Systems in production, and the roles behind them. Every figure and case links to its full doc.
The front door is public; the compute never is. HTTPS terminates at a shared ALB, PrivateLink carries traffic across the account boundary into a VPC with no public IPs, and an internal NLB fans out to Fargate. Packaged as a reusable Terraform module.
alb·privatelink·nlb·fargate·acm·terraform
No cloud keys exist anywhere in the pipeline. Every run assumes a short-lived IAM role via GitHub OIDC; plans post on the PR, applies wait for a human. Designed once for an org's shared infrastructure and again for a fleet of client sites, plus a guard job that fails loudly instead of letting a skipped run report green.
github actions·oidc·iam·terraform·reusable workflows
Tenancy is enforced by the database, not the app. One template provisions each client site: repo, secrets, tiered features, Amplify + ACM via Terraform, DNS withheld until the certificate verifies. Every site shares one Postgres behind row-level security keyed by per-tenant JWTs; template updates fan out as reviewable PRs to the fleet.
astro·github actions·terraform·amplify·cloudflare dns·supabase rls
Poll at the rate the data actually changes. A dependency-free Python service polls the hypervisor at tiered intervals measured from real API behavior, and streams to the dashboard over SSE with constant fan-out cost. Read-only API role, bound to the WireGuard mesh only. The lab has zero WAN exposure.
proxmox·python stdlib·sse·tailscale·systemd
No child stack knows another's resource IDs. A root stack composes nine children (networking, identity, compute, search, and edge each in their own template) wired together through cross-stack outputs instead of copy-pasted identifiers. The same shape was re-cut across seven production platforms, from the full graph down to a single IAM-governance stack.
cloudformation·nested stacks·cloudfront·waf·cognito·iam
One network for the whole organization, not one per app. Public and private subnets split across all three zones, with NAT gateway creation left as a variable rather than a standing cost. The module is hand-rolled with object-typed ingress and egress rules and published for git-source consumption, so a project pins a ref instead of copying the file.
terraform·vpc·nat gateway·s3 backend
Sole infrastructure author for a small org whose app roadmap was shelved before launch. I built the ground the apps were meant to stand on: a shared 3-AZ VPC, an in-house Terraform module library, and OIDC-based GitHub Actions pipelines that have never held a stored AWS credential. Written, validated, and dry-run against a real account; no application ever deployed on it.
infra·network·ci-cd
A solo-built, multi-tenant wedding-invitation platform (deliberately hand-built per client rather than self-serve SaaS) with four templated site designs, a shared row-level-secured Postgres layer, and a dispatched pipeline that provisions a new tenant end to end on Terraform and GitHub Actions.
ci-cd·infra·app-delivery
Thin, versioned Terraform stacks consuming shared reference-architecture modules to run three internal application platforms on ECS Fargate with RDS PostgreSQL 17 behind RDS Proxy.
infra·ci-cd
A hub-and-spoke landing-zone network: a public ALB fronting private ECS Fargate services over PrivateLink, plus a hardened SFTP-to-S3 bridge for external file exchange.
network·infra
Focused containerization, delivery-pipeline, and Helm chart contributions to two larger platform teams' systems: a .NET retail-reporting app and a Kubernetes microservice platform.
ci-cd·app-delivery
A document repository for researchers, built solo and entirely through the AWS console, including an asynchronous text-extraction pipeline (SQS · Lambda · Textract) I designed and then deliberately cut for cost, folding extraction back into the application once the expected load didn't justify a serverless fan-out. The same platform was rebuilt as infrastructure-as-code in the role that followed.
infra·app-delivery
Infrastructure engineer across seven production AWS platforms built for a software house's clients. Sole author of most, and the provisioning engineer on the largest: a ministry's AWS landing zone of three workload accounts, whose design came from an AWS principal architect. One nested-stack CloudFormation pattern, re-cut per platform, from a full nine-stack web build down to a single IAM governance stack.
infra·network