John Ghlen Dealdo

What this project covers

• Provisioned DigitalOcean droplets, cloud firewalls, and reserved IPs with Terraform across isolated staging and production environments.
• Automated Docker runtime setup, systemd daemon configuration, and Linux baseline hardening using modular Ansible playbooks.
• Built GitHub Actions workflow compiling and publishing immutable container images to GHCR, deploying over private Tailscale mesh SSH.
• Eliminated public origin port exposure by routing all web traffic through Cloudflare Tunnel (cloudflared).
• Restricted developer and CI deployment access using Tailscale Tailnet ACLs and dedicated SSH identities.
• Authored production runbooks covering deployment validation, health checks, rollback procedures, and secret management.

Compact schema

Sequence

1. Codify cloud infrastructure

   Provision DigitalOcean droplets, cloud firewalls, and reserved IPs across staging and production using Terraform.

2. Harden server baseline

   Apply Ansible playbooks for OS security hardening, Docker runtime, systemd services, and non-root users.

3. Configure private networking

   Deploy Tailscale node and Cloudflare Tunnel to terminate public ingress and close direct host ports.

4. Automate delivery pipeline

   Build GitHub Actions CI/CD to push immutable image tags to GHCR and trigger remote deployment over Tailscale.

5. Verify and hand over

   Execute health checks, test container rollback paths, and publish environment operational runbooks.

Stack

What this project covers

• Built a typed FastAPI service accepting VM provisioning parameters from an internal Budibase operator interface.
• Persisted request state, specifications, and job queues in PostgreSQL for auditable tracking and failure recovery.
• Automated Proxmox VE template cloning, compute sizing, and bridge networking via the Proxmox REST API.
• Dynamically rendered and injected cloud-init network configuration and SSH credentials at VM creation time.
• Packaged the worker and database via Docker Compose with healthchecks, environment contracts, and structured logs.

Compact schema

Sequence

1. Model API & schema

   Define PostgreSQL schemas for provisioning requests, states, and asynchronous queue worker jobs.

2. Implement Proxmox client

   Build async Python client interfacing with the Proxmox VE REST API for template cloning and resource allocation.

3. Inject cloud-init configuration

   Generate dynamic network configuration, user accounts, and SSH authorized keys during provisioning.

4. Connect operator interface

   Attach Budibase front-end forms with validation rules to the FastAPI ingestion endpoints.

5. Validate error handling

   Implement worker retry logic, state rollback on API failures, and structured logging.

Stack

What this project covers

• Designed a two-bridge Proxmox layout with a WAN bridge and isolated private management bridge.
• Placed OPNsense between external ingress and private administration paths.
• Deployed a two-node OPNsense HA pair with CARP virtual IPs (VIPs) on both LAN and WAN for transparent gateway failover.
• Built a dedicated isolated sync bridge for XMLRPC configuration sync and pfsync state synchronization.
• Enforced WireGuard as the private administrative access path through the HA firewall pair.
• Sequenced baseline capture, rollback preparation, VPN validation, cutover, and post-cutover handover.

Compact schema

Sequence

1. Approve topology

   Confirm bridge roles, address ownership, private subnet boundaries, and the VPN-first operator path.

2. Capture baseline

   Record interfaces, routes, hostname behavior, access model, TLS state, and rollback requirements.

3. Build network base

   Create WAN and private bridges, deploy OPNsense, enable private LAN services, and validate a test VM.

4. Stand up HA pair

   Deploy the second OPNsense node, add the isolated XMLRPC and pfsync sync bridge, and validate CARP failover across LAN and WAN VIPs.

5. Validate VPN entry

   Enable WireGuard, test external admin access, and keep the original management path until the private route works.

6. Cut over management

   Move hypervisor administration to the private bridge and confirm the old exposed path is closed.

7. Harden and hand over

   Document final access, certificate behavior, validation evidence, and recovery procedures.

Stack

What this project covers

• Deployed a monolithic Zabbix monitoring server with PostgreSQL backend and web frontend as the fleet control point.
• Rolled out Zabbix Agent 2 to 8 client servers using an Ansible playbook for repeatable, uniform installation and registration.
• Standardized host groups, baseline Linux OS templates, and alert triggers for proactive system health monitoring.

Compact schema

Sequence

1. Stand up Zabbix

   Deploy the monolithic Zabbix server with the server, database, and web frontend on one node.

2. Define agent rollout

   Create the Ansible path for repeatable Zabbix Agent 2 installation and configuration.

3. Roll out Agent 2

   Use Ansible to install and configure Zabbix Agent 2 across the 8 client servers.

4. Verify monitoring

   Onboard the hosts into Zabbix and confirm that the fleet reports into monitoring consistently.

Stack

What this project covers

• Built a typed Python CLI for audit workflows with schema validation and scanner orchestration.
• Wrapped ZAP, Nuclei, Nmap, Trivy, and Semgrep behind consistent adapter interfaces for repeatable execution.
• Used Docker Compose to spin up local test targets and chaos experiments safely in isolated networks.
• Enforced test coverage, typing, and pre-commit hooks to ensure CLI maintainability.

Compact schema

Sequence

1. Model audit workflows

   Define CLI commands, configuration, and output formats before adding scanners.

2. Attach tool adapters

   Wrap security tools behind consistent interfaces for repeatable execution.

3. Run local lab services

   Use Compose-managed services for scanner and chaos-testing workflows.

4. Enforce quality gates

   Use tests, linting, typing, and pre-commit checks to catch toolchain drift.

Stack

What this project covers

• Split Terraform into `network`, `image-factory`, and `workloads` states to control blast radius and review scope.
• Defined a four-zone platform model with Proxmox Linux bridges at L2 and OPNsense as the routing and policy control plane.
• Published a Terraform-to-Ansible handoff contract and validation-only GitHub Actions pipeline instead of mixing deployment logic into CI.

Compact schema

Sequence

1. Establish platform contracts

   Document architecture, scope, ADRs, naming, and lifecycle ownership before expanding implementation.

2. Build image factory

   Produce the reusable Debian-based image and template contract for downstream platform layers.

3. Split infrastructure states

   Separate shared network fabric, template lifecycle, and workload provisioning into independent Terraform roots.

4. Provision zoned workloads

   Model admin, edge, application, and data workloads against the OPNsense-backed four-zone network contract.

5. Hand off to configuration

   Publish an Ansible-ready inventory output and keep CI focused on validation, formatting, and syntax safety.

Stack