Open to opportunities

I design systems
end to end, built to hold up in production.

Platform / infrastructure engineer. From code to production, through CI/CD, observability and security — an integrated ecosystem designed to be operated over the long run.

01

About

Working as an engineer for 10 years. My specialty: designing coherent distributed systems and keeping them operable over time.

What I show here is infrastructure actually running in production for my daily use, tested under failure, with full observability and an end-to-end CI/CD chain.

On the people side, I mentored two interns from the ground up on our stack — both were hired at the end of their internship. Helping others level up is part of how I approach the craft.

My areas of focus: Rust, container orchestration, security / isolation, networking, and self-hosted observability.

Principles
  • If it hasn't been tested under failure, it isn't resilient.
  • A technical choice is justified by its tradeoffs, not by trends.
  • Migrate for value, never for dogma.
  • Security is designed starting from the threat model.
  • A system must be observable before it's scaled.
02

Selected projects

Three pieces that, together, cover the essentials of a platform profile: operating a system, designing a secure architecture, and thinking about scale.

🏗️ Self-hosted infrastructure Complete & tested

A complete ecosystem — code → CI → production → observability — on bare metal, validated by real failure tests.

The problem

Having a reliable personal platform to host and operate my own services, with the standards of real production: resilience, alerting, zero data loss.

The architecture
  • Networking — WireGuard (the only entry point), Docker overlay, and CoreDNS for *.internal resolution with fallback to Docker's DNS.
  • CI/CD — Gitea + Woodpecker: lint → tests → build → automatic push registry on tag/release → deploy on prod.
  • Observability — OtelCollector (central hub), Prometheus (storage + alerting), Loki (logs) + Tempo (traces), Perses dashboards, Alertmanager → ntfy.
  • Safety net — Blackbox scraped directly by Prometheus: monitoring survives a Collector failure.
What sets it apart — validated resilience
  • Gitea outage → ntfy alert received ✓
  • OtelCollector outage → alert received, monitoring maintained ✓
  • Multiple redeployments → zero data loss (persistent volumes) ✓
Docker SwarmWireGuardCoreDNSGiteaWoodpecker CIOpenTelemetryPrometheusLokiTempoPersesAlertmanager

🤖 Herald — AI agent for Gitea In active development

A code-review and AI-assistance bot for Gitea, written in Rust, with a security-first agentic architecture.

The problem

No AI assistance solution exists for Gitea. A real need: solo code review, implementing tests/features, usable day to day — including from a phone.

The security model

The challenge of an agent that executes code isn't making it run, but making it run without risk of exfiltration or compromise. The decisions:

  • Agent loop on the host, side effects isolated in a container
  • Git handled exclusively by the host (Gitea token): no secret ever touches the sandbox.
  • .git "disarmed" for reading (remotes removed, credentials cleared, hooks emptied) — on a copy, with the armed original staying on the host.
  • Network cut during the AI phase (disconnect via bollard): exfiltration is impossible. Network active only for postCreate.
  • Persistence from the start (resume after stop).
Roadmap (intentional semver)
  • 1.0 — Review + comments posted to the right line on the MR
  • 1.1 — The 3 observability signals
  • 1.2 — Sandboxing begins (read-only first)
  • 2.0 — Feature creation (write / execute)
  • 2.x — Advanced persistence + web config dashboard
RustTokiobollardDevContainersOpenRouterOpenTelemetry

⚡ Distributed media pipeline Design / upcoming

An extended imgproxy-style media processing pipeline, designed for horizontal scaling and streaming.

The problem

Process media (images, streaming) compositionally, with an architecture able to scale out horizontally — and serve as a real load-testing playground.

The architecture
  • Compositional API: a core + runners communicating over NATS.
  • Multi-level cache, horizontal scaling of runners.
  • Claim-check pattern: files transit through an object store (S3/Minio); NATS carries only commands and metadata.
The technical goal

An ideal candidate for load tests (k6) instrumented by my observability stack — validating system behavior at scale and documenting the breaking points.

RustTokioNATSS3 / Miniok6OpenTelemetryDocker Swarm
03

Skills

Languages

Rust (async / Tokio), TypeScript / Node. Looking for the right tool for the right problem.

Infrastructure & Ops

Docker Swarm, bare metal, Fedora Bootc (immutable OS), CI/CD (Gitea, Woodpecker).

Observability

OpenTelemetry, Prometheus, Loki, Tempo, Perses, Alertmanager. Full stack, tested under failure.

Networking

WireGuard, CoreDNS, overlay networks, Caddy. Designing self-hosted private networks.

Security & Isolation

Container sandboxing, privilege separation (DBus / Polkit), threat modeling.

Distributed & Messaging

NATS, distributed architectures, claim-check patterns, horizontal scaling.

04

Contact

Interested in platform / infrastructure / staff roles where technical quality and autonomy matter. The code for everything shown here is available to review.