A growing collection of cloud infrastructure projects — each built with production-grade practices: IaC, security by default, and clean architecture.
Real systems running in production — the source is public where it can be.
Multi-site static hosting on AWS — the infrastructure powering this very site. Two S3 origins (portfolio + resume), each fronted by CloudFront with OAC-secured access. Single wildcard ACM certificate with DNS validation, CloudFront Functions for clean URL rewriting, and Route 53 alias records for apex, www, and subdomain routing.
View sourceA modern, pixel-perfect HTML/CSS resume served as a static site on its own subdomain. Demonstrates clean semantic HTML, responsive design, print-friendly styling, and zero-server architecture with CloudFront CDN delivery.
View liveA live commercial cleaning business site plus an installable invoice and proposal PWA on its own subdomain. The app works offline via a service worker, installs on Android through a PWA manifest, persists drafts in localStorage, and sends finished documents through the Web Share API. Both properties are static assets on S3 behind CloudFront, provisioned by Terraform.
View liveA containerized FastAPI service on AWS App Runner with least-privilege S3 access. Terraform provisions the ECR repository, a private SSE-S3 encrypted bucket with 30-day lifecycle expiration, and an IAM instance role assumed via tasks.apprunner.amazonaws.com — scoped to exactly one bucket, with health checks and environment configuration wired in.
Terraform skeleton and helper tooling for standing up an AWS Organization with an OU and account layout suitable for bootstrapping Control Tower — the multi-account landing-zone problem solved from code rather than the console.
An ongoing set of working reference implementations across providers and tools: AKS on Azure and Elastic Beanstalk on AWS in Terraform, WordPress on Azure, EKS and general AWS provisioning in Pulumi across TypeScript, Python, and C#, plus Ansible playbooks for home-lab configuration management. Deliberately spread across stacks — the point is comparing how each tool models the same problems.
Full applications — self-hosted, in daily use, and built end to end rather than scaffolded and abandoned.
Browser-based administration interface for Dovecot/Postfix mail servers, built with FastAPI, HTMX, and Tailwind. Handles user administration, mail queue inspection, log analysis, IP blocking via UFW, disk capacity tracking, and threshold-based alerting. Security-hardened: an unprivileged web process talks to a root-level helper daemon over a Unix socket with strict input validation and command allowlisting.
View sourceA self-hosted network monitoring dashboard — FastAPI backend, React frontend, packaged as a single Docker container. Monitors HTTP, HTTPS, and TCP services with live updates, seven-day uptime history, incident tracking, and webhook alerting. A multi-architecture image (amd64 and arm64) publishes to GHCR on every push, so it runs unchanged on x86 servers, Raspberry Pi, and Apple Silicon with no build toolchain on the host.
View sourceA privacy-first, self-hosted platform for managing properties, assets, vehicles, and maintenance schedules. Next.js 15 and React on the front, tRPC for end-to-end type safety, PostgreSQL with PostGIS for spatial data, Redis and BullMQ for the job queue, MinIO for object storage. Includes an AES-256 encrypted document vault, SVG floor plans and Leaflet yard maps, weather freeze alerts, irrigation controller integrations, and multi-user households with role-based access. Runs on Docker Compose behind Traefik with automatic SSL.
A Windows desktop app that consolidates per-user Immich sync shares into one canonical family archive, deduplicating by content rather than timestamp. Sync state is a SQLite content-hash manifest — size prefilter, then SHA-256 — because Immich rewrites mtimes. Placement is EXIF-driven with folder and mtime fallbacks; Live Photo pairs move atomically. Every copy runs as temp write → hash verify → atomic rename → journal, so a failed run halts cleanly and resumes, and any run can be undone with per-file verification. Core library and WPF app are split, with an xUnit suite including an end-to-end scenario test.
Hands-on work with the emerging agent stack and self-hosted inference — understanding a technology by running it, not reading about it.
Working implementations of six AI agent protocols — Model Context Protocol (MCP) for tool and data connectivity, Agent-to-Agent (A2A) for discovery and inter-agent communication, AG-UI for SSE streaming of agent events to frontends, and three more — each as a self-contained runnable module. Built as a hands-on study of how the emerging agent interoperability stack actually fits together.
Ongoing hands-on evaluation of self-hosted and local-first AI tooling: running Qwen models on local hardware, wiring local inference into VS Code and OpenCode, and deploying and troubleshooting a self-hosted LibreChat stack. Same theme as the rest of the home lab — understand the operational reality of a technology by running it yourself.
The full record — every role, project, certification, and technology — lives on the complete CV →