Projects

Production systems and lab builds. Each one is written up with the design decisions, the trade-offs, and what I'd do differently at scale.

Selected work

Production

Firewall Automation & Governance Platform

Centralised, database-driven network access control across a production Linux fleet — policy compiled per host, applied safely, and revoked automatically.

  • Python
  • iptables / IPSets
  • MySQL
  • Ansible
  • Linux
  • Prometheus
 Production

SSL Certificate Lifecycle Automation

Issue, transfer, install, disable and revoke for Let's Encrypt certificates across a fleet of multi-tenant nginx hosts — private keys kept off the command line and out of the web tier, and every destructive step made reversible.

  • Python
  • certbot / ACME
  • nginx
  • Bash
  • SFTP (paramiko)
  • iptables
  • sudo
 Production

Node Configuration Inventory & Server Scoring

A read-only collector run across a Linux fleet over SSH, normalising hardware, OS, network and package data into one schema — then scoring every server and every network interface, with a reviewed dictionary for any metric it has never seen before.

  • Python
  • Paramiko
  • MySQL
  • Linux
  • ethtool
  • cron
 Production

Distributed Proxy Checker

A queue-driven daemon that tests a proxy from whichever server you choose, across a mixed Linux and Windows fleet — pickup cut from up to a minute to about two seconds, and every failure naming the stage it failed at.

  • Python
  • systemd
  • MySQL
  • FastAPI
  • PHP-FPM
  • nginx
  • Bash
 Built & drilled

Secure High-Availability Web Platform

A load-balanced, multi-AZ platform with MySQL GTID replication, encrypted backups and a WAF — built, then deliberately broken, with every recovery number measured rather than claimed.

  • Terraform
  • Ansible
  • AWS
  • MySQL
  • Cloudflare
  • nginx
 Built & drilled

GitOps Delivery Platform with Service Mesh

A Kubernetes delivery platform where git is the only way in — ArgoCD app-of-apps, Istio canaries counted rather than asserted, secrets from Vault. Built, measured, broken, fixed and torn down: seventeen defects found, sixteen fixed, one published as a failure.

  • Kubernetes (k3s)
  • ArgoCD
  • Istio
  • Terraform
  • Helm
  • Kustomize
  • Prometheus
  • Loki
  • Vault
  • GitHub Actions
 Built & drilled

Zero-Trust Secure Supply Chain Platform

Seven independent enforcement layers on Kubernetes — signed images, admission policy, Pod Security, NetworkPolicy, Istio mTLS and egress, Falco — and seven attacks run against them on purpose. Six held. The seventh failed silently, and why it failed is the most useful result on the page.

  • Kubernetes (k3s)
  • Kyverno
  • Sigstore / cosign
  • Istio
  • Falco
  • ArgoCD
  • Trivy
  • OPA
  • Terraform
  • GitHub Actions

Also built

Earlier work — smaller in scope, but each one taught something that shows up in the projects above.

Production Kubernetes Platform on AWS

A kubeadm cluster built from scratch on a custom multi-AZ VPC — ALB ingress with host-based routing, Helm-packaged services, autoscaling validated under load, and full observability.

  • Kubernetes
  • kubeadm
  • AWS
  • Helm
  • Terraform
  • Prometheus

Firewall Fleet Orchestrator

A drift-detecting security orchestrator — central policy as the source of truth, SHA256 change detection, and Ansible pushing validated rules across a managed EC2 fleet.

  • Python
  • Ansible
  • AWS EC2
  • iptables
  • SHA256

EC2 Linux Hardening — Defence in Depth

Layered hardening for RHEL on AWS EC2 — IAM least privilege, network scoping, host firewall, SSH lockdown, brute-force banning and monitoring, automated with Ansible.

  • RHEL
  • AWS EC2
  • Ansible
  • firewalld
  • fail2ban
  • Python