Skills · hands-on, from a running platform

What I actually operate

Every card below is a capability I use to run AutomationLab as if it were production. Each one links to its own writeup: what it is, how I wire it into the lab, the architecture, what broke and what I learned. 27 capabilities cataloged, with the diagrams and screenshots on each writeup still filling in.

6 categories 27 capabilities 1 lab, operated end to end

See how it is all planned →

Platform & Orchestration

Kubernetes / K3s Lightweight K3s cluster that runs the platform's services. Read writeup → Proxmox VE Five-node HA cluster; the metal every VM is provisioned onto. Read writeup → Terraform Per-VM workspaces provision infrastructure from declared state. Read writeup → Ansible Post-provision configuration and role-based host hardening. Read writeup → Helm Packaged, versioned releases for cluster workloads. Read writeup →

CI/CD & GitOps

Jenkins Config-as-code controller that drives every provisioning pipeline. Read writeup → Kaniko Daemonless, in-cluster container image builds. Read writeup → Argo CD GitOps reconciliation keeps the cluster matching git. Read writeup → Gitea Self-hosted git, PRs, and branch protection as the source of truth. Read writeup → Pipelines The provisioning flow itself: allocate, plan, approve, configure. Read writeup →

Security & Identity

HashiCorp Vault AppRole-brokered secrets for every pipeline and service. Read writeup → Active Directory On-prem identity and the automated user lifecycle. Read writeup → AD CS / PKI Internal certificate authority backing trust in the lab. Read writeup → Entra ID Hybrid identity synced from on-prem AD via AD Connect. Read writeup → Duo MFA Multi-factor enforcement on privileged access paths. Read writeup → DevSecOps Security scanning as required checks in the merge path. Read writeup →

Observability

Grafana Dashboards over the lab, including a custom Infinity data source. Read writeup → Prometheus Metrics collection and alerting rules for cluster health. Read writeup → Zabbix API-driven monitoring with a classify-and-heal engine. Read writeup → Incident & Postmortem Blameless practice: real outages, real writeups, real fixes. Read writeup →

Networking & Edge

Cloudflare Tunnel / Access Zero-trust edge: outbound tunnel plus SSO on every app. Read writeup → OPNsense Firewall and routing between segmented VLANs. Read writeup → Split-horizon DNS One name, two answers: internal vs. external resolution. Read writeup → VLANs Segmented network design separating infra, compute, identity. Read writeup →

Automation & Tooling

Python tooling The glue scripts that automate the pipelines end to end. Read writeup → Job-search platform A self-hosted app built and operated on the same platform. Read writeup → NetBox IPAM Source-of-truth IP allocation feeding the provisioning flow. Read writeup →