Solutions Engineer → DevOps
runs a family media platform and a DevOps lab off three machines in the same rack.
Building a 3-node Proxmox homelab, GitOps pipelines, and infrastructure-as-code. Solutions Engineer by day, DevOps by night.
pg. 01 — profile
Collection · pg. 02
Currently a Solutions Engineer in Hong Kong, building homelab-infra on the side — a 3-node Proxmox cluster that's both my family's private cloud and a production-grade DevOps playground: Terraform, Ansible, K3s, ArgoCD, and CI/CD, all as code.
"Live like no one else today, so that you can live like no one else tomorrow." — Dave Ramsey
Collection · pg. 03
Collection · pg. 04
A 3-node Proxmox cluster, built in public — a family media platform and a DevOps playground, everything as code. All three tiers are live: the family tier (Jellyfin, Nextcloud, Jellyseerr with Jellyfin SSO, Immich photo backup, self-healing media automation) after a zero-downtime cutover; the core-infra tier — self-hosted DNS, reverse proxy, Prometheus/Grafana/Loki observability with live email alerting, and GitLab CE; and the lab tier — a 3-node K3s cluster with ArgoCD and Traefik Ingress, workloads packaged as Helm charts, commit-to-deploy proven end to end. A self-hosted GitLab Runner gates every push with five checks, including Trivy security scanning, and a real Proxmox Backup Server restore drill — 12 minutes, full app stack recovered — proved the recovery story instead of just claiming it. VLAN segmentation is rolling out zone by zone; the first timed lab teardown drill is next. If it isn't in git, it doesn't exist.
Traffic enters through a Cloudflare Tunnel (no open ports) to three public apps — Jellyfin, Nextcloud, and Jellyseerr (Jellyfin SSO, requests need approval); every admin plane, including Immich's photo backup, is Tailscale-only. All three tiers are clustered and live: k8plus (family-prod — Jellyfin, Nextcloud, Jellyseerr, Immich), g11 (core-infra — DNS, reverse proxy, Prometheus/Grafana/Loki with email alerting, GitLab CE, and a GitLab Runner gating every push with lint, validate, and Trivy security scans), and the MacBook (lab — a 3-node K3s cluster with ArgoCD and Traefik Ingress, workloads as Helm charts, commit-to-deploy proven end to end). A PBS restore drill has already proven the family tier's recovery path, and even the LXCs' logs now ship to Loki. A MikroTik managed switch is in place, with VLAN segmentation rolling out zone by zone and a JetKVM for out-of-band console.
A 10-inch rack — printed by me, designed by the MakerWorld community. Small enough for a desk, rigid enough to hold real hardware: this is where the rest of this page actually runs. The third node, the MacBook Pro, sits right on top.
Printed from KWS Rack V2, MikroTik rack ears, GMKtec rack mount, and a universal rack shelf — all open designs on MakerWorld.
The pipeline is already proven — one git push travels
through CI, Trivy security scans, and ArgoCD to a live Kubernetes
rollout with no kubectl. This card is just waiting on the
screen recording of it, end to end.
Grafana Fleet Overview (system health) and a public Uptime Kuma status page (service uptime) are both live — real infra, watchable in real time.
./demo.sh up stands up a mini k3s lab on AWS spot in ~4
minutes and prints a live URL; ./demo.sh down tears it down —
a few cents per run, nothing left behind.
Collection · pg. 11