# Sawczuk Consulting

> Cloud infrastructure engineering for enterprise scale — Kubernetes, GitOps, and platform architecture.

Author: Przemysław Sawczuk — independent DevOps and platform engineering consultant.
Contact: hello@sawczuk.dev
Expertise: Kubernetes cluster optimization, cloud-agnostic architecture using open-source tooling (Terraform, Crossplane), and GitOps pipeline automation with ArgoCD.

## Pages

- [Home](https://sawczuk.dev/): Cloud infrastructure engineering for enterprise scale
- [Consulting](https://sawczuk.dev/consulting/): Consulting services and engagement options
- [Technical Insights](https://sawczuk.dev/insights/): Blog directory — DevOps, Kubernetes, architecture, infrastructure
- [Contact](https://sawczuk.dev/contact/): Start an engagement

## Polish Pages

The marketing pages are also published in Polish under /pl/. The blog is English-only.

- [Strona główna](https://sawczuk.dev/pl/): Inżynieria infrastruktury chmurowej
- [Konsulting](https://sawczuk.dev/pl/consulting/): Usługi konsultingowe i modele współpracy
- [Kontakt](https://sawczuk.dev/pl/contact/): Rozpocznij współpracę
- [Polityka prywatności](https://sawczuk.dev/pl/privacy/): Polityka prywatności

## Blog Posts

- [Washed-Out Black: Why Windows Prints Worse Than Linux to the Same CUPS Queue](https://sawczuk.dev/insights/windows-cups-postscript-washed-out-text/) — 2026-08-06 — Homelab, Networking: Black text printed from Windows came out as thin grey dots. The same CUPS queue was perfect from Linux and macOS. The culprit was the Microsoft IPP Class Driver rasterizing the page before it ever left the PC.
- [The Printer That Swallows Jobs: HP P1005 Firmware Reload in an Unprivileged LXC](https://sawczuk.dev/insights/hp-p1005-cups-firmware-reload-lxc/) — 2026-08-06 — Homelab, Linux: CUPS reported every job as completed and the HP LaserJet P1005 printed nothing. The cause was a firmware blob that never got pushed, because udev doesn't run inside an unprivileged LXC container.
- [When Your k3s Cluster Goes NotReady Because the Clock is Too Fast](https://sawczuk.dev/insights/k3s-clock-drift-tls-certificate-failure/) — 2026-05-19 — Kubernetes, Homelab: My k3s master node went NotReady because system clock drift caused TLS certificates to appear from the future.
- [Running Gitea with act_runner for Fully Local CI/CD](https://sawczuk.dev/insights/running-gitea-with-act-runner-fully-local-cicd/) — 2026-03-31 — CI/CD, Homelab: I moved all my server and private configs to a self-hosted Gitea instance with act_runner, keeping everything local and away from external CI providers.
- [Full HTTP Request/Response Logging in Istio with Envoy Lua Filters](https://sawczuk.dev/insights/istio-envoy-lua-http-full-logging/) — 2025-10-28 — Kubernetes, Observability: Envoy sidecars in Istio don't log request/response bodies by default. Here's how to solve it with Lua filters and structured JSON logging.
- [When Bitnami Changed Their Docker Repository: A Vendor Lock-In Postmortem](https://sawczuk.dev/insights/bitnami-docker-repository-change-vendor-lock/) — 2025-10-25 — Containers, Kubernetes: When Bitnami moved their Docker images to a legacy namespace and deprecated most versions, thousands of deployments broke overnight. Here's what happened and what it teaches about vendor dependency management.
- [Production-Ready Terragrunt: tfEnv, SOPS, TFLint, and Pre-Commit Hooks](https://sawczuk.dev/insights/production-ready-terragrunt-terraform/) — 2024-08-04 — Terraform, IaC: Structuring a Terragrunt repository for production IaC — tfenv version pinning, SOPS secrets management, TFLint validation, and pre-commit hooks for code quality.
- [Homelab Infrastructure as Code: Pi-hole + DNS + VPN on k3s](https://sawczuk.dev/insights/building-rpi-from-the-scratch/) — 2022-01-28 — Homelab, Kubernetes: Rebuilding a homelab ad-blocker from scratch with Pi-hole, Unbound DNS, and WireGuard VPN — all managed with k3s manifests and Git, because even homelabs deserve GitOps.
- [CloudMapper: Mapping AWS Resources and Finding Security Gaps](https://sawczuk.dev/insights/cloudmapper-aws-security-audit/) — 2022-01-28 — AWS, Security: Using CloudMapper to inventory your AWS environment, visualize resource relationships, and generate security vulnerability reports — in under 10 minutes.
- [Git-Crypt: Encrypting Sensitive Files in Git Without a Separate Secrets Store](https://sawczuk.dev/insights/git-crypt-sensitive-files-in-git/) — 2021-12-20 — Security, Git: Using git-crypt to encrypt credentials, keys, and config files directly in a Git repository — without splitting them into a separate secrets manager.
- [GitHub Actions: Using Official Template Actions for Reliable Pipelines](https://sawczuk.dev/insights/github-actions-template-actions-reliable-pipelines/) — 2021-12-09 — CI/CD, Automation: Using official GitHub Actions template actions instead of raw shell steps — node-version pinning, caching, and why this prevents pipeline failures on cloud image updates.
- [Multi-Site WordPress on Docker: Reverse Proxy, SSL, and Containerized PHP](https://sawczuk.dev/insights/multi-site-wordpress-docker-reverse-proxy-ssl/) — 2021-11-21 — Containers, Linux: Running multiple WordPress sites with different PHP versions on a single Docker host — using nginx-proxy with Let's Encrypt and automated SSL.
- [Standardizing Code Quality Across Teams with Pre-Commit CI](https://sawczuk.dev/insights/format-the-code-automatically-before-commit/) — 2021-09-24 — CI/CD, Git: Git hooks that enforce formatting, linting, and testing before code reaches CI — eliminating noise in pipelines and establishing a shared quality bar across teams.
- [Syncing Bitbucket to AWS CodeCommit via Pipeline: Full SSH Setup](https://sawczuk.dev/insights/bitbucket-codecommit-pipeline-sync-ssh/) — 2021-08-01 — AWS, CI/CD: Setting up a Bitbucket pipeline that pushes changes to AWS CodeCommit on every commit — without third-party integrations or additional authentication apps.
- [Kubernetes RBAC: Granting Read-Only Developer Access via ServiceAccount Tokens](https://sawczuk.dev/insights/kubernetes-rbac-read-only-access-tokens/) — 2021-08-01 — Kubernetes, Security: How to give developers read-only access to a running k8s cluster — ServiceAccount, ClusterRole, RoleBinding, and a ready-to-use kubeconfig generator script.
- [GitFlow & Semantic Versioning: A Release Engineering Framework](https://sawczuk.dev/insights/gitflow-semantic-versioning-release-engineering/) — 2021-07-01 — Git, CI/CD: GitFlow branching model combined with automated semantic versioning — how to structure releases, manage hotfixes, and keep the changelog honest.
- [Git Merging Strategies for GitOps-Ready Repositories](https://sawczuk.dev/insights/git-merging-strategies/) — 2021-06-30 — Git, CI/CD: Three git merge strategies and when to use each — with focus on how they impact GitOps workflows, CI/CD traceability, and repository cleanliness.
- [Secure Ephemeral File Transfer in CI/CD Pipelines](https://sawczuk.dev/insights/easy-and-fast-file-sharing-from-the-command-line/) — 2021-04-17 — CI/CD, Linux: Using ephemeral, encrypted file sharing in CI/CD pipelines for secure artifact distribution, third-party API responses, and build log uploads — without permanent hosting.
- [Inspect Any Docker Container's Original Run Command with runlike](https://sawczuk.dev/insights/inspect-docker-container-run-command-runlike/) — 2021-04-17 — Containers, Linux: Using runlike to reconstruct the docker run command from any running container — essential for debugging deployment drift and documenting how services were actually launched.
- [Message Queues in Production: Patterns for Reliable Pipelines](https://sawczuk.dev/insights/queuing-jobs-is-easier-than-you-think/) — 2020-12-10 — Architecture, CI/CD: Task queuing isn't just for backend developers — it's the backbone of resilient CI/CD pipelines, webhook processing, and event-driven infrastructure. Here's how to think about it operationally.
- [Docker in Production: A Cross-Team Reliability Pattern](https://sawczuk.dev/insights/docker-in-production-cross-team-reliability/) — 2020-11-24 — Containers, Architecture: Docker isn't just a dev convenience — it's a production reliability pattern that gives Dev, DevOps, and Ops teams a shared contract for how software is built, shipped, and operated.
- [Teaching Infrastructure Thinking Through Production-Ready Bots](https://sawczuk.dev/insights/learning-programming-not-always-have-to-be-boring/) — 2020-11-09 — Containers, Career: How I teach junior developers to think in infrastructure — by building chatbots that eventually run on Docker, get deployed to a VPS, and integrate with message queues like RabbitMQ.
- [Automating Proxy Deployments with Bash and Ansible](https://sawczuk.dev/insights/magic-of-whiptail-squid-proxy-instalation/) — 2020-11-04 — Automation, Linux: Building a bash-based Squid proxy installer with interactive whiptail dialogs, then re-deploying it reliably with Ansible — a pattern for turning one-off scripts into reproducible infrastructure.
- [Self-Hosted VPN: WireGuard on a $5 VPS for Privacy and Remote Access](https://sawczuk.dev/insights/self-hosted-wireguard-vpn-5usd-vps/) — 2020-11-01 — Networking, Linux: Setting up a personal WireGuard VPN on a cheap VPS — bypassing regional locks, avoiding commercial VPN subscriptions, and owning your network infrastructure.
- [Pypyr: YAML Pipeline Automation for Complex CI/CD Workflows](https://sawczuk.dev/insights/pypyr-yaml-pipeline-automation-cicd/) — 2020-11-01 — CI/CD, Automation: Pypyr is a task runner that fills the gaps in cloud CI/CD — handling error conditions, API calls, and parallel execution better than Makefile or plain bash scripts.
- [Cloud-Native Media Server: rclone + Jellyfin on a Budget VPS](https://sawczuk.dev/insights/cloud-native-media-server-rclone-jellyfin/) — 2020-10-31 — Homelab, Linux: Building a private Netflix with 2TB of cloud storage — using rclone for encrypted mount, Jellyfin for media management, and a lightweight VPS for transcoding.
- [Your Old Raspberry Pi Is Still Useful: DNS + VPN in 20 Minutes](https://sawczuk.dev/insights/reboot-your-raspberry-pi/) — 2020-10-27 — Homelab, Networking: Setting up a home DNS sinkhole and WireGuard VPN on a Raspberry Pi — the two services that make every device on your network faster, safer, and accessible from anywhere.

## Topics

- [AWS](https://sawczuk.dev/insights/tag/aws/)
- [Architecture](https://sawczuk.dev/insights/tag/architecture/)
- [Automation](https://sawczuk.dev/insights/tag/automation/)
- [CI/CD](https://sawczuk.dev/insights/tag/cicd/)
- [Career](https://sawczuk.dev/insights/tag/career/)
- [Containers](https://sawczuk.dev/insights/tag/containers/)
- [Git](https://sawczuk.dev/insights/tag/git/)
- [Homelab](https://sawczuk.dev/insights/tag/homelab/)
- [IaC](https://sawczuk.dev/insights/tag/iac/)
- [Kubernetes](https://sawczuk.dev/insights/tag/kubernetes/)
- [Linux](https://sawczuk.dev/insights/tag/linux/)
- [Networking](https://sawczuk.dev/insights/tag/networking/)
- [Observability](https://sawczuk.dev/insights/tag/observability/)
- [Security](https://sawczuk.dev/insights/tag/security/)
- [Terraform](https://sawczuk.dev/insights/tag/terraform/)

## Optional

- [GitHub Profile](https://github.com/Qanop): Open-source work and consulting projects
- [LinkedIn](https://www.linkedin.com/in/psawczuk/): Professional profile
- [X](https://x.com/sawczuk_dev): Short-form updates
- [RSS Feed](https://sawczuk.dev/rss.xml): Subscribe to technical insights
- [Atom Feed](https://sawczuk.dev/atom.xml): Alternative feed format
- [Sitemap](https://sawczuk.dev/sitemap-index.xml): Full URL index