Role and profile design
A layered structure with a common baseline, per-role configuration and per-environment overrides, so a web server and a database host share hardening without sharing everything else.
Infrastructure & Cloud
Configuration Management
Servers configured from code, so rebuilding a machine is boring and identical.
The work
What this actually does
Configuration management earns its keep on the unglamorous machines: the appliance nobody can rebuild, the bastion with three years of hand edits, the batch server that only one person can patch. We describe those hosts as roles and playbooks, apply them repeatedly, and prove the result matches the baseline rather than assuming it does.
The work is mostly about ordering and hardening. Roles are layered so a shared baseline runs first, then service-specific configuration on top, and every task is written to be safe to run twice. Reports show which hosts have drifted, which are missing patches, and which have quietly diverged from the hardened image you thought they were built from.
If any of these sound familiar
- Only one person knows how the billing server was actually set up
- Rebuilding a failed host takes two days of guesswork and old tickets
- Security baselines are documented but nobody can prove they are applied
- Patch status is a spreadsheet updated by hand every quarter
Scope
What's included
Every engagement on this page covers the following, sized to your setup rather than delivered as a fixed package. If something here is not relevant to you, it comes off the scope and off the price.
Idempotent playbooks
Every task written to be safe on the second run, tested against a clean host and an already-configured one, because that is where most hand-written automation quietly breaks.
Hardened baselines
CIS-aligned settings for SSH, sudo, kernel parameters, audit rules and file permissions, with every deviation recorded as an explicit exception rather than quietly left in place.
Patching workflow
Scheduled runs that apply security updates, drain workloads first where needed, and report what changed on each host so a failed reboot is visible immediately.
Drift and compliance reports
Nightly checks comparing each host against its expected state, with a short report per environment listing changes, missing packages and exceptions that need renewing.
Legacy host migration
Hand-built machines gradually replaced by images and roles built in code, with the old configuration read as source material rather than thrown away.
What changes
What teams typically see
1 roleRebuild any host
0Hand-edited production hosts
100%Hosts reporting compliance daily
Handover
What you keep
Everything produced during the engagement is yours: the repositories, the accounts, the documentation. There is no proprietary layer and nothing to unlicense if you take the work in-house.
- Versioned role and playbook repository with tests
- Documented hardened baseline with exception register
- Patch schedule wired into your change process
- Drift and compliance report delivered per environment
- Runbook for rebuilding any managed host from scratch
Tooling
Tools we use here
A starting point, not a requirement. We work in whatever you already run wherever it does the job.
Ansible
Terraform
HashiCorp Vault
Prometheus
AWS
Microsoft Azure
Python
How it runs
From first call to handover
The same four steps on every engagement. You see each one before it starts and can stop at any of them.
- 01
Inventory the hosts
We list every server, appliance and bastion, note who uses it and what state it is in, then pick the ones where automation pays back fastest.
- 02
Write the base role
A common baseline covering users, SSH, packages, logging and time sync lands first, because everything else builds on top of it and inherits its assumptions.
- 03
Convert services in order
Hosts move to managed configuration a group at a time, each tested in staging and applied through the same review process as any other change.
- 04
Prove and report
Once a host is managed we verify it, add it to the nightly compliance check, and hand your team the runbook for rebuilding it without our help.
Questions
Asked before we start
Ansible, Chef or Puppet?
Ansible suits most estates because it needs no agent and is readable by people who are not full-time automation engineers. Chef and Puppet still make sense where you already run them at scale. We are happy to keep what you have.
Our servers are snowflakes. Is it too late?
No, but you cannot automate something you have not understood. We start by capturing current state as documentation, then rebuild one representative host from code and compare the two before touching the rest.
Does configuration management still matter with containers?
Yes, for everything outside the container. Container hosts, build agents, databases, network appliances and the hardening of the node itself all still need managed configuration. If your whole estate is Kubernetes, you likely need less of it, not none.
How do you avoid breaking production with a bad run?
Changes go through a staging host first and reach production one group at a time. Every role is safe to re-run, and we keep a documented rollback for the tasks that cannot simply be reversed, such as package upgrades.
Infrastructure & Cloud
Often needed alongside this
Infrastructure & Cloud
Infrastructure as Code
Your entire cloud estate described in version control — reviewable, reproducible and rebuildable from scratch.
- Terraform, OpenTofu, Pulumi & CloudFormation
- Remote state, workspaces and modular reusability
- Drift detection and policy-checked pull requests
Security & Compliance
Vulnerability & Patch Management
A patch cadence you can actually keep, driven by real exposure data rather than raw CVE counts.
- Automated OS, runtime and dependency patching
- Risk-based prioritisation by exploitability
- Rolling patching with zero-downtime drains
Security & Compliance
Compliance Readiness
Continuous evidence collection instead of a quarterly fire drill — audit trails generated by your pipeline.
- SOC 2, ISO 27001, HIPAA and PCI DSS readiness
- Automated control evidence and reporting
- Change management and segregation-of-duties trails
Worth a conversation about Configuration Management?
Bring the specific problem. We will tell you honestly whether this is the service that fixes it, and what it would take.