Hybrid Networking

The problem this solves

"Our connectivity grew one VPN tunnel and one peering at a time. Now routing is a mystery, DNS resolves differently depending on where you are, and the whole thing is one flat blast radius. When something breaks, only one person can debug it — and we can't reproduce any of it." Root cause: organically-grown connectivity with no central routing/DNS/segmentation design produces undocumented paths, overlapping CIDRs, and flat trust between environments; none of it is in code, so it can't be reasoned about or rebuilt.

What you own when we leave

• Terraform/IaC for the connectivity fabric in scope (transit/hub routing, VPN/Direct Connect/interconnect, peering, route tables).
• A unified DNS and resolution design (consistent name resolution across on-prem and clouds), as code.
• A segmentation model that bounds blast radius between environments and tiers, enforced and documented.
• Clear network diagrams generated from / kept in sync with the actual IaC — not a one-off Visio.
• Runbooks for adding a site/VPC/cloud, and a documented IP/CIDR plan.
• ADRs for the routing and segmentation decisions.

Not a network assessment report. A network you can reproduce from code and extend safely.

How we approach it

1. 01

   Discovery

   We read your accounts, configs, and constraints directly (scoped read-only access or exported state), map the real current state, and agree on a written scope and success criteria before any code is written.

2. 02

   Architecture Decision Records

   We write down the key decisions — what we’re doing, the options we rejected, and why — as ADRs in your repo, so the reasoning survives long after we’re gone and you can challenge it before we build.

3. 03

   Implementation

   We build the solution as reviewable Terraform/IaC in small, tested pull requests against your CI, so you watch it land incrementally and nothing arrives as a black box.

4. 04

   Handover

   We walk your team through the repo, the threat model, and the runbooks live, confirm you can apply/destroy/extend it yourselves, and then we leave. You own everything — there is no phase 5 where you still need us.

Engagement shape

A fixed-scope build/redesign over a defined set of sites, clouds, and connections — delivered as Terraform with a tested routing/DNS/segmentation design and a live handover. Scope is set by the number of environments and connections in play, agreed in writing first.

Engagements typically start at $30,000 USD. Contact for scope and a fixed price.

A sample of what we ship

# network/transit.tf — hub: explicit routing, no flat mesh
resource "aws_ec2_transit_gateway" "hub" {
  description = "on-prem + cloud hub"

  # No implicit any-to-any: every attachment is associated and
  # propagated deliberately, per environment.
  default_route_table_association = "disable"
  default_route_table_propagation = "disable"
}

# Prod and non-prod live in separate route tables: non-prod reaches
# shared services and on-prem, never prod.
resource "aws_ec2_transit_gateway_route_table" "env" {
  for_each           = toset(["prod", "nonprod", "shared"])
  transit_gateway_id = aws_ec2_transit_gateway.hub.id
  tags               = { Name = "rt-${each.key}" }
}