Linux, virtualisation, and the automation that keeps a platform changeable.

Linux and production operations

Debian/Ubuntu and RHEL-family: systemd, hardening, patch policy, and diagnosis with ss/ip/nstat rather than guesswork.

Virtualisation and hosting

Virtuozzo/OpenVZ container hosting and VMware vSphere in production; KVM underneath both, Proxmox VE on my own estate.

Infrastructure automation

Ansible with an executable inventory and reviewed changes, plus CI that fails the build instead of printing a warning nobody reads.

Networking and edge

Routing, DNS, VPN, NAT, firewall zones, reverse proxy and TLS termination.

Reliability practice

Incident ownership, blameless root-cause analysis, runbooks, and restore rehearsal treated as the real backup control.

Cloud architecture

AWS Solutions Architect - Professional. Azure exposure is limited to roughly 2-3 months, and I say so rather than implying otherwise.

Cloud Systems & Operations Engineer

Scaleforce · Nov 2023 - present · 3 yrs · Ireland, remote

Production cloud and hybrid infrastructure across two data centres: Linux hosts, Virtuozzo/OpenVZ containers and the interconnect between them. Incident owner and escalation point on a 24/7 shift-covered service. Previously Cloud Lead Engineer / Architect on the same platform, employed in Cyprus.

Independent IT & Cloud Consultant

Self-employed · Aug 2025 - present · part-time

SME and private engagements: DNS and domain architecture, VPS and Linux hosting with security applied at install time, CDN, reverse proxy and TLS termination.

Ansible CI estate

Five roles, seven playbooks and an executable inventory, with validation that fails the build rather than warning: lint escalation, inventory parsing, two-tier secret scanning, and a regression guard for the lint config itself.

Proxmox VE estate

VLAN-aware bridges, isolated guest bridges, SDN/VNet isolation and firewall-path audits on a self-directed estate, with OpenTofu provisioning that validates cleanly, and has not been applied.

Edge router and DNS controls

Tunnel-based remote access with internal services kept private, expected-state assertions with a drift check, and a DNS chain of forwarder → DNSSEC validator → encrypted upstream. The OpenWrt control plane itself is designed, not cut over.

MCP Gateway (AI Agent Tool Bridge)

One authenticated endpoint over 53 tools (GPU inference, RAG memory, Docker, browser), with every backing service kept LAN-only, per-principal tool ACLs, and published latency and guardrail measurements.

Ariadne: CV parsing research

Dependency-free Python parsing research: deterministic extraction with typed failure codes, a fact ledger with two hashes per fact, and a source register that grades every claim A/B/C/U. No score is offered, because the A-graded evidence it cites shows a ranking function of this class reverses 29.6% of competence-preserving pairs.

Portfolio pipeline

The path this site is built by: a private source repository, a checker that proves it can fail before it is allowed to pass, a 15 ms Hugo build, and a one-way force-publish to Pages. 62 source files in, 11 artifact files out, 6 green runs.