Featured infrastructure, networking, and security work — followed by selected coursework and lab projects.
Three-node K3s on OCI ARM compute — the platform behind everything else.
Multi-node K3s on Oracle Cloud Always-Free ARM instances. Ingress-NGINX with cert-manager handles TLS; external DNS routes traffic by hostname. Designed so that each public service gets a clean ingress + cert story rather than ad-hoc port forwarding.
My documentation platform, self-hosted on the OCI K3s cluster.
BookStack deployed as a Kubernetes workload with persistent storage, ingress, and TLS via cert-manager. Public read; authenticated write. Backups cover both the database and uploaded assets. The docs site documents the cluster it runs on — closing the loop.
A small public service designed with real segmentation and an isolated admin path.
Service plane lives in a dedicated DMZ-style VLAN. Public ingress goes through a playit tunnel — no port forwards on the home network, no assumption of a public IPv4. Admin access is Tailscale-only, separate from the public surface. systemd hardening, restricted user, and scheduled backups round out the operational story.
A segmented, wireless-first network — not consumer Wi-Fi.
UniFi Cloud Gateway Max + U7 Pro Max. VLANs separate trusted LAN, IoT, guest, and the MC-DMZ service plane, with restrictive east-west rules. Per-SSID VLAN tagging, WPA3 where supported, and a CGNAT-aware approach to any public exposure.
Class labs and earlier experiments. Kept here for completeness — the featured projects above are where the real work lives.
Baseline hardening exercises on Debian / Ubuntu — users, SSH, firewall, services.
Firewalling and intrusion detection coursework — rule design and traffic inspection.
Hands-on routing, switching, and VLAN exercises from CNIT coursework.
Smaller self-hosted services tested on the K3s cluster before promotion or retirement.
Open to internships in IT, Cybersecurity, or Network Engineering.