Infrastructure & Automation Engineer

I build and operate self-hosted infrastructure — virtualisation, containers, network edge, and the automation that keeps it running.

I run a self-hosted estate of 20+ services across virtualisation, containers and a hosted edge — and I document the failures as carefully as the successes. Below are the problems that taught me the most.

United Kingdom Open to infrastructure / platform / SRE roles Remote-friendly

Selected work

Case studies

Each of these is a real incident or build, written as problem → constraints → decisions → outcome. Names and addresses are abstracted.

Migrating 20 public services across a subnet renumber

A LAN renumber invalidated routing for every published hostname at once. DNS looked correct while every route was dead — finding the real failure layer took separating three independent config surfaces.

Cloudflare TunnelZero TrustDNS
23 ingress rules repointed · 20/22 hostnames verified live

Recovering a corrupt SQLite database — and knowing when not to

A media manager began returning HTTP 500. The database was malformed, the most recent backups were also corrupt, and the automatic repair tool produced a file that passed integrity checks but silently destroyed data.

SQLitePythonWindows services
Recovered to integrity-ok with zero row loss

400ms to 30ms: diagnosing DNS that looked correct

Name resolution was slow and some hosts failed entirely. The configured resolvers were valid, publicly reachable, and completely useless from the affected machine — because a VPN was capturing the traffic.

DNSWireGuardWindows networking
~13x reduction in lookup latency · failure eliminated

A torrent pipeline that survives VPN reconnects

Seeding requires an inbound port, and the VPN rotates that port on every reconnect. Keeping the client, the port mapping and the tracker status in agreement needed automation rather than discipline.

ProtonVPNTransmissionRPC automation
Port re-synchronised automatically on every reconnect

Self-hosted media and photo stack on commodity hardware

Photos, music broadcasting, remote desktop and dashboards, all served from a home rack with no cloud dependency — including the edge, the identity and the monitoring.

ProxmoxDockerCIFS
20+ services · single-command recovery · zero monthly cloud spend

The estate

How it fits together

One hypervisor, a container host, a storage share and a hosted edge. No inbound ports are open, and no service is published without terminating at the edge first.

Edge
Hosted tunnel terminates every public hostname. Origin addresses are never published; the tunnel holds the only inbound path.
Hypervisor
Proxmox VE running a container host and supporting guests. Snapshots before change; recovery documented before it is needed.
Container host
Docker with a managed stack, remote storage mounted before dependent services start.
Storage
Network share for media and application data, with hardlink presentation so seeding payload and library files share one copy.
Identity
Access-controlled entry points, per-service credentials, and rotation recorded when it happens.
Observability
Per-container metrics plus endpoint and certificate checks, with alerts on the paths that actually break.
A public architecture write-up is also a reconnaissance document. Everything here is deliberately abstracted: no internal addresses, hostnames, tokens or live screenshots. Topology and decisions are shown; attack surface is not.

Tooling

Stack

Tools I have operated under load, not simply installed.

Virtualisation & containers

Proxmox VELXCDockerDocker ComposeDockhandPortainer

Operating systems

Debian / UbuntuWindows ServerWindows 11systemdSamba

Networking

Cloudflare TunnelZero TrustDNS designTraefikWireGuardVLANPacket analysis

Storage & data

ZFSCIFS / SMBSQLiteMariaDB / MySQLPostgreSQLBackup validation

Automation

PythonBashPowerShellREST / RPC APIsScheduled task design

Observability

NetdataUptime Kumahardware telemetrylog analysis

Contact

Get in touch

Happy to talk through any of the above in more depth — including the parts that went wrong first.