Keeping the lights on

Selected work demonstrating this service.

• Ran 10 PostgreSQL and MS SQL servers on Ubuntu

  Designed, deployed, and maintained 10 PostgreSQL and MS SQL servers on Ubuntu Linux VPS, ensuring optimal server performance and reliability.

• Wrote 1,000 RBAC rules to secure Linux servers

  Enhanced data security by implementing 1,000 RBAC rules for developers, application instances, PostgreSQL, MS SQL, and other Linux servers, preventing unauthorized access; documented with Ansible automation.

• Managed 30 Ubuntu Linux VPS instances

  Managed 30 Ubuntu Linux VPS instances, implementing disaster recovery strategies and ensuring optimal network configurations.

• Led access management across M365 and SSO

  Prevented security breaches by leading access management initiatives, utilizing M365, 1Password, Red Hat SSO, and OKTA SSO.

• Managed 8 WireGuard and IPsec VPN connections

  Managed and troubleshot 8 WireGuard VPN and IPsec VPN connections, ensuring secure communication across Google Cloud and Linux systems.

• Administered network infrastructure

  Administered network infrastructure for over 1,000 servers, ensuring optimal system deployment, security, and troubleshooting.

• Configured and deployed 1,000 Wi‑Fi routers

  Configured and deployed 1,000 Wi‑Fi routers, improving network accessibility and performance for clients.

• Administered 100 Bare Bone servers

  Administered 100 Bare Bone servers, physical networks, and IP telephony systems, ensuring robust infrastructure for company growth.

• Administered 40 websites on Apache and Nginx

  Administered 40 websites on Ubuntu Linux hosting servers with Apache and Nginx, ensuring high availability and performance.

• Ran 24/7 support for ~1,000 IPTV/OTT servers

  Provided round‑the‑clock 24/7 infrastructure support for an IPTV/OTT streaming platform, administering ~1,000 servers plus client‑owned systems for global customers in China, the US and Germany.

• Kept IPTV streaming signals running non‑stop

  Ensured uninterrupted delivery of IPTV streaming signals between suppliers and clients, monitoring and maintaining the streaming network and IP telephony around the clock.

• Built infrastructure that still runs years later

  Planned and implemented new infrastructure functionality for internal and external systems, building solutions durable enough to still run years later with minimal change.

• Built the entire core infrastructure from scratch

  As one of the first hires, designed and built the entire core infrastructure and supporting processes from scratch for a green‑energy SaaS startup, laying the foundation for rapid growth.

• Integrated a company‑wide password manager

  Integrated a company‑wide password‑management system, strengthening security and streamlining access control.

• Servers you can rebuild from scratch

  Built the company's own infrastructure as 19 Ansible playbooks and 34 roles across 12,065 lines of YAML, converging a live host to a declared state with every play idempotent.

• A whole company on one small server

  Ran the whole company on one 512 MB single‑core host — a git forge, a web server serving seven domains, Tor, two alternate‑protocol servers, backups and intrusion banning — by treating 464 MB of usable memory as the binding architectural constraint.

• Hardened SSH to 24 validated directives

  Hardened SSH to 24 asserted directives with three‑stage validation — the candidate file, the assembled config, then the daemon's own read‑back — after the read‑back caught the running server silently overriding two of the twenty‑four.

• Proved the intrusion ban works every run

  Proved the intrusion‑banning path end to end on every hardening run by banning a reserved test address, reading the resulting kernel rule and unbanning in a guaranteed cleanup block, so a jail that stops working fails a run instead of reporting healthy.

• Verified firewall rules by position

  Verified firewall rules by position rather than presence, reading the numbered rule list and the live packet‑filter chain, because a rule that exists is not a rule any packet reaches.

• Backups that have actually been restored

  Built encrypted off‑host backups on restic with retention pruning, an integrity check and a monthly automated restore drill, then audited the recovery position and wrote down the gaps rather than leaving them to be found during an incident.

• Built dead‑man's‑switch host monitoring

  Built dead‑man's‑switch monitoring that pings only while memory and disk are healthy, so a degraded host raises an alert by going silent — and caught six variable names saying "free" where the check correctly measured "available", an order of magnitude apart on a 464 MB box.

• Reconciled a 20‑record DNS zone as code

  Reconciled a 20‑record DNS zone declaratively against the Cloudflare API with separate audit and BIND‑export entry points, and turned the CDN proxy back off on privacy grounds after building it.

• Cut systemd sandbox exposure on every unit

  Cut systemd sandbox exposure across every unit this platform installs — a dead‑man's‑switch service from 9.6 UNSAFE to 1.5, an internet‑facing git forge from 8.3 EXPOSED to 1.5 — and added a converge‑time parser check after finding a misspelled directive silently ignored in three unit templates.

• Built 7 read‑only host reporting roles

  Built seven read‑only reporting roles that render a live host to Markdown — facts, access, git, metrics, traffic, security and provider inventory — under a rule that no number is printed the run did not measure.

• Your code on your own hardware

  Deployed the company's own git forge on Soft Serve, private by default with no web panel and its SSH port bound to loopback behind a jump host, and made the landing page in front of it a build artefact of the main site rather than a hand‑kept copy.

• Rehearsed the forge CI hook, found 2 defects

  Rehearsed the forge‑side CI hook and found two defects unreachable by reading the file: a fallback that put an unresolvable argument on the hook's input, and git's own environment variable following the gate into the checkout and turning 19 tests red.

• Made six collectors state what they skipped

  Made six reporting collectors state the part of their input they never read — files that stayed shut, probes not installed, journal lines unrecognised — and fitted thresholds to 116 measured samples, after establishing that a blind collection and a healthy host render the same page.

• Published a readable Tor onion mirror

  Published the site as a Tor onion mirror on a readable address beginning engineer, with the key generated off the host so it never reached this repository or a laptop, and left it the one front door of four that is never counted.