Transforming an Old Laptop into a Silent Linux Server & Private AI Homelab
How I converted an old decommissioned laptop into a headless, low-power Debian 13 micro-server running local AI, DNS filtering, and automations.
Custom-home
DevOps Engineer • Security Researcher (TCM PJPT • MSc Cybersecurity)
Shaz's DevOps & Security Hub
Building Resilient Cloud Infrastructure, Hardened CI/CD Pipelines & Secure Architectures
Hands-on engineering across AWS, Kubernetes, Terraform, Go, Python, and Cloud & Network Security.
Systems & Security Engineering
Flagship Engineering Projects
Production-grade tools, automated security pipelines, and cloud native architectures.
Cloud Native Infra Production Architecture
Production EKS GitOps with ArgoCD & ESO
Declarative Kubernetes infrastructure deployed via Terraform on AWS. Features ArgoCD ApplicationSets for multi-environment syncing, External Secrets Operator (ESO) syncing with AWS Secrets Manager, and Trivy automated container vulnerability gating.
Zero-Tracking & Privacy Production Web Platform
Digital Amannah — Values-Based Digital Wellness Platform
A privacy-first digital safety platform built with Next.js App Router and React Server Components for zero client-side tracking. Features automated markdown content delivery, strict TypeScript type safety, and localized moderation workflows.
Full-Stack Architecture Open Source Web App
SubTrackr — Go Backend & Supabase RLS Subscription Engine
A full-stack subscription and recurring expense management platform engineered with a high-performance Go (Gin) REST API, React 18 frontend, PostgreSQL Row Level Security (RLS) policies, and automated email notification jobs.
Pipeline Security DevSecOps Automation
Hardened CI/CD & Keyless AWS OIDC Pipeline
Zero-long-lived-credentials CI/CD architecture replacing static AWS IAM keys with OpenID Connect (OIDC) identity federation in GitHub Actions, combined with automated Trivy vulnerability scanning and security regression checks.
Tech Stack & Core Expertise
Cloud & Infrastructure
- AWS (EKS, IAM, S3, NLB, VPC)
- Azure (Batch, SP, Blob)
- Google Cloud Platform
- Kubernetes & Kustomize
- Docker & Containerd
Security & Hardening
- TCM Security PJPT Certified
- Vulnerability Scanning (Trivy)
- Secrets Management (ESO, Vault)
- Hardened CI/CD (GitHub Actions)
- IAM OIDC & Least Privilege
Tools & Languages
- Terraform & OpenTofu
- Go (Golang) & Python
- Bash Scripting & Linux Hardening
- Grafana, CloudWatch, Kuma
- Tailscale WireGuard Mesh
Current Focus & Credentials
Professional Engineering
- DevOps Engineer at Seqera Labs
- Building secure CI/CD pipelines with Trivy automated vulnerability gating
- Automating secrets management with External Secrets Operator (ESO)
- Multi-cloud infrastructure as code automation with Terraform
Education & Research
- MSc Computer Science with Cybersecurity at University of York
- TCM Security PJPT (Practical Junior Penetration Tester)
- Verified Certifications: Credly Badges
- Active HackTheBox penetration testing & red-teaming labs
- Infrastructure as Code & Cloud Native Security Automation
My DevOps Journey
May 2025 - Present
DevOps Engineer
Seqera Labs
Building secure CI/CD pipelines with integrated security scanning, automating secrets management with ESO, and implementing infrastructure as code with embedded security baselines.
Kubernetes Terraform CI/CD Security
2024 - 2025
Cloud Support Engineer
Seqera Labs
Provided technical support for cloud infrastructure, troubleshooting complex deployment issues, and optimizing system performance across multi-cloud environments.
AWS Azure GCP Troubleshooting
2023 - 2024
IT Administrator
Cloudbeds
Managed enterprise IT infrastructure, implemented automation solutions, and maintained 99.9% system uptime while reducing support ticket volumes by 40%.
System Administration Automation Infrastructure
2022 - 2023
Infrastructure Technology Helpdesk Administrator
TractionOnDemand
Specialized in infrastructure support, network troubleshooting, and user technical assistance while building foundational DevOps skills.
Infrastructure Networking Technical Support
2021 - 2022
Application Support Analyst & Service Desk Analyst
Impellam Group
Started my tech journey in application support and service desk roles, developing problem-solving skills and technical foundation.
Application Support Service Desk Problem Solving
Expected August 2026
MSc Computer Science with Cybersecurity
University of York
Advanced studies in cybersecurity, focusing on threat detection, security architecture, and defensive strategies.
Cybersecurity Threat Analysis Security Architecture
Latest Technical Articles
Dynamic Node Provisioning on EKS: Migrating from Cluster Autoscaler to Karpenter
Scaling worker nodes in Kubernetes has historically relied on the Kubernetes Cluster Autoscaler. While Cluster...
Sep 22, 2026
Zero-Trust Pod Networking on EKS: Replacing kube-proxy and iptables with Cilium eBPF
As Kubernetes clusters scale to hundreds of microservices and thousands of active pods, traditional networking...
Sep 14, 2026
How We Sharded GitHub PR Previews: Dynamic Isolation and Zero Stale Infrastructure
Few things improve the developer feedback loop like ephemeral preview environments. Being able to open...
Sep 07, 2026
My Journey Building an EKS Cluster: The Struggles, Breakthroughs, and Lessons Learned
My Journey Building an EKS Cluster: The Struggles and Breakthroughs
Dynamic Node Provisioning on EKS: Migrating from Cluster Autoscaler to Karpenter
A production guide to replacing Auto Scaling Groups and Cluster Autoscaler with Karpenter v1 NodePools, automated consolidation, and spot interruption handling on AWS EKS.
Zero-Trust Pod Networking on EKS: Replacing kube-proxy and iptables with Cilium eBPF
Benchmarking and implementing Cilium eBPF on AWS EKS to eliminate iptables latency, enforce Layer 7 DNS and HTTP network policies, and inspect traffic with Hubble.
How We Sharded GitHub PR Previews: Dynamic Isolation and Zero Stale Infrastructure
A walkthrough of how to shard ephemeral PR preview environments in GitHub Actions and Kubernetes to prevent queue bottlenecks, eliminate resource collisions, and automate cleanup.
Sandboxing Autonomous AI Agents and MCP Tool Executions in CI/CD
How to engineer defense-in-depth security perimeters around autonomous AI coding agents, Model Context Protocol servers, and automated code generation pipelines.
Scaling GitHub Actions Runners on Kubernetes with Actions Runner Controller
A comprehensive guide to deploying ephemeral self-hosted GitHub Actions runners using Actions Runner Controller ARC, AutoScalingRunnerSets, and rootless container isolation.
The Attention Trap & The Supply Chain: Modern Data Breaches, NPM Poisoning, and Digital Wellness
A technical analysis of how mass data broker leaks, cloud warehouse compromises, and NPM open-source supply chain attacks are fueled by the attention economy, and how to harden your stack.
The Uptick in Cyberattacks: Why Old Defenses Are Breaking and How I Protect My Stack
A look at the recent surge in AI-augmented attacks, session-hijacking, and automated bot scanning, and the practical zero-trust patterns I use to protect Digital Amanah and my infrastructure.
Scaling Multi-Environment EKS GitOps with ArgoCD ApplicationSets and Kustomize
How to eliminate YAML duplication and manage multi-cluster Kubernetes deployments across dev, staging, and production using ArgoCD ApplicationSets and Kustomize components.