John Ghlen profile picture

John Ghlen

DevOpsEngineer
Linux, infra., automation, IaC, CI/CD
Part-time Linux system administrator
DevOps / Platform
Philippines
--:-- -- // GMT+8
johnghlendealdo@gmail.com
About

Building reliable infrastructure, automation, and deployment workflows one practical system at a time.

I’m drawn to the parts of software delivery that sit below the interface: Linux, networking, infrastructure as code, CI/CD, and the steady operational habits that make systems easier to run and easier to trust.

I like poking around the weird layers underneath apps until I accidentally become emotionally attached to a Linux server.

The deeper I go into Linux, networking, containers, IaC, and deployment automation, the more I realize: complexity doesn’t disappear—it just gets distributed across layers you slowly learn to see.

I enjoy technical work that rewards curiosity, patience, and the ability to stare at logs until they eventually start making sense.

I also care about ownership—not in a buzzword sense, but in the practical DevOps way: if I build or touch a system, I want to understand it end-to-end, be responsible for how it behaves in production, and be the person who can actually debug it when it breaks at 2 AM.

I’m not trying to act like some 10x infrastructure wizard. I’m just out here slowly collecting practical skills, documenting what I learn, and trying to become the kind of engineer who can confidently say: “give me 20 minutes and I’ll probably figure it out."

Contribution & Activity
MayJunJulAugSepOctNovDecJanFebMarAprMay
MonWedFri

0 contributions in 2026 on GitHub.

LessMore
Projects

Gated Proxmox Management via OPNsense

Strongest case studyPart-time infra project

A hardened virtualized network design that moves hypervisor administration behind a firewall VM and VPN-only access path.

The goal was to reduce direct management exposure while keeping rollback, baseline capture, and operator access clear enough for a risky network cutover.

What this project covers

  • Designed a two-bridge Proxmox layout with a public WAN bridge and isolated private management bridge.
  • Placed OPNsense between public ingress and private administration paths.
  • Sequenced baseline capture, rollback prep, VPN validation, cutover, and post-cutover handover.

Compact schema

Sequence

  1. Approve topology

    Confirm bridge roles, address ownership, private subnet boundaries, and the VPN-first operator path.

  2. Capture baseline

    Record interfaces, routes, hostname behavior, access model, TLS state, and rollback requirements.

  3. Build network base

    Create public and private bridges, deploy OPNsense, enable private LAN services, and validate a test VM.

  4. Validate VPN entry

    Enable WireGuard, test external admin access, and keep management public until the private route works.

  5. Cut over management

    Move hypervisor administration to the private bridge and confirm the old public path is closed.

  6. Harden and hand over

    Document final access, certificate behavior, validation evidence, and recovery procedures.

What I learned

I learned that infrastructure hardening is mostly sequencing: prove recovery first, validate the new path second, and only then remove the old exposure.

Stack

Proxmox VEOPNsenseWireGuardLinux networkingBashCloud-init

Proxmox Provisioning Control Plane

ImplementedPart-time platform project

A containerized API and worker flow for requesting, validating, and provisioning virtual machines through a controlled interface.

This project turns manual VM creation into an API-backed workflow with validation, job tracking, and integration hooks for an internal low-code interface.

What this project covers

  • Built a FastAPI service around Proxmox API operations and VM request validation.
  • Used Docker Compose to run the API, database, and integration layer consistently.
  • Separated request intake from provisioning work so failures can be tracked instead of hidden.

Compact schema

Sequence

  1. Define request contract

    Model VM inputs, environment values, and validation rules before touching the hypervisor API.

  2. Containerize service

    Package the API and supporting services with Docker Compose for repeatable local and server runs.

  3. Add job handling

    Track provisioning status through database-backed jobs instead of relying on one-shot scripts.

  4. Integrate interface

    Connect the request workflow to a low-code front end while keeping provisioning logic in the API.

What I learned

I learned how platform work changes when the goal is not just to create infrastructure, but to make the request path auditable and repeatable.

Stack

FastAPIPythonDocker ComposePostgreSQLProxmox API

Proxmox Private VM Access with WireGuard

ActivePublic GitHub project

A public infrastructure lab that uses Ansible and Terraform to bootstrap private VM access behind WireGuard.

This project separates host preparation from VM lifecycle management: Ansible handles the Proxmox host baseline while Terraform manages VM resources.

What this project covers

  • Used Ansible roles and playbooks for repeatable Proxmox host bootstrap.
  • Used Terraform modules and environments for VM lifecycle boundaries.
  • Added CI checks for Terraform formatting and Ansible syntax validation.

Compact schema

Sequence

  1. Bootstrap host

    Prepare Proxmox dependencies and baseline configuration with Ansible.

  2. Define VM lifecycle

    Use Terraform modules and environment folders to describe private VM resources.

  3. Gate access

    Use WireGuard as the administrative entry point for private resources.

  4. Validate changes

    Run CI checks before infrastructure definitions are treated as usable.

What I learned

I learned why IaC ownership boundaries matter: host state, VM state, and access paths should not be mixed into one unclear automation layer.

Stack

TerraformAnsibleProxmox VEWireGuardGitHub ActionsMakefile
GitHub

Web Security Chaos Toolkit

ActivePublic GitHub project

A DevSecOps-oriented CLI toolkit for orchestrating web audits, scanners, and controlled failure experiments.

This project focuses on operational security workflows: repeatable scans, structured outputs, local lab services, and adapter-based tooling.

What this project covers

  • Built a Python CLI with typed configuration and scanner orchestration.
  • Used Docker Compose to run supporting security and chaos-testing services.
  • Added tests, linting, typing, and pre-commit checks to keep the toolkit maintainable.

Compact schema

Sequence

  1. Model audit workflows

    Define CLI commands, configuration, and output formats before adding scanners.

  2. Attach tool adapters

    Wrap security tools behind consistent interfaces for repeatable execution.

  3. Run local lab services

    Use Compose-managed services for scanner and chaos-testing workflows.

  4. Enforce quality gates

    Use tests, linting, typing, and pre-commit checks to catch toolchain drift.

What I learned

I learned that security tooling becomes more useful when it produces consistent evidence instead of one-off terminal output.

Stack

PythonDocker ComposeZAPNucleiNmapTrivySemgreppytest
GitHub
Experience

Linux SysAdmin / System Engineer

Part-time
HelityEurope/Berlin

December 2025 - Present

Supporting infrastructure and platform work across Proxmox-based systems, secure service deployment, and internal automation workflows.

  • Designed and documented Proxmox VE networking around OPNsense, private VM bridges, DHCP/NAT boundaries, and WireGuard-based administrative access.
  • Built a FastAPI provisioning worker that integrates Budibase, PostgreSQL, Docker Compose, and the Proxmox API for queued VM clone requests.
  • Prepared Coolify, Traefik, CrowdSec, internal TLS, WAF verification, and operational notes for a secure self-hosted application platform.
  • Created validation, rollback, and infrastructure collection scripts to make system changes easier to verify and recover.
LinuxProxmox VEOPNsenseWireGuardDocker ComposeFastAPIPostgreSQLCoolifyTraefikCrowdSecBash

Internship (DevOps)

Internship
InfosoftDavao City, Philippines

March 2026 - June 2026 (Expected)

Contributing to the team’s DevOps direction by improving development workflows, container practices, and security-focused automation.

  • Introduced DevOps practices and alternative workflow approaches, including infrastructure as code, configuration as code, CI/CD, and documentation frameworks.
  • Trimmed and optimized the team’s Docker-based PHP/Laravel development environment template to make local setup lighter and easier to maintain.
  • Developed the Web Security Chaos Toolkit, a Python-based DevSecOps CLI for repeatable web audits, scanner orchestration, Docker Compose lab services, and structured security evidence.
DockerLaravelPHPCI/CDDocumentationPythonDocker ComposeDevSecOps
Education

Formal education entry

Degree or diploma
Add your school or program

Add years attended

Replace this with your actual education background, concentration, and relevant coursework or capstone details.

  • Mention any systems, networking, or software engineering coursework that supports your current goals.
  • Note projects, labs, or group work that shaped your interest in infrastructure or automation.
Operating systemsNetworkingProgramming

Self-directed study path

Independent learning
Courses, labs, and documentation

Ongoing

Acknowledge that practical lab work, documentation, and repeated experimentation are part of your education too.

  • Study Terraform, Kubernetes, observability, and security-aware deployment practices through projects.
  • Keep notes on what works, what breaks, and what needs deeper understanding.
TerraformKubernetesCloudObservability
Technology Stack