~/projects
Each project is labeled honestly. Production case studies (8) are sanitized write-ups of work from my CV — client names, domains and figures are withheld. Portfolio implementations and reference architectures are built on synthetic data. A separate badge shows whether the code is published and validated (20 so far).
Showing 20 of 20 projects
01
Active/passive EKS across two regions with a managed promotion path
A warm-standby disaster recovery design for a stateful Kubernetes workload: two regional EKS clusters, an Aurora PostgreSQL Global Database, replicated object storage and an explicit, runbook-driven failover.
02
Queue-mode n8n with KEDA scale-to-zero workers
n8n split into main, webhook and worker workloads on Kubernetes, with Redis/Valkey as the job queue, PostgreSQL for state, and KEDA scaling workers on queue depth — including down to zero when idle.
03
Moving container workloads from x86 to ARM64 without a big bang
A staged migration from AMD64 to Graviton: multi-architecture images, ARM64 build agents, mixed node groups, compatibility testing and a rollback path that is one scheduling change away.
04
Multi-account foundation with guardrails, central logging and IaC
An AWS Organizations layout with security, logging, shared-services and workload accounts, SCP guardrails, IAM Identity Center access, centralized CloudTrail and a VPC baseline — all from Terraform modules.
05
ArgoCD + Helm with promotion by pull request
CI builds and signs images; a separate config repository holds the desired state per environment; ArgoCD reconciles clusters to it, detects drift, and rolls back by reverting a commit.
06
Security gates from commit to registry
A pipeline that runs secrets scanning, SAST, dependency and image scanning, DAST against a preview environment and SBOM generation, and blocks promotion on policy failures.
07
GKE platform for an AI-assisted healthcare application (anonymized)
Infrastructure for a Java-based, AI-assisted pharmacy application on Google Cloud: private GKE, Cloud SQL, Secret Manager, Cloud Build and Artifact Registry, with logging and monitoring built in.
08
AKS with Workload Identity, Key Vault and Azure DevOps
A reference AKS platform: hub-and-spoke networking, private AKS, Azure Container Registry, Key Vault through the CSI driver with Microsoft Entra Workload ID, and Azure DevOps pipelines.
09
EKS, AKS and GKE compared through one deployment model
The same Helm-packaged service deployed to all three managed Kubernetes offerings, documenting where they genuinely differ: identity, networking, ingress, logging and cost.
10
API Gateway, Lambda, SQS and EventBridge with idempotency and DLQs
An order-style event pipeline: an API that accepts requests, a queue that absorbs bursts, idempotent consumers, fan-out through EventBridge, and dead-letter queues with alarms.
11
Metrics, logs and traces with SLOs that drive alerting
Prometheus, Grafana and OpenTelemetry with SLIs defined per user journey, multi-window burn-rate alerts instead of threshold noise, and an incident process tied to error budgets.
12
Regulated payments platform across AWS and on-premises VMware (anonymized)
A hybrid design for a high-availability payments platform: Kubernetes workloads on AWS, systems of record on-premises on VMware, private connectivity, segmented networks and tested backup and DR procedures.
13
AWS WAF, detective controls and policy as code
AWS WAF with managed and rate-based rules managed in Terraform, GuardDuty and Security Hub findings routed to responders, secrets rotation, and policy-as-code checks on infrastructure changes.
14
Reproducible cost analysis over a billing export, plus Terraform guardrails
A local, dependency-free toolkit that reads a FOCUS-style billing export and produces cost allocation, rightsizing and Graviton candidates, Savings Plans sizing, a budget gate and a forecast — with Terraform for AWS Budgets and anomaly detection.
15
Log anomaly detection with guardrailed, human-approved remediation
A Python pipeline that detects log anomalies deterministically, correlates them with deploys and alerts, optionally drafts an incident summary with an LLM, and proposes — never executes — remediation without human approval.
16
CodeBuild with security gates, immutable images and approval-gated ECS releases
An AWS-native delivery pipeline: CodePipeline V2 pulls from GitHub, CodeBuild tests, builds and scans the image, pushes an immutable SHA tag to ECR, deploys to ECS Fargate staging, and promotes to production after manual approval — with automatic rollback.
17
Immutable backups, cross-region copies and restores that are tested, not assumed
Centralized backup with AWS Backup: tag-based plans, copies to a second region under a different KMS key, vault lock against deletion, native restore testing with an automated validator, and an RPO/RTO report computed from job history.
18
Private origin, security headers, smart cache invalidation and keyless CI deploys
A production-shaped static hosting stack: a private S3 bucket reachable only through CloudFront Origin Access Control, security response headers, a tested URL-rewrite function, ACM and Route 53 automation, and GitHub Actions deploying through OIDC with a role scoped to one bucket and one distribution.
19
Test before traffic, shift gradually, roll back on alarms
Multi-environment ECS Fargate services on Graviton deployed with CodeDeploy blue/green: new tasks are smoke-tested on a test listener before any user traffic, traffic shifts all-at-once in dev, linearly in staging and by canary in production, and alarms on error rate or latency roll back automatically.
20
No secrets in images, env vars or etcd — mounted files that rotate live
Applications on EKS read credentials from AWS Secrets Manager as read-only mounted files through the Secrets Store CSI Driver, authenticated with EKS Pod Identity and an IAM role that can read exactly two secrets. Rotated values are picked up without a restart, and CI scans for secrets that slipped into manifests or code.