Projects

Production systems and lab builds. Each one is written up with the design decisions, the trade-offs, and what I'd do differently at scale.

Selected work

Production

Firewall Automation & Governance Platform

Centralised, database-driven network access control across a production Linux fleet — policy compiled per host, applied safely, and revoked automatically.

  • Python
  • iptables / IPSets
  • MySQL
  • Ansible
  • Linux
  • Prometheus
 Built & drilled

Secure High-Availability Web Platform

A load-balanced, multi-AZ platform with MySQL GTID replication, encrypted backups and a WAF — built, then deliberately broken, with every recovery number measured rather than claimed.

  • Terraform
  • Ansible
  • AWS
  • MySQL
  • Cloudflare
  • nginx
 In progress

GitOps Delivery Platform with Service Mesh

A Kubernetes platform where a git commit is the only deployment mechanism, and releases roll out as canaries under service mesh traffic control.

  • Kubernetes
  • ArgoCD
  • Istio
  • Helm
  • GitHub Actions
 In progress

Zero-Trust Secure Supply Chain Platform

Seven independent enforcement layers on Kubernetes — from signed images in CI down to runtime detection — each one verified by attempting to bypass it.

  • Kubernetes
  • Kyverno
  • Cosign
  • Istio
  • Falco
  • OPA
  • Terraform

Also built

Earlier work — smaller in scope, but each one taught something that shows up in the projects above.

Production Kubernetes Platform on AWS

A kubeadm cluster built from scratch on a custom multi-AZ VPC — ALB ingress with host-based routing, Helm-packaged services, autoscaling validated under load, and full observability.

  • Kubernetes
  • kubeadm
  • AWS
  • Helm
  • Terraform
  • Prometheus

Firewall Fleet Orchestrator

A drift-detecting security orchestrator — central policy as the source of truth, SHA256 change detection, and Ansible pushing validated rules across a managed EC2 fleet.

  • Python
  • Ansible
  • AWS EC2
  • iptables
  • SHA256

EC2 Linux Hardening — Defence in Depth

Layered hardening for RHEL on AWS EC2 — IAM least privilege, network scoping, host firewall, SSH lockdown, brute-force banning and monitoring, automated with Ansible.

  • RHEL
  • AWS EC2
  • Ansible
  • firewalld
  • fail2ban
  • Python