A slower boat

Tracing a very particular voyage

A cormorant glides past and settles on a port-side cardinal mark, where the Western Port channel starts. Water slaps gently against the hull of my father's boat as I reach for the laptop, running OpenCPN - great open source nautical chart software, by the way.

I curse under my breath as my e-reader slips off my lap, its screen showing a close up image of Jean Le Cam 's keen, inquisitive face - a Breton yachtsman and competitive sailor whose name is very well known, especially in the French sailing community. He's a cheeky devil, known to speaking bluntly, but always honestly. This book of his I'm reading is a delight - actually a sort of transcribed long-form series of interviews.

A point he keeps returning to is that he is not prone to nostalgia: he always looks ahead, to what's next. With a wry laugh, he also admits he is prone to making the same mistakes incessantly.

I wish I was one of those people who can just look ahead, but I'm quite nostalgic, and I often feel very viscerally shaped by the experiences or decisions that led me to the present moment. I look backward, inwardly, all the time. Not to wistfully wish for change, but to better understand why things happened the way they did.

It's a particular time at the moment in that regard - probably to a large degree because I have reached my early 40s. But especially professionally, I am thinking about where it all began for me, and what's coming next. So where did, in fact, 'mig5 system administration' start for me?

Golden years

In 2010, I was working at a web agency that was going through a dry spell. They wanted to save money by sacking my junior sysadmin. Angered by the idea of this solution, I argued that this junior was earning one of the lowest salaries at the org, but was doing a great job. If anyone ought to leave, it, in my opinion, should have been the director of New Business - because where was it? What was he doing while my junior continued to get his work done, meeting his own and my expectations?

Le Cam probably could not have been blunter. It went down about as well as you'd expect. After a few days of arguing and generally being a pain in my boss' backside, I negotiated myself to go down to three days a week, and my junior to four. Between the two of us, we reduced roughly the equivalent of his original wage, for the organisation to stay afloat.

On those two days off per week, I started taking sysadmin consulting work on the side. It took less than a year before I was reliably earning more money on those two days a week than I was at the 'day job'. By October 2011, freelancing became my whole living, and it stayed that way for a long time, almost by accident.

How did I find the work? Rather incredibly, it found me. From around 2009 I had become a core developer of Aegir , a site management and hosting system for Drupal, and somewhere along the way I found myself pioneering ideas that the wider industry had yet to name: using Aegir's clone features to move builds through dev, stage and production , and leaning on Drush Make to pin and reproduce an entire application from a manifest. Looking back, it was configuration management 'avant la lettre'. Puppet was still finding its feet. Ansible barely existed. Containers were a curiosity at best, and the cloud itself was only a couple of practical years old. Even Github was pretty new - I noticed the other day that I registered there in June 2009 (boy, it took me a while to get to grips with Git, coming from Subversion and CVS world!).

Because I was one of the louder evangelists for that automation workflow, work came to me easily. (I also don't think, at the younger age I was, how much being a 'white guy in tech' was already working in my favour.) I was promoting tech solutions through my website via Twitter (at a time when that corner of the internet was still fun). Agencies running Drupal and Magento needed someone who understood the whole lifecycle, and for the better part of a decade, from 2011 to 2020, that was my world. It would be dishonest if I claimed it never went to my head. It was a fine place to be: respected, in demand, and shaping how a small corner of the industry thought about deployments. People literally were writing about having 'fallen under my spell' .

Then the music stopped

There was a bill to pay for all that visibility, and I paid it in anxiety. The Drupal and Magento ecosystems went through some ugly security incidents in those years, and when you are the infrastructure person behind an agency, every emergency belongs to somebody else's client, and somehow still to you. Some difficult clients, difficult clients of clients, difficult clients of clients of clients. Problems that always seemed to beep the monitoring alarm on my phone the moment I stepped out the door with my wife on a Saturday morning. The endless chain of liability, one step removed from anything you control. I found myself lying awake doing arithmetic about risk that, in retrospect, was never really mine to carry.

Years of CBT helped, but only to a degree (honestly? Escitalopram has done more). I learned a lot, including that one of the reasons I probably do systems engineering is due to an attraction to being 'in control' as a means to overcome the anxiety. Unfortunately, it's also an oroborus, in that wielding a lot of power brings, as they say in the comics, great responsibility, and it can be a big weight on the shoulders when you are easily 'triggered' by certain conditions.

So during the COVID lockdowns I made a clean break. I stepped away from agency work entirely and went looking for organisations with a single mission I could believe in: civil society, human rights, privacy, public-interest technology. Places where the security of the systems genuinely matters because real people are affected by it. It suited me, and it still does. Strangely enough, nothing about these missions make them less stressful - in fact, many of them are even scarier than before! But I've somehow found a way to make it emotionally resonate with me at a level that cuts out that other type of fear that, even as I try to write this article, is tricky to put into words.

The switch away from my 'community' that was Drupal, had another cost though. I stopped speaking at (or even attending) conferences, stopped going to meetups, stopped writing and making videos. Perhaps COVID didn't help either, but I don't think it was much of that. I had been one of those people who explained or even introduced ideas to an industry before the word 'influencer' existed, and then I simply went quiet. I became something of a hermit, and I let my community ties lapse. In our line of work, that is close to vanishing.

What we do in the shadows

The strange thing about the hermit years is how much of value got built there. Post-Drupal, my work settled into infrastructure as code, automation, monitoring, effective incident response, security compliance, and the general craft the industry now calls DevSecOps. I learned an enormous amount.

I also did what I have always done, which is, 'build the tool I need' and release it. Enroll , which reverse-engineers existing production servers into honest, reproducible Ansible; more recently, others such as Heckle , which pulls a whole git forge into Terraform or OpenTofu (notice this trend of trying to get to 'being back in control'?); a decade of packaging SQLCipher for PHP .

I also became a core developer of OnionShare - that project, in particular led to a bunch of paid gigs still to this day, in the Tor/privacy/security space. For a time, I was the sysadmin of the onion services of Qubes OS ' package repositories through consulting to Whonix. Qubes remains my daily driver. The OnionShare opportunity has echoes of my 'Drupal journey', with word of mouth working to my advantage, but without quite the same level of visibility.

Open source gave me my career in the first place, and it has kept giving, even during the years I gave the least of myself back.

Let me digress!

Some of the work I am proudest of is still yet to be released, but is coming soon! Let me go on a brief and total tangent because I'm excited by it. Over the course of many ISO27001 audits, I gradually learned how auditors think, and became conscious of a frequent divide between 'on the ground operations' and what a compliance framework looks like on paper. Well-run orgs often tick most or even all of the boxes! but the order they go about it is frustrating for auditors, who think about risk and process information differently. This often leads to auditors asking absurd, often already-answered-but-in-a-different-way questions that lead to frustration back for those in the trenches too.

Tired of jumping in all directions to provide the evidence the auditor was seeking, I have built a compliance platform that does something the market largely skips: ingesting real raw data from logs and other sources, and automatically mapping those to relevant compliance framework controls and clauses (such as ISO27001:2022, Cyber Essentials, SOC-2 and so on) based on established pattern matching and rule definitions. Most compliance products ask you to fill in questionnaires about your controls. Mine starts at the other end. The auditor has an interface to 'snapshot' evidence, there is automatic data masking/redactions where necessary, and full ISMS and risk management tools. My ultimate goal: not needing the auditor to even ask me questions.

Several auditors have urged me not to open source that work, because they think it is a true 'competition killer' and one that should be locked away and monetised ASAP. Nothing could convince me better that making it FOSS is therefore the right move, and so it's going to be. I'm on the cusp of developing a free demo system for it. More on this to come soon!

Anyway, on to how things look for me in October 2026.

The ship that carried me

One client has been with me for fourteen of these nineteen years. That's a long time for a freelance contract. It has been quite a high stakes client with major security needs, and so working there has not been easy for me and my anxiety. But it has been, in financial terms, a keel: the steady weight under the waterline that keeps the whole boat upright. Recently, funding and cash-flow problems has made the organisation non-viable, and it is now winding up. There is no fault to assign. It is simply a ship that has reached the end of its voyage, and I am grateful beyond measure for how long it carried me.

It does mean a steep annual drop in funds for me. For the first time in my career I am out in the market looking for work, without the old privilege of it landing in my lap. That is a peculiar feeling at my stage of life. My ego was never enormous, but I would be pretending if I said I am indifferent to being respected. I am at the age where I still need to work, and recognition and reputation still matter in ways both practical and personal. The awkward truth is that my reputation faded, yet it was while my skills increased. The Drupal-era work that made me known has been largely forgotten, and the work that replaced it happened in private, away from the room where reputations are maintained.

I've started a Buy me a Coffee for those who might benefit from my open source, volunteer time and feel they can give back. Similarly, I set up the Github 'Sponsor' feature . But honestly? I don't expect to see anything there. Times are tough already for people.

Jean Le Cam's new boat

Jean Le Cam spent years racing the Vendée Globe in IMOCA vessels at the raw, punishing edge of offshore sailing, then grew disillusioned with what that kind of racing had become. For the upcoming Route du Rhum he has chosen a much slower, far more comfortable boat. He knows he is probably not going to win. He has done the hard yards, many times over, and now he wants to enjoy the sea again. It is a return to the roots of why he sails.

I read my own situation in that. The IMOCA years, the record-chasing, the solo punch-outs in the Southern Ocean: that was agency work at scale, security incidents at 3am, reputation maintenance, the tech talks. The slower boat is this: working with the organisations I believe in, building tools that solve real problems, and returning to something I have genuinely missed, which is helping shape best practices in the Dev, Sec and Ops space, in public, with the community I drifted away from. In particular, making it easier to demonstratably prove strong security safeguards in workflows and business processes, without just lip service.

I, too, would like the sailing to be good again.

Coming back into the room

This has been a proper ramble! What am I on about, anyway? I guess this essay is, in part, a reintroduction. I am Miguel Jacq. I have worked on production systems since 2007, consulted since 2011, and been fully remote from Melbourne for that whole time, carving out a niche working the 'night shift' for orgs mostly located in the US, the UK, and Europe. I help small and specialist teams, often with key missions that I personally happen to believe in, untangle poorly-managed Linux estates, automate change to reduce time without skimping on checks and balances, harden security all the way through the org's processes, keep monitoring useful without alert fatigue, and make recovery feasible.

I join teams that don't need a full-time sysadmin, or need mentoring of existing ones, and try to leave behind lasting changes, playbooks and documentation so the system stops depending on any one person's memory, mine included. For a number of years, I've specialised in demonstrating 'the art of the possible' for technical problems that, for any number of reasons, have felt 'too hard'.

I am once again enjoying the work for a multitude of reasons, be it my health and wellbeing, a certain middle-aged reflection, an accomplished skill set and wide range of experience. I am older, more pragmatic, and here to help. I don't need to be a 'thought leader', but I also don't want to be forgotten. It's a hard thing to write. Google 'Australian tall poppy syndrome', it maybe partly explains why. (I am also half Australian, half French, and the 'mixed identities/cultures' phemonenon is also a big area of interest and part of who defines me - perhaps a blog post for another time.)

If you knew my name from Aegir and my Drupal days, thank you for that era and helping me be successful. I hope I inspired you or helped you run your tools too. I would love to show you what I build now. More is coming soon. I am open to new engagements, and to collaboration on the open-source work, and to simply being part of the conversation again.

Le Cam will be racing in November for the love of the sea, on a boat that finally suits the man sailing it. Funnily enough, I got my own marine license just recently, following a trip to Saint-Pierre et Miquelon which helped reconnect me to the water and my ancestral roots. It's also why OpenCPN's on the laptop now. My Dad is still sailing, still has plenty to teach me in that regard. (He happens to also be a long-time Linux guy who also liked arguing with his boss. My sysadmin adventure really began with a stack of his O'Reilly books, at a time when there was no Stack Overflow, let alone AI.)

Le Cam has renovated his boat for comfort and for fun. In some ways, I've been doing the same with my business: in public, somewhat the way it used to look, but better, and for who I am now. The conditions are a bit dicey at the moment. Tech turbulence. But I'm out there, like the cormorant. Trying to be a lighthouse of logic, in the storm, for traffic seeking safe passage.