Self-Hosted Infrastructure & Platform
Ongoing- Architected and operate a 3-node Proxmox VE cluster (plus a standalone hypervisor and dedicated backup server) running 20+ containerized services, with high availability via Proxmox HA + Corosync quorum and live workload migration.
- Designed default-deny network segmentation on a UniFi zone-based firewall — a 4-tier trust model (trusted / IoT / kids / guest) with intrusion prevention (IPS), honeypots, and VLAN isolation; validated the external attack surface via port/TLS scanning.
- Built a highly-available reverse-proxy edge (Caddy + keepalived VRRP failover) fronting ~28 services with automated Let's Encrypt TLS (DNS-01 wildcard, least-privilege API tokens), HSTS/security headers, and CrowdSec intrusion prevention actively blocking live traffic.
- Engineered a 3-2-1 backup/DR strategy: Proxmox Backup Server (dedup, scheduled GC/prune/verify) with encrypted offsite cloud replication, on RAID6.
- Run redundant DNS (AdGuard Home with keepalived HA + config sync, DNSSEC validation, split-horizon) and manage 5 Cloudflare zones (DNSSEC, SPF/DMARC, Full-Strict TLS).
- Automate patching and configuration management with Ansible (orchestrated via Semaphore) and scheduled maintenance jobs.
- Operate full observability + SecOps: Uptime Kuma, Wazuh SIEM (30+ agents), and CrowdSec; completed a comprehensive security audit and hardening pass (MFA, key-only SSH, secrets hygiene, scoped/rotated credentials, least privilege).
- Currently building an AIOps self-healing pipeline — alert → n8n orchestration → LLM agent for autonomous incident triage, with a security-first design (read-only investigation tier + human-gated remediation).