Briggs Bastian, Seattle, WA
Hi — I'm Briggs.
I started out triaging SIEM alerts on a SOC floor; now I run a company's security stack, and I still go home and attack my own network to prove the alerts fire. Systems that hold under pressure — that's the whole job. After hours it's Gesture, a 1v1 souls-like, and a modded Minecraft server for the friends.
Now · July 2026
- studying for AZ-104, AZ-305 behind it
- running All the Mons for the friends
- building Gesture, a 1v1 souls-like
- tending the garden in public
- years of 3 a.m. alerts
- 04+
- hosts, one flake
- 06
- public postmortems
- 04
- desktop 412
- mgmt 188
- media 203
- playground 97
- hacktop 154
- cloud1 9
NixOS is best for all use cases……
Now building
Selected work
Gesture
A deterministic 1v1 arena dueling prototype inspired by Dark Souls 3 combat. Godot 4, GDScript, fully data-driven, with the simulation built to go peer-to-peer later.
- Godot 4
- GDScript
- Data-driven
- Steam P2P (planned)
The Homelab
A UniFi network running a NixOS fleet from one flake: workstation, services host, media, a libvirt security lab, a staging/CI box that moonlights as a Minecraft server, and an off-site Linode node fronting it, all deployed with a single colmena apply. One Ubuntu NAS stays off NixOS on purpose.
- NixOS
- Colmena
- sops-nix
- Terraform
- libvirt
- UniFi
briggsbastian.com
This site, treated as a production system: Astro static build, Nix flake package, a gated CI pipeline on my own Forgejo, and a publish-on-green mirror feeding GitHub Pages.
- Astro
- Nix Flakes
- Forgejo Actions
- GitHub Pages
Operations
How I run things
Infrastructure as Code
I describe six NixOS hosts in one flake and deploy them with one colmena apply — because I never want to rebuild a box from memory again.
CI/CD & Release Engineering
I built the pipeline that gates this very page: typecheck, secret scan, Nix build. Nothing I push goes public unless every check is green.
Cloud
I stood my Linode node up with Terraform, tore it down when it was idle, and rebuilt it from code the day a game server needed a public front door. Next I want Azure at architect depth — AZ-104 under study, AZ-305 behind it.
Secrets & Trust
I keyed every host’s secrets to its own SSH identity, run a private CA that issues real certs to my internal services, and gave my deploy user just enough power to ship a build — never a root shell.
Observability
I tune a SIEM at work; at home I replaced Wazuh with a Loki/Alloy stack so my alert rules live in git next to the hosts they watch. An alert I can’t act on is noise.
Security Engineering
I attack my own network from a Kali box to prove the detections fire — and when the “compromised” host needs cleanup, my recovery is a rebuild.
Networking
I’m the overall network guy: UniFi with VLAN segmentation across trusted, IoT, and guest at home, plus nftables host firewalls. At work, the same on Cisco, Meraki, SonicWall, Fortinet, and pfSense.
Declarative Recovery
Every host I run is a generation I can roll back to. I have torn machines down on purpose just to watch them come back identical.
Thought garden
Recently tended
The cloud box is a bouncer, not a server
How I published a Minecraft server from my LAN with zero open home ports: a $5 Linode as the public face, and a WireGuard tunnel my side dials out.
- networking
- security
- homelab
A SIEM that lives in the config?
I moved the homelab off Wazuh onto a declarative Loki/Alloy stack, and I honestly do not know yet whether it was the right call.
- nixos
- security
- observability
Does declarative config actually replace an RMM?
RMMs are necessary for managing a fleet, and I am not convinced the declarative-everything story really replaces one. Where Colmena ends and an RMM begins.
- nixos
- homelab