Building Resilient Cloud Infrastructure, Hardened CI/CD Pipelines & Secure Architectures
Hands-on engineering across AWS, Kubernetes, Terraform, Go, Python, and Cloud & Network Security.
Production-grade tools, automated security pipelines, and cloud native architectures.
Declarative Kubernetes infrastructure deployed via Terraform on AWS. Features ArgoCD ApplicationSets for multi-environment syncing, External Secrets Operator (ESO) syncing with AWS Secrets Manager, and Trivy automated container vulnerability gating.
A privacy-first digital safety platform built with Next.js App Router and React Server Components for zero client-side tracking. Features automated markdown content delivery, strict TypeScript type safety, and localized moderation workflows.
A full-stack subscription and recurring expense management platform engineered with a high-performance Go (Gin) REST API, React 18 frontend, PostgreSQL Row Level Security (RLS) policies, and automated email notification jobs.
Zero-long-lived-credentials CI/CD architecture replacing static AWS IAM keys with OpenID Connect (OIDC) identity federation in GitHub Actions, combined with automated Trivy vulnerability scanning and security regression checks.
Why I Replaced Third-Party Analytics with Self-Hosted Umami
As autonomous AI agents and Large Language Models (LLMs) gain tool-calling capabilities—executing database queries, triggering...
Transforming an Old Laptop into a Silent Linux Server & Private AI Homelab
During a recent infrastructure audit, a bizarre CI failure was identified: container image pulls for large automated builds were terminating at exactly the 350-second mark. There was no error from...
Manual dashboard management in Grafana often leads to configuration drift. In a recent initiative, I tackled the migration of over 50 legacy dashboards from an on-prem instance to a modern,...
Static AWS credentials stored in GitHub Secrets represent a significant security liability. If compromised, they provide persistent access until manually revoked. A more secure approach is to migrate to OIDC...
In complex enterprise AWS setups, data storage (S3) and compute resources often reside in different accounts. Configuring this cross-account access securely is a fundamental IAM challenge.
A common and frustrating scenario in Azure Batch occurs when the service principal is healthy and sign-in logs show 100% success, yet the management plane remains inactive. Jobs may be...
As EKS Pod Identity gains traction, many are weighing the trade-offs against the established IAM Roles for Service Accounts (IRSA) pattern. In a recent modernization of a production Kubernetes environment,...
Firewall Configuration for Enterprise Cloud Platforms
For a long time, my main focus with CI/CD was speed. How fast can I get code from a commit to production? It was all about automation and efficiency. Security...
Most token incidents I have dealt with were not sophisticated attacks. They came from basic things like old PATs nobody owned, overly broad scopes, and credentials sitting in too many...
I hit this issue in production: a file was updated in S3 (origin), but Cloudflare kept serving an older cached version.