Buy wildcard certificates from a vendor, install them everywhere you find you need them manually, don't write down where you put them or when they're going to e

Buy wildcard certificates from a vendor, install them everywhere you find you need them manually, don't write down where you put them or when they're going to expire. Cross your fingers the private key doesn't get leaked. Collect every metric possible and set up arbitrary blanket alerting thresholds and black-box anomaly detection and tune nothing ever. Now you can hire a whole team dedicated just to suffering from alert fatigue. Standardize on a single LTS OS release across all your infrastructure and wait until the absolute last possible second to start trying to switch to the new current LTS release, biting off about a decade of OS changes to everything everywhere all at once.