My Projects

Some of the projects and recent work I have built and run in production. Start with the EKS migration if you only read one.

Start hereClient · ChainGPT

Legacy Platform → Consolidated EKS

Scattered ECS, EC2, Lambda, and per-account stacks onto two GitOps-managed clusters.

Problem

Workloads lived across AWS accounts — ECS, EC2, Lambda, extra ALBs, no shared GitOps.

Owned

Target platform, Terraform EKS, Istio, Karpenter, and the production cut-over.

Result

Two GitOps clusters; private-by-default APIs; fewer load balancers and log forwarders.

AWS EKSTerraformArgo CDFluxCDIstioKarpenter

Read write-up

Client · Normies & ChainGPT

Reusable GitHub Actions Deploy Platform

One pipeline for every service — security gated, health-checked, auto-rollback, and notified.

Problem

Every repo invented its own deploy YAML. Green CI meant the image pushed, not that the cluster was healthy.

Owned

Reusable workflow_call suite: OIDC, scan, GitOps bump, health gate, auto-rollback, notify.

Result

New service is config. CI green means the cluster is healthy — and a failed gate rolls itself back.

GitHub ActionsOIDCECRTrivySemgrepArgo CD

Read write-up

Client · ChainGPT

Dotfun Agents Platforms

Multi-tenant agent factory on EKS — GitOps provision, in-cluster mesh, DNS at the edge.

Problem

Thousands of tenants only works if create and destroy are APIs, not git commits and DNS tickets.

Owned

Path from activate to a healthy public URL — Argo CD as an API, Helm, ExternalDNS, Cloudflare.

Result

Isolated agents with their own hostname; teardown prunes compute and DNS.

AWS EKSArgo CDHelmKustomizeExternalDNSCloudflare

Read write-up

Client · Normies

Private by Default Service Mesh

One Istio mesh, two gateways: public traffic through the edge, internal traffic never leaving the VPC.

Problem

Internal APIs sat behind public load balancers, and every internal hostname needed its own certificate.

Owned

The private path: Istio internal gateway, AWS Private CA, ACM wildcards, private NLB, and private DNS.

Result

Internal services are unreachable from the internet, and a new one is a routing rule rather than a new load balancer.

AWS EKSIstioAWS Private CAACMRoute 53Network Load Balancer

Read write-up

Client · ChainGPT

Private IPFS Cluster on Wasabi S3

Terabytes of blocks on object storage, not SSDs.

Problem

A disk-only replica holding millions of pins used about 6–7TB locally — expensive to scale and recover.

Owned

Private IPFS Cluster with hybrid disk + Wasabi S3 block store, GC, and pin-set ops.

Result

S3 replicas stay ~100GB local; pins stay in sync across regions without another 7TB volume.

IPFS KuboIPFS Clustergo-ds-s3DockerWasabi S3LevelDB

Read write-up

Client · ChainGPT

Self-Hosted BSC Full Node (Internal RPC)

In-house BNB Smart Chain RPC — cheaper than paid providers, keyed, rate-limited, and actually monitored.

Problem

Backends sat on paid public RPC. The in-house node was stale, paging falsely, and had no API keys.

Owned

Snapshot restore, pruneancient, keyed gateway, and alerts that check eth_syncing first.

Result

Internal RPC on the hot path; noisy clients get 429; pages match real lag vs chain tip.

UbuntuDocker ComposeBSC GethPBSSJSON-RPCHAProxy

Read write-up