A school’s IT

Since July 2026, the TousDys association, which runs the Edeys school in Le Haillan, has entrusted me with its IT. It is the IT of a whole school that I design, deliver and operate: the team’s storage and online office tools, the directory and authentication, backups, and the pupils’ workstations in the classroom.

The cloud runs on a Hetzner machine described in OpenTofu. OpenCloud handles files, calendars and contacts there, Keycloak on top of an LDAP directory handles authentication, and Collabora opens documents in the browser. The accounts and contents of the old platform were migrated there and then checked by fingerprint, during a four-day cutover in September 2026. An encrypted backup with BorgBackup goes out every night, and a file restored from the very first one matched the original byte for byte.

The state of the whole sits in a single register, validated YAML files from which the infrastructure map is generated by a program. An “in service” line must carry the date of its measurement and its author, and the check fails if the map diverges from the register. In class, a fleet of Ubuntu workstations is administered with Ansible and reconfigures itself three times a day, with protected pupil sessions, secrets encrypted with SOPS and a private Tailscale network.

The audit first showed that the existing hosting did not allow a restore to be tested, and a backup you cannot replay remains a hypothesis. That is why the platform was rebuilt in code rather than taken over as it was. The register answers another finding: the same fact had ended up living in six documents, and the infrastructure map contradicted itself. There is now only one place to read what is running.

The work is not finished. The school’s register notes what remains to do: a full restore of the machine and a second copy outside the provider.