October 2026 Serve The Product Page Outside The Application Runtime TenCtrl needed a public page on tenctrl.fr while the application, which holds Microsoft sessions, stays on a private development host. The application is a Next.js app, so a market...
architecturenginxstatic-site
Read decision
October 2026 Keep Microsoft Tokens On The Server TenCtrl reads Microsoft 365 data on behalf of a signed-in technician. Access and refresh tokens for Microsoft Graph grant read access to a tenant's user directory, so where they li...
securitymicrosoft-graphoauth
Read decision
October 2026 Strip OAuth And Search Query Strings From Access Logs The default nginx access log records full request URLs and referrers. On TenCtrl, those URLs include the OAuth callback, whose query string carries a one-time authorization code an...
securitynginxprivacy
Read decision
September 2026 Prefer Bare-Metal Lab Compute For Windows Lab V1 Windows Lab V1 needs a domain controller, a Windows workstation, private administration, snapshots and repeatable rebuilds. The current public host is already ruled out for Windows...
labvirtualizationprivate-access
Read decision
September 2026 Publish Evidence, Keep Administration Private ABD Labs needs a public portfolio, but the Microsoft Enterprise Lab will contain administration paths and intentionally broken configurations during learning and incident scenarios...
securityportfoliolab
Read decision
September 2026 Use Astro Static Output For ABD Labs ABD Labs needed to move beyond a hand-written marker page while keeping the public site easy to version, build and serve from nginx.
astrostatic-siteportfolio
Read decision
September 2026 Start Lab V1 Lite Before Windows Compute The current public host can publish documentation and automation evidence, but it cannot safely host the Windows VM lab because nested KVM is unavailable and resources are limited.
labplanningportfolio
Read decision
September 2026 Keep Windows Lab Compute Separate From The Public Host The current public host serves public services and does not expose nested virtualization. The Microsoft Enterprise Lab needs Windows VMs, snapshots and private networking.
labvirtualizationisolation
Read decision