Platform & DevOps Engineer — GitOps, Kubernetes, and end-to-end infrastructure automation.
From bare-metal provisioning with Terraform to self-healing Kubernetes clusters managed by ArgoCD. I build platforms that are declarative by design, secure by default, and automated end to end — this site runs on the very homelab it describes.
I treat infrastructure as a product. My focus is architecting resilient, production-ready systems where manual intervention is the exception, not the norm — from the OS layer up to application configuration, every piece is declarative and version-controlled.
Everything below runs in a single-operator homelab I built and operate as real infrastructure: bare-metal Proxmox hosts, an immutable Talos Kubernetes cluster, GitOps delivery via ArgoCD, a signed-and-attested CI supply chain, and custom tooling where off-the-shelf didn't fit. It's not a demo — it's the platform, and it's the proof.
The projects below aren't isolated demos — they're the moving parts of a single platform. Terraform, Ansible, and Komodo provision the physical layer: a dozen service hosts and the VMs of an immutable Talos Kubernetes cluster. On top of it, ArgoCD reconciles every workload from Git, pulling cosign-signed Helm charts from a private OCI registry and secrets sealed by a purpose-built Go CLI.
Two hub repos govern everything else: a CI/CD component catalog owns the pipeline logic every repo includes at a pinned version, and a central Renovate runner owns dependency policy for the whole estate. The same machinery publishes the proof — every repo passes through a sanitize-and-verify pipeline before being mirrored publicly to GitHub.
A self-healing, production-grade Kubernetes platform on immutable Talos Linux, managing the entire cluster state declaratively through ArgoCD with an app-of-apps pattern — 23 applications across four sync-wave tiers, all reconciled from Git.
A dedicated hub that publishes 14 versioned, typed-input GitLab CI/CD components — plus one shared toolchain image — consumed by every repo in the estate. Releases are cut automatically from Conventional Commits; every artifact is cosign-signed and ships a syft SBOM attestation.
A from-scratch Go tool that turns declarative YAML secret configs into Kubernetes SealedSecrets. A cobra CLI plus a charm/huh TUI, with a two-pass derive engine, value generators, and a JSON schema for editor autocomplete — built to gate CI without cluster access.
Bare-metal to running services with a clean tool separation and live-state handoff: Terraform provisions, Ansible configures by reading Terraform state directly, and Komodo reconciles committed TOML to running Compose stacks on every push.
17 custom Helm charts authored to a single consistent contract and published to an OCI registry, with a CI pipeline that validates every chart without a live cluster and signs each release with cosign.
The estate's automation backbone: one centralized Renovate runner keeping every repo current, and a sanitized public-mirror pipeline that scrubs private repositories and force-pushes public GitHub mirrors behind a hard verification gate.
A live catalog of services running on the cluster and the Proxmox hosts — all GitOps- or IaC-managed, TLS-terminated, and SSO-gated. (Hostnames are kept private.)
Microsoft
Issued: August 2025
Credential ID: 86F88C248C92836B
Interested in discussing platform engineering, GitOps, or infrastructure automation? Let's talk.