Home on Nugroho Satrijandi

The Cost of Not Running Experiments

Wed, 15 Jul 2026 00:00:00 +0000

A bank’s costliest decisions rarely look costly on the day they’re made. They look obvious.

Picture the chart everyone nods at. Customers who get a payment reminder three days before the due date miss fewer payments. The gap is huge, the line is clean, and the room agrees in under a minute: send the reminder to everyone.

The chart is real. The correlation is real. The conclusion is almost certainly wrong. Customers who opt into reminders, or who happen to be reachable three days out, are already more organized, more liquid, and more likely to pay on time no matter what you do. The reminder didn’t cause the good behavior; they share a common cause. Roll it out to everyone and you may spend real money moving nothing, while congratulating yourself on a number that was always going to be there.

A Recovery-First Kubernetes Homelab

Sat, 11 Jul 2026 00:00:00 +0000

This site is served by the project it describes: a single-machine Kubernetes homelab built the way I’d build production. The goal was never to run the most services — it was to run a small number of services on a foundation that is declarative, recoverable, and secure by default. Everything below is the design; nothing here is a secret, a credential, an address, or anything an attacker could use.

Principles

Declarative over imperative. Every change is a file describing desired state, applied idempotently. Running it twice equals running it once.
Git is the source of truth; the runtime is a cache. If a change isn’t in Git, it didn’t happen — and reconciliation will undo it.
Recovery-first. Anything required to rebuild the cluster lives outside the cluster and outside the machine. I designed the restore path before deploying workloads.
Immutable artifacts. Container images are pinned by digest; chart and package versions are pinned. No floating latest.
Least privilege & secure by default. Workloads run non-root under a restricted Pod Security baseline; the network defaults to deny; only one service is exposed to the public internet (this blog).

The stack

Layer	Choice
Substrate	ARM64 Linux on Apple Silicon, single-node k3s
Networking	Cilium (kube-proxy replacement) + Kubernetes Gateway API
Public ingress	Cloudflare Tunnel (no open inbound ports)
Private access	Tailscale (everything internal is tailnet-only)
GitOps	Argo CD (app-of-apps, environment overlays)
Internal Git	Gitea on CloudNativePG, push-mirrored to an off-host mirror
Secrets	SOPS + age for bootstrap, External Secrets beyond
Identity	Kanidm as the OIDC provider
Policy	Kyverno + a restricted Pod Security floor, enforced at admission
Observability	Prometheus, Alertmanager, Grafana, Hubble + an external dead-man’s switch
Storage & backup	Local persistent volumes, Velero, app-native encrypted off-host backups
Supply chain	Woodpecker CI + rootless BuildKit + Zot, signed with cosign, scanned with Trivy, SBOM-attested, verified at admission
DNS as code	external-dns reconciling records from cluster objects

How it fits together

Substrate. A single ARM64 Linux machine runs k3s with flannel and kube-proxy disabled, secrets encryption on, and an audit policy that never logs secret bodies. Keeping the substrate portable (it can be re-created on another ARM64 hypervisor) is part of the recovery story.

Git Is the Source of Truth; the Runtime Is a Cache

Wed, 24 Jun 2026 00:00:00 +0000

There’s a mental shift that, once it clicks, changes how you operate everything: the running system is not the source of truth. Git is. The cluster, the warehouse, the environment — they’re caches. A projection of a versioned, reviewed history that a reconciliation loop keeps in sync.

Why it matters

When the runtime is authoritative, every fix is a one-off. Someone SSHes in, edits a file, restarts a service — and now reality has drifted from any record of intent. The next person can’t tell what’s deliberate and what’s an accident.

Recovery-First: Design the Restore Before the Deploy

Sat, 20 Jun 2026 00:00:00 +0000

Most infrastructure is designed forward: stand up the cluster, deploy the apps, and then — maybe — bolt on backups. I’ve come to think that’s backwards. The most honest test of an architecture is whether you can rebuild it from nothing but a Git history and an off-host backup. If you design the restore path first, everything else gets healthier almost by accident.

What “recovery-first” forces you to do

When the restore is the requirement, a few rules stop being optional:

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m a Head of Data specializing in MLOps, driving end-to-end ML pipeline development and implementation. I bridge data science innovation with production systems — collaborating across teams to deliver streamlined solutions that align with business goals while staying current with emerging AI technologies.

Across nearly a decade I’ve built and led data science teams in fintech and ride-hailing, shipping the models that underwrite credit, catch fraud, retain customers, and drive growth — together with the feature platforms, serving, and monitoring that keep them dependable in production.