Infrastructure

• One infrastructure plan for 14 departments

  Designed a comprehensive infrastructure framework for a research institute impacting 14 departments, featuring flexible modules, unified data pipelines, and structured support strategies for long‑term adoption.

• Built the company's first observability dashboard

  Developed and launched the company's first observability dashboard, providing real‑time system performance insights and data visualization on the large office TV.

• Ran 10 PostgreSQL and MS SQL servers on Ubuntu

  Designed, deployed, and maintained 10 PostgreSQL and MS SQL servers on Ubuntu Linux VPS, ensuring optimal server performance and reliability.

• Wrote 1,000 RBAC rules to secure Linux servers

  Enhanced data security by implementing 1,000 RBAC rules for developers, application instances, PostgreSQL, MS SQL, and other Linux servers, preventing unauthorized access; documented with Ansible automation.

• Automated 100 critical data backups using Barman

  Automated 100 critical data backups using Barman, Google Cloud, Bash, and Python, ensuring data integrity across databases.

• Ran 20 Docker apps on Google Cloud and AWS

  Deployed and maintained 20 Docker containerized applications, troubleshooting with Podman and Kubernetes, and managing R‑based apps on Google Cloud and AWS.

• Managed 30 Ubuntu Linux VPS instances

  Managed 30 Ubuntu Linux VPS instances, implementing disaster recovery strategies and ensuring optimal network configurations.

• Led access management across M365 and SSO

  Prevented security breaches by leading access management initiatives, utilizing M365, 1Password, Red Hat SSO, and OKTA SSO.

• Cut operational risk with Grafana and Prometheus

  Mitigated operational risks by implementing a monitoring dashboard using Grafana and Prometheus, improving system reliability.

• Managed 8 WireGuard and IPsec VPN connections

  Managed and troubleshot 8 WireGuard VPN and IPsec VPN connections, ensuring secure communication across Google Cloud and Linux systems.

• Overhauled internal processes, saving 8,000 hours

  Overhauled internal processes, saving 8,000 hours by improving software architecture, systems, and scheduling efficiency.

• Administered network infrastructure

  Administered network infrastructure for over 1,000 servers, ensuring optimal system deployment, security, and troubleshooting.

• Automated SSL/TLS certs for 100 Docker apps

  Automated SSL/TLS certificate creation for 100 Docker applications, ensuring secure connections across Ubuntu Linux hosts.

• Configured and deployed 1,000 Wi‑Fi routers

  Configured and deployed 1,000 Wi‑Fi routers, improving network accessibility and performance for clients.

• Administered 100 Bare Bone servers

  Administered 100 Bare Bone servers, physical networks, and IP telephony systems, ensuring robust infrastructure for company growth.

• Administered 40 websites on Apache and Nginx

  Administered 40 websites on Ubuntu Linux hosting servers with Apache and Nginx, ensuring high availability and performance.

• A mapping product, carried end to end

  Architected, developed, implemented, supported infrastructure, data processing, and the map application for 2 years non‑stop without any weekends, holidays, or vacations, 10–14 hours a day.

• A tenth of the cloud bill, and nothing lost

  Optimized budget costs 10 times with zero loss in productivity for an international client by reimagining the overall infrastructure, eliminating unnecessary services, and relocating from the AWS cloud.

• Provisioned Azure infrastructure as code

  Provisioned Azure infrastructure as code with Bicep — Container Apps, PostgreSQL Flexible Server, Front Door/WAF and networking — across the development, staging and production environments.

• Owned end‑to‑end platform deployments to Azure

  Owned end‑to‑end deployments of the platform to Azure, managing releases across development, staging and production environments.

• Implemented backups and disaster recovery as code

  Configured database backup retention as infrastructure‑as‑code, then audited the recovery position and documented the restore procedure — naming the remaining gaps rather than leaving them to be found during an incident.

• Ran 24/7 support for ~1,000 IPTV/OTT servers

  Provided round‑the‑clock 24/7 infrastructure support for an IPTV/OTT streaming platform, administering ~1,000 servers plus client‑owned systems for global customers in China, the US and Germany.

• Kept IPTV streaming signals running non‑stop

  Ensured uninterrupted delivery of IPTV streaming signals between suppliers and clients, monitoring and maintaining the streaming network and IP telephony around the clock.

• Built infrastructure that still runs years later

  Planned and implemented new infrastructure functionality for internal and external systems, building solutions durable enough to still run years later with minimal change.

• Built the entire core infrastructure from scratch

  As one of the first hires, designed and built the entire core infrastructure and supporting processes from scratch for a green‑energy SaaS startup, laying the foundation for rapid growth.

• Integrated a company‑wide password manager

  Integrated a company‑wide password‑management system, strengthening security and streamlining access control.

• Built first‑party error monitoring and tracing

  Built first‑party error monitoring and OpenTelemetry tracing rather than buying them — payload sanitising, spike and regression detection, symbolication and a synthetic heartbeat — behind 11 operator views.

• Servers you can rebuild from scratch

  Built the company's own infrastructure as 19 Ansible playbooks and 34 roles across 12,065 lines of YAML, converging a live host to a declared state with every play idempotent.

• A whole company on one small server

  Ran the whole company on one 512 MB single‑core host — a git forge, a web server serving seven domains, Tor, two alternate‑protocol servers, backups and intrusion banning — by treating 464 MB of usable memory as the binding architectural constraint.

• Three locks on the door, none of them locked

  Found and closed three SSH brute‑force protections that had never worked: a ban jail watching port 22 while the daemon listened on 1986, a rate limit shadowed by a broader rule above it, and a ban action whose binary never resolved, so no ban had ever applied.

• Hardened SSH to 24 validated directives

  Hardened SSH to 24 asserted directives with three‑stage validation — the candidate file, the assembled config, then the daemon's own read‑back — after the read‑back caught the running server silently overriding two of the twenty‑four.

• Proved the intrusion ban works every run

  Proved the intrusion‑banning path end to end on every hardening run by banning a reserved test address, reading the resulting kernel rule and unbanning in a guaranteed cleanup block, so a jail that stops working fails a run instead of reporting healthy.

• Verified firewall rules by position

  Verified firewall rules by position rather than presence, reading the numbered rule list and the live packet‑filter chain, because a rule that exists is not a rule any packet reaches.

• Backups that have actually been restored

  Built encrypted off‑host backups on restic with retention pruning, an integrity check and a monthly automated restore drill, then audited the recovery position and wrote down the gaps rather than leaving them to be found during an incident.

• Built dead‑man's‑switch host monitoring

  Built dead‑man's‑switch monitoring that pings only while memory and disk are healthy, so a degraded host raises an alert by going silent — and caught six variable names saying "free" where the check correctly measured "available", an order of magnitude apart on a 464 MB box.

• Made Ansible check mode tell the truth

  Made check mode tell the truth across the whole platform after finding six probes deciding on a value the host never gave, because Ansible's command module reports success under --check while skipping the command entirely.

• Added a one‑second preflight for secrets

  Added a preflight play that runs the same code as the converge against operator‑local secrets in about a second, after a half‑applied production run died on its ninth task with the swap settings already written to the live host.

• Reconciled a 20‑record DNS zone as code

  Reconciled a 20‑record DNS zone declaratively against the Cloudflare API with separate audit and BIND‑export entry points, and turned the CDN proxy back off on privacy grounds after building it.

• Cut systemd sandbox exposure on every unit

  Cut systemd sandbox exposure across every unit this platform installs — a dead‑man's‑switch service from 9.6 UNSAFE to 1.5, an internet‑facing git forge from 8.3 EXPOSED to 1.5 — and added a converge‑time parser check after finding a misspelled directive silently ignored in three unit templates.

• Built 7 read‑only host reporting roles

  Built seven read‑only reporting roles that render a live host to Markdown — facts, access, git, metrics, traffic, security and provider inventory — under a rule that no number is printed the run did not measure.

• Your code on your own hardware

  Deployed the company's own git forge on Soft Serve, private by default with no web panel and its SSH port bound to loopback behind a jump host, and made the landing page in front of it a build artefact of the main site rather than a hand‑kept copy.

• Ran containers on Podman and Quadlet

  Deployed a container plane on Podman and Quadlet under systemd rather than Docker, because Docker publishes container ports above the host firewall's own rules — and gave deploys an unprivileged user with one fixed command instead of root.

• Provisioned a second server from code

  Automated the provisioning of a second server on a second cloud provider, creating the firewall before the machine so it is born behind one, with both providers' firewalls written directly against their REST APIs to avoid a third‑party collection.

• Wrote a scope rule after a credential leak

  Wrote a scope rule into the repository after a restructure carried another company's inventory, firewall allowances and prose into it — and kept the quarantined residue under the secret scanner rather than excluding it.

• Split every operational secret per host

  Split the four per‑host operational secrets after establishing that two hosts sharing one dead‑man's switch alert less than two switches, not more, and that a shared backup passphrase makes two hosts one repository.

• Mirrored the site to Gemini and Gopher

  Mirrored the entire site as 777 Gemini documents and 777 Gopher documents off the same deployed tree, at zero bytes of change to the HTML.

• Rehearsed the forge CI hook, found 2 defects

  Rehearsed the forge‑side CI hook and found two defects unreachable by reading the file: a fallback that put an unresolvable argument on the hook's input, and git's own environment variable following the gate into the checkout and turning 19 tests red.

• Measured 13 addresses with no tracking

  Measured thirteen addresses from the web server's own access log alone — no cookie, no tracker and no third‑party service — masking the client network as each line is written, and folding the result into a permanent archive of 21 daily counts and 20 monthly facets.

• Published a readable Tor onion mirror

  Published the site as a Tor onion mirror on a readable address beginning engineer, with the key generated off the host so it never reached this repository or a laptop, and left it the one front door of four that is never counted.

This work is part of what we offer as System Administration, Security & Access Management, Site Reliability & Monitoring, Infrastructure as Code, DevOps & CI/CD Automation, Networking & VPN Setup, Cloud Infrastructure & Migration and AI Agent Security.

Building something that needs this? Get in touch.