Terraform nobody wants to touch
State drift, tangled modules, and a quiet fear that the next apply wakes the incident channel.
Owner-operated infrastructure studio
Find what’s actually wrong in production — and fix it safely.
RuntimeForge is Dean Whitlock’s studio for AWS platforms, Terraform, inherited-environment recovery, and post-incident hardening. You brief one senior operator — and that operator reads the logs, makes the changes, and writes the handoff.
- Focus
- AWS · Terraform · IAM · delivery · networking · observability
- Model
- Direct senior implementation. No agency relay layer.
runtime-map
Demonstration
§ 01 — The problem
Production stops being legible one reasonable decision at a time.
None of it is negligence. Systems accrete under deadlines until nobody can safely say what will happen when they change. RuntimeForge exists to make that legible again — and to fix it without a ceremonial rewrite.
Access outran its controls
IAM sprawl, long-lived keys, and permissions that grew faster than anyone’s ability to reason about them.
It works until one person is offline
Production still leans on tribal memory and a few careful people staying awake at the right moment.
The incident ended; the cleanup didn’t
The fire is out, the postmortem is filed, and the actual remediation is still vague and unscheduled.
Every diagram and readout on this site is a labeled demonstration. Nothing here is real client telemetry, and no metrics, outcomes, or logos are invented.
§ 02 — Engagements
Three ways teams arrive. The underlying job is the same.
Sold like a studio, delivered like an operator. Scope is shaped around what is actually broken, risky, or expensive to leave vague — not around a fixed package.
01
Startups moving past improvisation
Build the first real platform
When production still depends on a few careful people and tribal memory, this pass turns it into infrastructure with repeatable deploys, environment separation, and clear operating boundaries.
- Terraform foundations for VPC, ECS, Aurora, ALB, Route 53, secrets, and environment structure
- Delivery paths that survive team growth instead of one person staying awake
- Operating decisions documented while the work is still fresh enough to matter
Typical technical surface
AWS account structure, IAM baseline, Terraform module shape, CI/CD, secrets handling, DNS, and the first honest runbook.
02
Growth-stage teams carrying confusing environments
Rehabilitate the inherited estate
For the system that technically works but nobody trusts: drift, ambiguous access, hidden coupling, and a steady fear that the next edit wakes the incident channel.
- Audit cost, blast radius, IAM sprawl, Terraform drift, delivery risk, and environmental coupling
- Separate what must be fixed now from what should be stabilized and scheduled
- Leave runbooks and rollback logic behind, not just a one-time cleanup
Typical technical surface
Drift reconciliation, state and module untangling, access review, delivery hardening, and a prioritized remediation sequence.
03
Teams carrying fresh risk or an uncomfortable postmortem
Harden after the ugly surprise
Contain the immediate problem, review access and exposure, then implement hardening that actually lowers the chance of a repeat — without forcing a rewrite.
- IAM review, least-privilege cleanup, secrets hygiene, and safer operational boundaries
- Post-incident scoping that turns the vague part into a real remediation plan
- Targeted hardening shaped around the environment that already exists
Typical technical surface
Exposure review, credential rotation, least-privilege enforcement, logging and detection gaps, and change-path safety.
§ 03 — Method
The stack matters. The sequence matters more.
Most infrastructure damage happens during well-intentioned changes made without a clear picture. The work moves from investigation to safe implementation to a real handoff — in that order, every time.
- 01
Investigate first
Map the environment, find what is actually risky, and separate symptoms from the structural problem before touching anything.
- 02
Sequence the change
Choose the safest path, make rollback visible, and keep urgency from quietly becoming permanent architecture.
- 03
Implement directly
The same person who did the diagnosis makes the changes. Detail does not get diluted through a handoff.
- 04
Hand off clearly
Runbooks, notes, and post-change context are part of the work — not optional cleanup that never happens.
§ 04 — Selected work
Public work over invented case studies.
No client logos, no fabricated outcomes. The verifiable proof is a habit of reducing ambiguity until a system can be operated, inspected, and handed off with less guesswork.
Detection lab
NoSleep-Ops
A contained environment for traffic and patterns you do not want to generate in a real estate.
Mar 2026
Systems networking
FireRouter
A Rust networking build for when the router is technically up and operationally unhelpful.
Jan 2026
Automation
opscraft
PowerShell utilities collapsing repetitive infrastructure work into a smaller set of commands.
Jun 2025
Creative systems
Comicquant
A TypeScript experiment where structure, sequencing, and visual systems get to be expressive.
Jan 2026
Firmware
dsl-asuswrt-merlin.ng
Custom Merlin firmware for edge hardware that still deserved maintenance and a better posture.
Oct 2023
§ 05 — Field notes
Writing from real systems, not content marketing.
Incident patterns, infrastructure mistakes, and hardening work — the kind of detail that stays useful to buyers, operators, and whoever inherits the system next.
When 30 Google Workspace accounts picked up hidden email aliases overnight.
A persistence-by-alias pattern that hides in plain sight in the Google Workspace admin console, and the Admin SDK Apps Script that cleaned it up in under a minute.
Open noteThings that bit me when staging and prod "shared just one small thing."
A field guide to the environment-isolation failures that show up six months into a Terraform rollout, from shared secrets to DNS drift.
Open noteWhen Terraform isn't the answer.
Pulumi, CDK, Ansible, plain shell — and the project shapes where Terraform is actually the wrong pick. A working taxonomy for picking the right IaC tool.
Open note§ 06 — Why direct
Fewer layers between diagnosis, decision, and change.
I’m Dean Whitlock. RuntimeForge is my studio. The work lives in AWS accounts, Terraform state, IAM sprawl, delivery pipelines, and the awkward edges that appear once infrastructure becomes consequential.
You are not buying project management wrapped around a specialist. You are buying direct technical judgment, implementation, and handoff from the same operator — which keeps infrastructure work moving when ambiguity and stakes climb.
Tooling matters, but not as identity. The useful thing is choosing the approach that fits the system, then leaving it clearer, safer, and easier to operate than before.
Working vocabulary
terraformawsecsauroragithub actionsiamcloudflarecaddywireguarddockernftablesobservability
§ 07 — Contact
Start the brief before the system gets more expensive.
Scoped builds, cleanup, hardening passes, audits, and exploratory calls all fit here. Specific detail helps more than polished detail.
Message received
Expect a reply within one business day.
Form relay not configured in this environment
The form still validates locally. For live sends, set PUBLIC_FORMSPREE_ID, or use a direct channel.