Cloud infrastructure by trade. Four companies under one holding group. And a camera running through all of it.
01 About me
Anurag BainsPortrait, 2026
I'm a cloud engineer by trade, a founder because I could not leave a problem alone, and a creator because I can't help documenting the whole thing while it happens.
The day job is infrastructure: cloud architecture, identity, and the automation that keeps a fleet of machines boring. Nine years of it, most of them spent on systems nobody ever noticed, which is exactly what you want from infrastructure.
The rest started with one frustration. The gap between creative, design, software and infrastructure teams is where good ideas quietly die: four vendors, four briefings, and every pair of them that has to agree on something is another thread you end up holding. So I founded Codex Corp and built four companies designed to hand work to each other, and I have been building, shipping and filming the mess ever since.
02 Three at once
People keep asking which one is the real job. All three are. They are the same instinct pointed at three different problems: understand the system, build the thing, then show your work.
Layer one
The trade. Cloud architecture, identity, and the automation that keeps a fleet of machines boring. Nine years of it, most of them spent on infrastructure nobody noticed, which is the point.
Layer two
Codex Corp, a Canadian holding company with four operating companies under it. Founded because the handover between creative, design, software and infrastructure is where good work quietly dies.
Layer three
The Bains Mode. Documenting the whole thing on camera, including the parts that did not work. Not a highlight reel and not advice: a record of what building this actually costs.
03 Projects
Products, the company sites I designed and shipped myself, and client work. Open any of them for the full story and a look around.
Product
A dream journal for Android, web and desktop. Capture on waking, sleep tracking, and a picture of what recurs.
Codex Labs’ first product, and the one I use to prove the pipeline works end to end. Voice capture on waking, because nobody types at three in the morning. Generated imagery for each entry through Cloudflare Workers AI. Sleep tracking, streaks, and a view of the symbols that keep coming back. It runs from one codebase on Android, on the web, and as a desktop build, with Supabase behind it and the whole delivery path automated. Built and running; the public launch is still ahead of it.
Client work
A realtor site led by commercial work, with a live listing feed pulled from the brokerage.
A RE/MAX realtor whose commercial work was buried under residential listings, so the site leads with commercial and lets residential follow. Dark by default, which is not where most realtor sites start. The listings are not screenshots: a Pages Function pulls the live office feed so the page is current without anyone maintaining it.
Client work
An educational browser game: fish a British Columbia lake against the clock, then name each catch native or invasive.
Built for the Invasive Species Council of British Columbia to sit inside their WordPress site. A round opens with a pledge, then gives you five minutes on a lake: land a fish, say whether it is native or invasive, and the game tells you what to do with it. A Species at Risk goes straight back into the water, and every catch is written into a log book. The species are data, built to be generated from the council’s own spreadsheet. Responsive and touch-first so it works on a phone at a public event, with audio and a tutorial that does not lecture. Finished and passing its quality gate; not published yet.
Infrastructure
Raised a fleet of 1,000+ nodes from a Secure Score of 52 to 90, cutting ransomware exposure by around 40%.
Secure Score is a blunt number, but it is the one an executive reads. Getting it from 52 to 90 meant enforcing Attack Surface Reduction rules and rolling Defender for Endpoint EDR across more than a thousand nodes without breaking the line-of-business software those nodes exist to run. The endpoint estate was aligned to ISO 27001 baselines at the same time: BitLocker, Secure Boot, and compliance policies that actually block rather than warn.
Infrastructure
Rebuilt device setup for 1,000+ Windows endpoints, taking provisioning from four hours to under 30 minutes.
Imaging a laptop by hand is four hours somebody is not doing their job. This replaced it with a user-driven Autopilot flow and an Enrollment Status Page profile, so a machine can be drop-shipped to a person and be ready in under half an hour. Behind it sits a five-ring Autopatch strategy holding 98% compliance on quality updates within seven days, and PowerShell that recovered 200+ endpoints which had fallen out of management entirely.
Infrastructure
Moved 100+ print queues into Azure Universal Print and retired the legacy print server estate.
Print is the least glamorous thing in an IT estate and one of the most expensive to keep limping. Migrating more than a hundred queues to Azure Universal Print through Azure connectors removed the dependency on the legacy print servers and their proprietary licensing, worth about $25,000 a year in operating cost, and moved queue management to the same console everything else is managed from.
Infrastructure
Architected a hub-and-spoke topology joining on-premises appliances to Azure over IKEv2 IPSec.
A hub-and-spoke topology integrating on-premises Cisco Meraki appliances with Azure VPN Gateways over IKEv2 IPSec tunnels, with routing tuned for under 20ms access to cross-tenant SQL instances. The same programme launched a new site end to end: Meraki MX84 firewalls and Ubiquiti CloudKeys, full layer two and three configuration in-house, 99.9% uptime, and roughly $15,000 of managed-service labour avoided.
Infrastructure
Automated the joiner, mover and leaver lifecycle so a new hire has the right access on day one and a leaver has none.
Joiner, mover and leaver done by hand is where access quietly accumulates: people keep permissions from roles they left years ago, and nobody notices until an audit. Automated JML workflows in PowerShell and Power Automate now provision and de-provision across Entra ID, Active Directory and Okta, cutting manual intervention by 40% while giving new staff day-one access. A centralised identity store governs the accounts, dormant ones are decommissioned rather than left, and group ownership has clear boundaries.
Infrastructure
Moved 1,000+ endpoints from standalone SCCM into Intune co-management, in waves, with no reimage.
Standalone SCCM works until the fleet stops being in one building. Moving more than a thousand endpoints into Intune co-management was done in waves, with workloads shifted one at a time so a rollback was always a switch rather than a rebuild, and without reimaging a single machine. Alongside it, a PowerShell packaging factory automated wrapping and detection logic for more than fifty complex applications.
Infrastructure
Planned and ran an enterprise-wide Windows 11 deployment on one standardised image.
An operating system upgrade is only partly a technical problem. The build was one standardised image driven by SCCM task sequences, with driver and application packaging automated through the PSAppDeploy Toolkit so that the thousandth machine came out the same as the first. Doing the packaging properly is what makes the rollout boring, and boring is the goal: nobody should be able to tell which wave they were in.
Infrastructure
Upgraded the domain controllers to Server 2022 and audited over 500 Group Policy Objects down to a consolidated set.
On-premises directories accumulate. Domain controllers were brought from Windows Server 2016 to 2022, and more than five hundred Group Policy Objects were audited and consolidated, which is mostly the unglamorous work of finding out what each one was for and who still needs it. The Entra Connect sync topology was strengthened at the same time, because a directory that is current on one side and stale on the other is worse than either.
Infrastructure
Consolidated several separately managed Active Directory domains into a single unified forest.
Several domains, each managed by different people to different standards, is several sets of assumptions about who should have access to what. Consolidating them into one forest meant a migration plan written before anything moved, trust relationships configured deliberately rather than inherited, and role-based access controls applied on the way in so the new forest did not start life carrying the old one’s exceptions.
Infrastructure
One patching framework across Windows and macOS, reaching 100% compliance within 30 days.
Two operating systems patched by two different processes means two different answers to the question of whether the fleet is current, and the honest answer is usually neither. A single centralised framework across SCCM and Intune covers Windows and macOS together, reaching full compliance within thirty days. The number that matters is not the peak but the fact that it is measured the same way on both platforms.
Infrastructure
Disaster recovery for the identity estate itself, with a recovery time objective under four hours for Tier-0 assets.
Most disaster recovery plans assume the directory is there to authenticate against. If the domain controllers and the Entra Connect servers are the thing that is gone, everything downstream is unreachable no matter how well it was backed up. This planned for that case specifically: a recovery time objective of under four hours for Tier-0 assets, automated backup, and rehearsed rapid-restore procedures so the global identity store survives ransomware or a catastrophic failure rather than being restored from a document nobody has tested.
Company site
The holding company. One point of entry for four operating companies, with every service floor published.
The holding company site, and the argument the whole group rests on: one entry point, four operating companies, and a starting price published for every service line rather than hidden behind a form. Static HTML on Cloudflare Pages, deployed from the same monorepo and the same workflow as the other four.
Company site
The production house. Photography, cinematic video and certified aerial work.
The production company: photography, cinematic video, and certified aerial work. The site has to carry image quality without carrying image weight, which is most of the engineering in it.
Company site
The design company. Brand identity, marketing creative, product interface and motion as one system.
The design company, where brand identity, marketing creative, product interface and motion are treated as one system rather than four contracts. The site is the argument for that, so it has to hold together as one thing.
Company site
The software company. Web and mobile applications, platforms, APIs and games.
The software company: web and mobile applications, platforms, APIs and games. It is the one that ships products rather than engagements, which is why Dream Codex lives under it.
Company site
The infrastructure company. IT, cloud architecture, delivery pipelines, security posture and AI.
The infrastructure company, and the one closest to the day job: IT, cloud architecture, delivery pipelines, security posture and AI. Most of the infrastructure work in this catalogue is its portfolio as much as mine.
04 The journey
Nine years, eight stops. Pick any one of them to see what the job actually involved.
Active Directory, Azure AD Connect, Windows Server, VPN
Office 365, Exchange, Azure AD, MFA
VMware, Active Directory, Exchange Online
Azure, Active Directory, ISO 27001, GDPR
SCCM, Palo Alto, Zero Trust, PKI
Intune, Entra ID, Atera RMM, Zero Trust
Azure, Intune / Autopilot, Entra ID, Defender EDR
Studios, Digital, Labs, Systems
05 The trade
Until it is gone. Nine years across eight domains, taken straight from the CV and listed plainly, because a capability list should be checkable rather than impressive. The bars are simply how many named capabilities sit in each domain.
Cloud platforms
9
Cybersecurity
14
Identity and access
14
Networking
12
Endpoint and IT management
16
Scripting and analysis
8
Backup and recovery
6
Virtualisation
8
06 Codex Corp
A Canadian holding company, founded 2025. Four specialists that each do one thing properly, set up so the handover between them is decided before it reaches the client rather than after.
Photography, cinematic video and certified aerial work.
Visit ↗ 02Brand identity, marketing creative, product interface and motion.
Visit ↗ 03Software and products. Web and mobile applications, platforms, APIs.
Visit ↗ 04IT, cloud architecture, delivery pipelines, security posture and AI.
Visit ↗07 The Bains Mode
Most of what gets filmed about building companies is the announcement. I'm more interested in the eleven months before it, which is where the actual decisions are.
The Bains Mode is where the companies, the career and the mistakes get documented as they happen. No script, no course at the end of it, and nothing edited to look easier than it was.
08 Off the clock
The camera goes everywhere. It started as work and stayed as habit.
The one thing that cannot be automated, delegated or faked.
Systems designed to be understood. I maintain this counts as research.
A new city resets how you look at the problem you left at home.
Engineering meets design and nothing about it makes financial sense.
A different playlist for every kind of task. The wrong one and nothing ships.
09 How I work
If it only works while you are watching it, you have not finished. The measure is whether someone else can run it without calling you.
Documentation written afterwards is fiction. Written during, it is the only reason the same problem does not cost twice.
Knowing one layer deeply and the rest by rumour is how teams end up blaming each other. Learn the layer you are about to hand off to.
Work kept private stays comfortable and stops improving. Publishing it is what makes the standard real.
The task you dread doing again is the one worth a script. Everything repetitive is a bug that has not been filed yet.
Not the interview answer. The version where you take a weekend apart because something did not behave the way you expected.
10 Worked with
Where the work actually happened. Every one of them is on the CV, and every one of them can be checked.
5
He knows his stuff, and it shows in the work.
Anurag and his company, Codex Corp, have kept my business running: maintaining, deploying and managing a number of sites and services along the way. A total professional who clearly knows his craft.
5
Worth every dollar and every minute.
Codex Studios handled my professional headshots, and the whole experience was seamless from start to finish. Genuinely worth the money and the time.
4.5
Cleanly scoped, delivered on time, no surprises.
I brought Codex Corp in to figure out what my personal realtor site actually needed. The scope was laid out clearly from day one, and what came back was high quality and on schedule. Recommended, easily.
5
A week, a fair price, everything built in-house.
Anu and the team at Codex Digital and Labs built a 2D canvas game for the Invasive Species Council of B.C. Every asset, sound effect and line of game logic was made in-house, handed over with proper documentation, and the whole thing shipped in about a week. I recommend him without reservation.
5
A rush job that still came back premium.
Codex Digital built the landing page for our fishing game in a single day. It was a genuine rush, and it still landed on time with real care and polish behind it.
He made the whole day feel effortless.
Codex Studios shot my thirtieth birthday session and it turned out incredible. We sat down first, went through references, and picked the locations together. Anurag kept things relaxed through every pose and made the day genuinely fun.
4.9 average, from the five reviews that carry a rating
11 Contact
A cloud project, a company collaboration, or a question about how any of this is put together. I read everything that isn't a template.