# Linux & Servers > Selected Engineer ApS work demonstrating Linux & Servers — the achievements that prove it. - [Developed and launched the company's first observability dashboard, providing real‑time system performance insights and data visualization on the large office TV.](https://engineer.company/portfolio/developed-and-launched-the-company-s-first-observability-9/) - [Designed, deployed, and maintained 10 PostgreSQL and MS SQL servers on Ubuntu Linux VPS, ensuring optimal server performance and reliability.](https://engineer.company/portfolio/designed-deployed-and-maintained-10-postgresql-and-ms-13/) - [Enhanced data security by implementing 1,000 RBAC rules for developers, application instances, PostgreSQL, MS SQL, and other Linux servers, preventing unauthorized access; documented with Ansible automation.](https://engineer.company/portfolio/enhanced-data-security-by-implementing-1-000-rbac-14/) - [Managed 30 Ubuntu Linux VPS instances, implementing disaster recovery strategies and ensuring optimal network configurations.](https://engineer.company/portfolio/managed-30-ubuntu-linux-vps-instances-implementing-disaster-20/) - [Managed and troubleshooted 8 WireGuard VPN and IPSEC VPN connections, ensuring secure communication across Google Cloud and Linux systems.](https://engineer.company/portfolio/managed-and-troubleshooted-8-wireguard-vpn-and-ipsec-23/) - [Administered network infrastructure for over 1,000 servers, ensuring optimal system deployment, security, and troubleshooting.](https://engineer.company/portfolio/administered-network-infrastructure-for-over-1-000-servers-39/) - [Automated SSL/TLS certificate creation for 100 Docker applications, ensuring secure connections across Ubuntu Linux hosts.](https://engineer.company/portfolio/automated-ssl-tls-certificate-creation-for-100-docker-41/) - [Administered 100 Bare Bone servers, physical networks, and IP telephony systems, ensuring robust infrastructure for company growth.](https://engineer.company/portfolio/administered-100-bare-bone-servers-physical-networks-and-50/) - [Administered 40 websites on Ubuntu Linux hosting servers with Apache and Nginx, ensuring high availability and performance.](https://engineer.company/portfolio/administered-40-websites-on-ubuntu-linux-hosting-servers-53/) - [Provided round‑the‑clock 24/7 infrastructure support for an IPTV/OTT streaming platform, administering ~1,000 servers plus client‑owned systems for global customers in China, the US and Germany.](https://engineer.company/portfolio/provided-round-the-clock-24-7-infrastructure-support-82/) - [Ensured uninterrupted delivery of IPTV streaming signals between suppliers and clients, monitoring and maintaining the streaming network and IP telephony around the clock.](https://engineer.company/portfolio/ensured-uninterrupted-delivery-of-iptv-streaming-signals-between-83/) - [Diagnosed and repaired laptop hardware — screens, hinges, keyboards, trackpads, motherboards and power — and resolved software issues across Linux, Windows and Mac.](https://engineer.company/portfolio/diagnosed-and-repaired-laptop-hardware-screens-hinges-keyboards-93/) - [Built the company's own infrastructure as 19 Ansible playbooks and 34 roles across 12,065 lines of YAML, converging a live host to a declared state with every play idempotent.](https://engineer.company/portfolio/built-the-companys-infrastructure-as-code-108/) - [Ran the whole company on one 512 MB single‑core host — a git forge, a web server serving seven domains, Tor, two alternate‑protocol servers, backups and intrusion banning — by treating 464 MB of usable memory as the binding architectural constraint.](https://engineer.company/portfolio/ran-the-whole-company-on-one-512mb-host-109/) - [Found and closed three SSH brute‑force protections that had never worked: a ban jail watching port 22 while the daemon listened on 1986, a rate limit shadowed by a broader rule above it, and a ban action whose binary never resolved, so no ban had ever applied.](https://engineer.company/portfolio/found-three-ssh-brute-force-protections-that-never-worked-110/) - [Hardened SSH to 24 asserted directives with three‑stage validation — the candidate file, the assembled config, then the daemon's own read‑back — after the read‑back caught the running server silently overriding two of the twenty‑four.](https://engineer.company/portfolio/hardened-ssh-with-three-stage-validation-111/) - [Proved the intrusion‑banning path end to end on every hardening run by banning a reserved test address, reading the resulting kernel rule and unbanning in a guaranteed cleanup block, so a jail that stops working fails a run instead of reporting healthy.](https://engineer.company/portfolio/proved-the-intrusion-banning-path-on-every-converge-112/) - [Verified firewall rules by position rather than presence, reading the numbered rule list and the live packet‑filter chain, because a rule that exists is not a rule any packet reaches.](https://engineer.company/portfolio/verified-firewall-rules-by-position-113/) - [Built encrypted off‑host backups on restic with retention pruning, an integrity check and a monthly automated restore drill, then audited the recovery position and wrote down the gaps rather than leaving them to be found during an incident.](https://engineer.company/portfolio/built-encrypted-backups-with-a-monthly-restore-drill-114/) - [Built dead‑man's‑switch monitoring that pings only while memory and disk are healthy, so a degraded host raises an alert by going silent — and caught six variable names saying "free" where the check correctly measured "available", an order of magnitude apart on a 464 MB box.](https://engineer.company/portfolio/built-dead-mans-switch-monitoring-115/) - [Made check mode tell the truth across the whole platform after finding six probes deciding on a value the host never gave, because Ansible's command module reports success under --check while skipping the command entirely.](https://engineer.company/portfolio/made-ansible-check-mode-tell-the-truth-116/) - [Cut systemd sandbox exposure across every unit this platform installs — a dead‑man's‑switch service from 9.6 UNSAFE to 1.5, an internet‑facing git forge from 8.3 EXPOSED to 1.5 — and added a converge‑time parser check after finding a misspelled directive silently ignored in three unit templates.](https://engineer.company/portfolio/cut-systemd-sandbox-exposure-across-every-unit-119/) - [Built seven read‑only reporting roles that render a live host to Markdown — facts, access, git, metrics, traffic, security and provider inventory — under a rule that no number is printed the run did not measure.](https://engineer.company/portfolio/built-seven-read-only-host-reporting-roles-120/) - [Deployed the company's own git forge on Soft Serve, private by default with no web panel and its SSH port bound to loopback behind a jump host, and made the landing page in front of it a build artefact of the main site rather than a hand‑kept copy.](https://engineer.company/portfolio/deployed-the-companys-own-git-forge-121/) - [Deployed a container plane on Podman and Quadlet under systemd rather than Docker, because Docker publishes container ports above the host firewall's own rules — and gave deploys an unprivileged user with one fixed command instead of root.](https://engineer.company/portfolio/deployed-a-container-plane-on-podman-and-quadlet-122/) - [Split the four per‑host operational secrets after establishing that two hosts sharing one dead‑man's switch alert less than two switches, not more, and that a shared backup passphrase makes two hosts one repository.](https://engineer.company/portfolio/split-every-operational-secret-per-host-125/) - [Rehearsed the forge‑side CI hook and found two defects unreachable by reading the file: a fallback that put an unresolvable argument on the hook's input, and git's own environment variable following the gate into the checkout and turning 19 tests red.](https://engineer.company/portfolio/rehearsed-the-forge-side-ci-hook-151/)