stuff I figured out the hard way

Cloud infrastructure that just works.

I'm an independent cloud consultant for teams running on AWS, Azure, Google Cloud, Hetzner, or their own VMs. I design, build, secure, and cost-tune your infrastructure — hands-on, alongside your engineers — then hand it over in a state your team can own.

Email me → Read the blog

CKS certified | SOC 2 Type II carried to audit | 8+ years | AWS, Azure, Google Cloud & Hetzner | one senior engineer, start to finish

track record

proof, not promises

I write up the hard problems I solve in production — the numbers, the dead ends, and the fix. Start here:

  1. 1. From $2,500 to $130: Taming Runaway Database Backups

    How I cut backup costs by 95% with a simple Lambda and S3 lifecycle policies

    | rds, backups, aws
  2. 2. SSL Required: Getting CA Certificates Through AWS, Azure, and GCP Secret Managers Intact

    Managed databases that enforce SSL need a CA certificate in every pod. How to store PEM certificates in AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager without mangling the newlines - and mount them with External Secrets

    | ssl, secrets-manager, azure
  3. 3. GitOps Self-Service: Managing 50+ Services with GitHub Actions and ArgoCD

    How I accidentally built an Internal Developer Platform using workflow_dispatch, yq, and ArgoCD for full service lifecycle management

    | eks, kubernetes, github-actions
  4. 4. Migrating 50+ TCP Services to Envoy Gateway: The Silent Security Group Gotcha

    How I moved a fleet of TCP services from ingress-nginx to Envoy Gateway using the Gateway API - and how AWS security group quotas caused a silent freeze that took down the data plane

    | envoy-gateway, kubernetes, gateway-api
  5. 5. EFS on a Swarm: Taming Memory Bloat at Scale

    How mounting EFS on hundreds of pods drove memory through the roof, and the DaemonSet trick that saved us

    | kubernetes, efs, aws
  6. 6. Hoop + EKS: Fine-Grained Kubernetes Access via IAM Role Chaining

    How I set up auditable, role-based kubectl access through Hoop using IRSA, IAM role chaining, and Kubernetes RBAC

    | eks, kubernetes, aws

All posts →

services

Architecture review
A fixed-scope deep dive into your cloud setup — reliability, security, cost, and operability — ending in a prioritized, plain-English action plan. The easiest way to start.
Kubernetes & platform engineering
Production-grade EKS, AKS, and GKE. Clusters, GitOps, CI/CD, observability, and a self-service platform your developers actually want to use.
Cloud migration
Between on-prem, VMs, and any cloud — including moving off a hyperscaler to Hetzner — planned in phases, rehearsed, and cut over without surprise downtime.
Security & compliance
Hardened clusters and cloud accounts, led by a Certified Kubernetes Security Specialist. RBAC, Pod Security Standards, and network isolation as defaults; SOC 2 Type II carried to audit; GDPR data residency enforced by architecture, not policy.
Identity & access
Zero standing privilege: SSO across cloud accounts, just-in-time access to databases and clusters, Zero Trust instead of VPNs, and one Keycloak/OIDC pattern instead of per-app auth.
Infrastructure as code
Terraform modules, Ansible playbooks, and AWS CDK that keep staging and production identical — reviewed, repeatable, and documented, so changes stop depending on one person's memory.
Hetzner & bare metal
Not everything needs a hyperscaler. Production setups on Hetzner Cloud and dedicated servers — Kubernetes included — often at a fraction of the AWS, Azure, or Google Cloud bill.
VM & Linux management
Linux VM fleets configured with Ansible — provisioned, patched, hardened, monitored, and backed up — on a hyperscaler, Hetzner, or on-prem.
Observability & alerting
SLO-based alerting that pages you for real problems, not noise — I've cut on-call alert volume by ~88%. Prometheus or VictoriaMetrics, Loki or VictoriaLogs, Grafana or Perses.
CI/CD pipelines
Pipelines on GitHub Actions, GitLab CI, or Bitbucket Pipelines with container scanning and policy gates, plus GitOps delivery via ArgoCD and Helm — from monthly releases to on-demand.
Cost optimization
Rightsizing, capacity planning, and architecture changes that typically cut cloud spend 30% or more — without trading away reliability.
Advisory retainer
A direct line to the engineer who built your infrastructure — for tricky questions, breakages, and big decisions. On-call escalation available.

tools I work with

Cloud
AWS, Azure, Google Cloud, Hetzner, on-prem VMs
Kubernetes
EKS, AKS, GKE, self-managed, Helm, Gateway API, Envoy Gateway
Infrastructure as code
Terraform, Ansible, AWS CDK
Identity & access
AWS IAM Identity Center, Keycloak, OAuth2 Proxy, GCP Identity-Aware Proxy, Hoop.dev, Active Directory
Security posture
AWS Security Hub, GCP Security Command Center, Microsoft Defender for Cloud
Metrics & alerting
Prometheus, Alertmanager, VictoriaMetrics, vmalert, PagerDuty, CloudWatch
Logs
Loki, VictoriaLogs
Dashboards
Grafana, Perses
CI/CD & GitOps
GitHub Actions, GitLab CI, Bitbucket Pipelines, ArgoCD
Languages
Python, Go, PowerShell

how it works

  1. 1. Email me — Fill in a short template — five minutes, not a 30-minute sales call.
  2. 2. Technical call — If it's a fit, an engineer-to-engineer call about your architecture.
  3. 3. Scoped proposal — A written scope with a clear price and timeline. No hourly surprises.
  4. 4. Hands-on delivery — I work in your repos and channels, alongside your engineers.
  5. 5. Clean handover — Docs, walkthroughs, and a platform your team owns. Retainer only if it helps.

why work with me