Case study · Platform & infrastructure

A company's entire technology stack, built by one engineer

Identity, networking, delivery pipelines, monitoring and a lab ERP for a geotechnical and materials-testing company, designed and run end to end by its sole engineer.

Role
CTO / IT Director, NS Engineering
Period
Nov 2025 – present

The problem

A growing engineering company needed the technology backbone of a much larger organisation: one identity for every employee and system, separate development, staging and production environments, reliable deployments, and software for a testing laboratory working to ISO/IEC 17025.

It had one engineer to build and operate all of it. So the design had to keep the ongoing operating load low.

Approach

Identity first

A single directory (Active Directory) federated into Keycloak over LDAPS gives every application single sign-on from one source of truth. Collaboration tools, the ERP and internal services all authenticate against it, so joining or leaving the company is one change, not many.

Isolated environments on a private network

Development, staging and production run on separate hosts connected by a WireGuard mesh. The environments are designed so that a test run or a restored backup can never write to production identity data.

Everything deployed by CI

A previously manual, SSH-driven setup moved to GitHub Actions pipelines with secrets rotation, linting of the pipelines themselves, and production deploys gated behind their own environment.

Durable by design

HR-facing account changes go through a queue-backed provisioning service (FastAPI + RQ), so an outage in a downstream system delays a change instead of losing it. Prometheus and Grafana monitor the identity and application stack.

Lab software that meets a standard

A Frappe/ERPNext-based lab and operations system covers the testing workflow, with compliance data migrated for ISO/IEC 17025 (equipment, personnel authorisation, historical certification records), an organisation-wide OKR system, and a Playwright end-to-end test suite.

AI-assisted engineering as the default

The whole stack is built and maintained with an AI-assisted, agentic workflow. That is what makes one person able to cover this much surface, with tests and live verification as the check on its output.

What was hard

One source of truth for identity

Every new system wants its own user list. Integrating each application with the one directory, rather than giving it a separate set of accounts, is more work up front for every system added.

Green checks are not the same as working

With no second engineer to catch problems, the discipline that mattered most was verifying behaviour live (killing a dependency mid-operation to confirm recovery, for example) instead of trusting a successful deploy.

Scope versus capacity

Self-hosting keeps the company's data in the company, but every service is also something to patch, monitor and back up, by the same one person.

Result

  • One identity across the company, with single sign-on to its systems.
  • Separate, isolated development, staging and production environments.
  • Deployments that go through CI instead of manual SSH, with production gated.
  • Monitoring across the identity and application stack.
  • Laboratory workflows and compliance records digitised for ISO/IEC 17025.

Honest limits

  • A one-engineer platform has a bus factor of one. Documentation, runbooks and CI reduce that risk but do not remove it.
  • This page describes the systems' scope and design only; operational details stay private to the company.

More: all case studies · get in touch