Cloud & network
infrastructure, built
and troubleshot.

A command-line tool that parses AWS-style inventory, security group rules and VPC Flow Log samples, then reports where the environment is exposed.

• Detects publicly reachable SSH, RDP and database ports, open S3 buckets, weak encryption posture, privileged IAM users without MFA and stale access keys.
• Correlates repeated rejected traffic against administrative ports from flow log samples to surface probable scanning activity.
• Emits Markdown reports with severity, supporting evidence, a risk score, remediation steps and CIS AWS Foundations Benchmark v1.4.0 mappings.
• Built with argparse, ipaddress, dataclasses and pathlib, with detection logic covered by unittest.

An async CLI that monitors host reachability and TCP service ports from a YAML inventory, stores history in SQLite, and alerts only when a host actually changes state.

• Checks every host by ICMP ping and TCP connect concurrently with asyncio, recording each run to SQLite with uptime percentage and average latency.
• Alerts on the transition — up→down or down→recovered — instead of every poll, so a host down for an hour produces one alert, not twelve.
• Posts a JSON payload to a Slack or Discord style webhook and writes a structured log line; still logs transitions when no webhook is configured.
• Generates CSV and self-contained HTML reports, and exits non-zero when any host is down so it works as a health gate in cron or CI.
• Runs on a systemd timer; core uses only the Python standard library, so the single dependency is a YAML parser.

Campus LAN, branch interconnect and small-enterprise designs built from scratch on routers, L2/L3 switches, servers and end hosts — then deliberately broken and repaired.

• Configured VLANs, 802.1Q trunking, inter-VLAN routing, STP root bridge selection and EtherChannel to segment traffic and remove Layer 2 loops.
• Deployed static routing, RIPv2, OSPF and EIGRP; verified adjacencies and path selection; resolved missing-route, mismatched-network-statement and wrong-mask faults.
• Implemented NAT/PAT at the internet edge plus DHCP pools and relay, DNS, NTP and Syslog, validated with ping, traceroute and show commands.
• Hardened devices with ACLs, port security, DHCP snooping, SSH, privilege levels and banners; performed IOS backup, restore and upgrade procedures.
• Produced topology diagrams, IP addressing plans and fault-resolution notes for every lab to support repeatable handover.

The cloud half of the same discipline: design an address plan, deploy it, then work out methodically why a host is unreachable.

• Designed VPC address plans covering CIDR allocation, public/private subnets, route tables, Internet Gateway and NAT Gateway.
• Isolated faults caused by incorrect route entries, Security Group rules, NACL rule ordering, missing public IP assignment and key-pair issues.
• Reviewed VPC Flow Logs, CloudWatch metrics/logs, CloudTrail events and AWS Config records to trace rejected traffic and confirm configuration changes.
• Administered instances without open SSH using Systems Manager Session Manager, Run Command and Parameter Store.

A reusable, parameterised CloudFormation baseline for a hardened VPC and EC2 instance — the secure default I reach for instead of clicking through the console.

• Builds a VPC with public and private subnets, routing and VPC Flow Logs enabled from the start.
• No open SSH port. Access is via Systems Manager Session Manager only, using an instance profile rather than key pairs.
• Validated in CI with cfn-lint and Checkov, so infrastructure misconfiguration is caught before deploy.
• Fully parameterised for reuse across environments rather than hardcoded to one account.

A FastAPI service that ships to AWS ECS Fargate on every push to main — with no long-lived AWS credentials anywhere in the repository or in GitHub secrets.

• Authenticates to AWS with GitHub OIDC federation. The deploy role's trust policy is scoped to this one repository, and grants only ECR push, task-definition registration and one service update.
• Trivy fails the build on CRITICAL or HIGH findings, so a vulnerable image never reaches ECR. Images are immutable and scanned on push.
• Terraform provisions VPC, ECR, ALB, ECS Fargate and CloudWatch — and passes Checkov with zero failures, with an inline documented reason on every deliberate skip.
• ECS tasks accept traffic only from the ALB security group, so the service is never directly reachable from the internet.

A FastAPI service taken the whole way from container image to an orchestrated, autoscaled deployment provisioned by Terraform.

• Containerised a FastAPI service exposing health and metrics endpoints.
• Wrote Deployment, Service, ConfigMap, Secret and HorizontalPodAutoscaler manifests.
• Automated build, Trivy vulnerability gate and OIDC-ready deployment through GitHub Actions.

A searchable public documentation site holding everything I learned across the programme — deployed, indexed and used by fellow re/Start students.

• 36 lecture notes and 11 weekly summaries spanning Linux, Bash, Python, SQL, networking, security, databases, SysOps and AWS services.
• Static generation with Markdown metadata parsing, fuzzy search over a generated index, table-of-contents navigation and syntax-highlighted code blocks.
• Shipped with SEO metadata, sitemap, robots.txt and security headers — plus Vercel Analytics and Speed Insights.