I design, build, and break real systems. What started as a homelab is now a production-patterned hybrid cloud/on-prem environment — real infrastructure running real workloads, provisioned as code and operated the way a real infrastructure team would run it.
I like understanding systems by actually operating them, not just reading about them. My homelab is a hybrid environment: a public-facing zero-trust edge on Oracle Cloud, a Kubernetes cluster and Docker host on-prem, all provisioned from a single Terraform/Terragrunt monorepo and continuously reconciled with GitOps — the same patterns real infrastructure teams run, at a scale I fully own end to end.
That includes writing my own runbooks, working through real incidents, and documenting root causes afterward instead of just patching around them -- the discipline of running infrastructure someone actually depends on, not just standing it up once and walking away.
A hybrid cloud / on-prem environment, provisioned entirely as code.
A single source of truth — every host, subnet, and service is declared once and generates everything downstream from it: Terraform resources, GitOps manifests, DNS records, reverse-proxy config. Nothing hand-duplicated.
A public-facing controller/router built on OpenZiti — internal services are reachable with no open inbound ports on the home network.
Every VM is provisioned from a single declarative host definition — no manual clicking, no drift between what's declared and what's running. Currently 20 hosts total.
A combined control-plane/worker Talos cluster (45 pods running) reconciled continuously by Flux GitOps, alongside Docker hosts for services that don't need an orchestrator — 8 apps on Kubernetes, 3 on Docker, 6 on their own dedicated VM.
Wazuh SIEM, Greenbone vulnerability scanning, and an isolated attack range for hands-on offensive/defensive practice — plus LibreNMS and Nautobot for network monitoring and source-of-truth.
Reaching an app remotely, with no open inbound ports:
Nothing on the home network ever accepts an inbound connection. A Ziti client dials out to the public controller, which brokers an outbound-only tunnel back through the home router to Traefik — the same reverse proxy every request goes through, local or remote — which enforces an Authentik SSO gate before most apps are ever reached.
Shipping a change, GitOps-style:
Every change to this repo — including the numbers on this page — flows through the same pipeline: commit, reconcile, apply. No manual kubectl apply, no clicking through a UI to make it real.
Enrolling a new user, without ever hand-provisioning an account:
The intake form is the only thing a not-yet-provisioned person can reach — they have no Ziti identity yet, so it runs over a narrowly-scoped public tunnel instead of the zero-trust overlay above. Approval isn't a rubber stamp on a database write: it's a single human decision that produces a git commit, and Terraform is still the only thing that ever actually creates the account — the same GitOps pipeline as everything else here, just triggered by a Slack click instead of by hand. A symmetric offboarding flow tears the account back down the same way.
Not a snapshot — pulled from the same generator that keeps the internal wiki honest, counts and generic service names only.
A 9-router partial mesh behind a simulated ISP edge, built for BGP practice.
Click a device to view its configuration.
Drag nodes to rearrange — click one to view its config.