Infrastructure and Security Lead. I build and run the platforms, and I secure them while I'm building them instead of bolting security on afterward. Day to day that looks like hypervisors, Kubernetes, IaC pipelines, identity, detection, and the compliance work that ties it all together. After hours it's a homelab that runs like production, open source security tooling, and self-hosted servers for my family and friends.
- Taking pisentry from v0.1 toward 1.0. A versioned rule schema and drop-in rules in
rules.dare landing now. - Contributing upstream to OpenSign, the open source DocuSign alternative (docs and Docker deployment).
- Building WoW 3.3.5a addons and contributing to AzerothCore modules in the mod-playerbots ecosystem.
- Studying for AZ-500, KCNA, and KCSA, and looking at Talos and Omni for the next version of the cluster.
Mixed-architecture k3s cluster on three Raspberry Pi 4s (Debian 13) and a Lenovo ThinkStation (RHEL 10.1). Everything is managed through FluxCD from MrGuato/pi-cluster with separate base and staging overlays, so I never really touch the cluster directly. Secrets are encrypted with SOPS and age and committed right into the repo. Cloudflare Tunnel gets traffic in with zero open ports, Longhorn does the block storage, and Velero backs everything up to MinIO on a separate node. Falco watches the container runtime and pisentry runs as a DaemonSet watching the hosts underneath. The dashboard above is pulling from kube-prometheus-stack.
A rough map of where I spend my time and the tools I tend to reach for.
| Area | Notes |
|---|---|
| Kubernetes | k3s, Helm, FluxCD, Kustomize, Longhorn, Velero, Falco. Currently looking at Talos and Omni. |
| IaC | Terraform, Ansible, and Packer. I usually build golden images with Packer, spin them up with Terraform, and let Ansible handle the config drift. |
| CI/CD and supply chain | GitLab CI and GitHub Actions, with Flux for GitOps. Scanning (SAST, SBOM, container, IaC) runs as real gates so things fail fast, and what I ship goes out as signed GHCR images with build provenance, CodeQL, and OpenSSF Scorecard. |
| Virtualization | vSphere and Proxmox. Hardened base images and automated patching. |
| Network | FortiGate, Palo Alto, Ubiquiti, Cisco. Zero-open-port ingress with Cloudflare Tunnel wherever I can get away with it. |
| Identity | Entra ID, Conditional Access, and least-privilege IAM across Azure and AWS. |
| Detection and response | Sentinel, SentinelOne, Rapid7, Defender XDR, and Tines for SOAR. On the host side I write my own detections, mapped to MITRE ATT&CK. Good telemetry usually makes detection a lot easier. |
| Compliance | CMMC Level 2 and NIST 800-171 in practice, plus CIS v8, NIST CSF 2.0, and Zero Trust. |
| Code | Go for security tooling, Bash for anything that runs in a container, Lua for WoW addons, and JavaScript for the dashboards and sites around all of it. |
Repo · Website · Releases · Container
My main open source project. A single static Go binary that watches a small Linux host for the ten attacks that hit it most (SSH brute force, suspicious logins, privilege escalation, persistence, cryptominers, reverse shells, file tampering and more), ranks them, and tells you where to look first. Standard library only, about 12 MB resident, under 1% CPU on a 2 GB Pi. Output goes out as Prometheus metrics, JSON events, a terminal Top 10 report, and push alerts to ntfy, Discord, Slack, or any webhook. It runs as a hardened systemd service or a Flux-managed DaemonSet, right next to Falco: Falco covers the container runtime, pisentry covers the host.
My homelab cluster, fully declarative. Flux reconciles apps and infrastructure from Git, SOPS-encrypted secrets live in the public repo, and Renovate keeps image tags fresh with automated PRs. Velero does backups out to MinIO on a separate node, and Longhorn handles distributed block storage across the ARM and x86 nodes. It also hosts Forgejo, Docmost, Vikunja, linkding, Headlamp, and my notes site. The live dashboard at the top of this README runs on it.
A running journal of GitOps and DevOps experiments, built with Astro and served from the cluster. Writeups and lessons from the homelab, including the failures and not just the happy path.
A Valheim dedicated server I host for family and friends, packaged so I can stop thinking about it. One CLI for setup, start, status, logs, backup, restore, and update, all driven from a single .env. Runs as non-root, saves cleanly on shutdown, takes verified backups with retention, and patches the game on every start so the image never goes stale. Opt-in BepInEx for mods. Our world is past 300,000 objects and still running on it.
The companion dashboard for that server, built because the group chat kept asking "who's on?" Server status straight from Steam's query, the in-game day, boss progression, weekly playtime and death leaderboards, a play-time heatmap, and armory-style profiles with a 3D voxel figure wearing each player's real gear. Runs in Docker next to the server.
The Enshrouded sibling of my Valheim server. Enshrouded only ships a Windows dedicated server, so the image runs it under Wine and Xvfb, forces SteamCMD to fetch the Windows build, and patches the game on every start. One ./enshrouded CLI covers setup, status, logs, updates, backups and restores, settings and Admin/Friend/Guest role passwords come from a single .env, and a one-line installer takes a fresh Linux host to a running server. Non-root, nightly Watchtower updates, and every change goes through hadolint, shellcheck, CodeQL, gitleaks and Trivy. Getting Xvfb lock files and SteamCMD to behave in a clean container was more fun than I expected.
A WoW 3.3.5a addon for mod-playerbots. Raise a whole dungeon or raid group from a template in one click, give orders by role or to a single bot, and switch each bot's strategies with checkboxes, all from one panel and a pinnable command bar.
DialedInUI · CurseForge and NodeNotes · CurseForge
Two published addons. DialedInUI gives you one-click layouts for Blizzard's own UI: pick from ten popular setups, preview them, apply through Edit Mode, and undo any time. NodeNotes remembers every herb and ore node you've gathered, what each one gave you, and lets you pin your own notes to them on the map.
Module contributions · mod-dungeon-clear and its addon
Upstream work on an AzerothCore module that teaches playerbots to clear dungeons and raids: new boss handling for Arlokk and Ouro, raid fixes from Blackwing Lair, and a new event status state in the companion addon.
A serverless site on S3, CloudFront, Lambda, API Gateway, and DynamoDB, all provisioned through CloudFormation with least-privilege IAM and a proper deploy pipeline.
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |