy, and you can never get back in remotely. At home that costs you a walk to the closet with a keyboard. In a data center three states away it costs considerably more.

So keep the working session open, open a second window, and prove the new way in actually works. Only then burn the old way. That’s the discipline of not closing the door you’re standing in, and no tool told me to do it.

The part a consultant would invoice for

One-way firewall rules, so a compromised camera can reach the internet but can’t reach my laptop. I understood that goal precisely. I could not have written the rule order from memory, and I didn’t have to. The established and related allow, the rule that lets already-open connections back through, has to sit above the block, or you cut off your own ability to control the devices you’re protecting.

Then I tested it, because a rule you haven’t tested is a belief. From the camera network I tried to reach my laptop and got nothing. Tried the internet and got through. Two minutes, and it’s the difference between having a firewall rule and having a firewall.

At house scale, that kind of detail once meant hiring someone and now takes an afternoon. At enterprise scale it’s still change control, a test window, and a blast radius, and I’d be overselling this if I said otherwise.

Nobody gets to the long tail

I geo-blocked 11 countries, updated two access points sitting a firmware version behind, and finally dealt with a certificate warning I’d clicked past for a year.

None of it was urgent. That’s exactly why it had sat there for a year. Every organization I walk into has a version of this list, and it’s rarely hard work. It belongs to nobody, and it never wins the argument for someone’s afternoon.

What I didn’t become

I directed the work and something else supplied the syntax. Whatever I knew when I did this for a living is long gone, and directing the work didn’t give it back.

I still had to know the fix for the certificate warning was two things at once: trust the certificate, and reach the box by the exact name printed inside it. I still caught the near-misses, a password that pasted into the wrong window and a spare SSID the interface offered no way to switch off, which had to come down another way.

There’s a fair objection here and I’d rather raise it myself. Knowing the allow has to sit above the block is judgment. I didn’t have it and something else did. What I brought was knowing what I wanted and being able to check whether I got it. That’s a smaller claim than the one people usually make about this, and it’s the one I can defend.

A reader who builds this kind of automation for a living offered a test I’ve adopted. If you can write a passing test for the step, it doesn’t need a model. I’d push it one step further. If you can’t tell whether the result is right, you have no business directing the work at all, however good the tool is.

The work is all still there. The hard part just relocated, out of writing the commands and into recognizing a right answer when you see one.

The enterprise version

This is the conversation I keep having with CIOs. Most of them are still counting engineers, and for a growing share of the work, headcount was never the constraint.

The bottleneck was always the distance between the person who knows the goal and the person who can execute it. Every requirements document ever written is a monument to that gap. For work this size, that distance just collapsed, and the org chart hasn’t caught up.

The enterprise version of my afternoon is the analyst who stands up her own pipeline instead of filing a ticket, or the seller who builds the account model himself. It’s the leader who prototypes the thing instead of writing a spec and waiting two quarters to find out it was the wrong thing.

A consultant told me recently that he’d had three clients in two months ask for AI to do their bank reconciliation, and one had already built and shelved a version. What stuck with me was his disappointment. The most resilient answer kept coming back as a deterministic framework with AI in a few places, and nobody in the room wanted that to be the answer.

The answer here is just as unglamorous. The people who already know what good looks like can now do the work, and the ones who don’t will ship confident nonsense faster than they ever could before.

If you want one thing to do about it, go find the person on your team who has been right about the last three things and has been waiting on someone else to build them. Take the queue away from them and give them a quarter.

The gate moved. It stands in front of judgment now, and judgment doesn’t ship with the model.