[All posts](https://zsoftly.ca/blog)
Blog

# Engineering

Architecture decisions, performance, and how we build ZCP.

Engineering

March 3, 2026

### [Running Your VPN Gateway Inside the Thing It Protects Is a Bad Idea](https://zsoftly.ca/blog/ops-02-subnet-router-migration)

We ran our Tailscale subnet router as an LXC container on the same Proxmox host it was providing remote access to. It worked. Until Proxmox needed attention. Here is how we fixed it.

Engineering

January 29, 2026

### [Building Private Cloud Infrastructure with Apache CloudStack - Architecture and Design Decisions](https://zsoftly.ca/blog/private-cloud-architecture-cloudstack)

Why private cloud matters for Canadian businesses, how CloudStack provides enterprise IaaS capabilities, and the key architectural decisions for deploying production-ready private cloud infrastructure.

Engineering

January 22, 2026

### [How We Cut EKS Costs 62% by Rethinking Node Architecture](https://zsoftly.ca/blog/eks-node-consolidation-platform-nodepool-karpenter)

Our sandbox cluster ran 8 EC2 instances 24/7 costing $260/month. Most were idle overnight. By separating platform services from time-based workloads and recognizing CI/CD managers as 24/7 services, we consolidated to 3 nodes saving $160/month while improving reliability.

Engineering

January 18, 2026

### [How We Consolidated 4 PostgreSQL Clusters into 1 with CloudNativePG](https://zsoftly.ca/blog/postgresql-consolidation-cloudnativepg-kubernetes)

We ran 4 separate PostgreSQL clusters for 91MB of data. Each cluster had its own PodDisruptionBudget blocking node drains. This guide shows how we consolidated them into a single HA cluster with PgBouncer connection pooling using CloudNativePG and ArgoCD.

Engineering

November 24, 2025

### [How We Eliminated 23 Bastion Hosts with JumpCloud and AWS SSM](https://zsoftly.ca/blog/how-we-eliminated-bastion-hosts-jumpcloud-ssm)

How we replaced legacy bastion host architecture with Zero Trust access. We cut infrastructure costs, eliminated SSH key sprawl, and passed SOC 2 with significantly fewer findings.

Engineering

November 21, 2025

### [Beyond GitHub Actions Quota Limits: Building Production-Grade CI/CD Artifact Storage](https://zsoftly.ca/blog/how-we-eliminated-cicd-downtime-cloudflare-r2)

When GitHub Actions quota limits halted a startup's entire deployment pipeline for 24 hours, we helped them build a strategic solution. Learn the decision framework for evaluating artifact storage, why most teams make the wrong architectural choices, and how to build CI/CD infrastructure that scales with your business.