Wiring every homelab service behind one login URL via Keycloak and Cloudflare Tunnel sounded like an afternoon of DNS records. It turned into an accidentally-public admin console, two apps failing OAuth with the identical error for two unrelated reasons, a three-cause Grafana outage, and a dead NFS
Curiosity is the most powerful thing you own
A beautiful narrative written over an elegant publishing platform. The story begins here...
Platform Engineering. Securing and running production systems across banking, gaming and e-commerce since 2011 — secure CI/CD, Kubernetes, MLOps, Observability. I write up the failures in detail: what broke, what the graphs showed, and what actually fixed it.
Home Labber — Notes from the Trenches
The Journey Begins here…
Selected work
Systems kept alive, and the ones that broke first. Every figure below is from the resume or from a post on this site.
- Reliability
99.9999% uptime across datacentre, AWS and Azure
Sysadmin team at India's largest fashion e-commerce platform — on-call rotation, revenue-impact metrics and PCI audit.
Six nines · hybrid infrastructure
- Incident
A Kubernetes node that served its own NFS mount
Memory pressure starved the NFS daemon the node itself depended on — a self-referencing deadlock that looked like a network fault.
1,172 zombie processes · load average 10× cores
- Cost
Cut cloud spend by finding what nobody was using
Billing analysis over AWS and Azure ETL, built in Python and Flask, surfacing overprovisioned and idle services.
25% reduction
- Compliance
Securing ISO 27001 certification
VAPT remediation and multi-AZ disaster recovery driven by Ansible. The certification unlocked further client contracts.
ISO 27001 · audited
- Platform
Secure CI/CD architecture for a national bank
OSA, SAST, DAST and a container trust registry, with policy as code catching issues before release rather than after.
Banking · current role
- Cost
Catching an AI agent ignoring its own rules
Instrumented the tool loop, found the gap where enforcement was never reached, and closed it with a pre-tool hook.
406M wasted tokens recovered
The Perils of Timezone — A Complete Visual Guide
Why UTC is the only sane default, how timezones silently corrupt distributed systems, and the discipline that keeps IST (or any local time) exactly where it belongs — at the edge.
27 Tests, 3 Alerts, 1 Real Bug Review Caught: Making a Drift Detector Watch Itself
A Kubernetes drift detector could tell you when prod and dr fell out of sync — but had no way to tell you it had stopped checking. Here's how I closed that gap with structured logs, a real health check, Prometheus alerts, and a dashboard, ticket-first and test-first.
Git Branching Strategy for AI-Assisted Development — Complete Visual Guide
Four real options, not two. GitFlow is too heavy for a codebase where AI agents open PRs continuously; GitHub Flow is too loose once AI-generated code needs a supervised gate before production. The strategy below, Integration-Gate Flow, is a Trunk-Based Development variant — it keeps TBD's short-liv
192.0.2.64 Kept Freezing After Login — the Trail Ended at a Port Collision on 16GB
Two Mac minis headed for Apple MLX distributed inference both froze after SSH login. The hunt crossed an mDNSResponder reverse-DNS stall, a WiFi wake-latency bug with a fix that only half-worked, a Thunderbolt/RDMA detour — and ended with two forgotten background inference servers squatting on the e
Local LLM Inference Architecture — From Silicon to Stack
A unified stack for running, routing, and observing LLMs — currently deployed on a laptop with RTX 3050 Ti, with planned expansions to K8s GPU nodes and Apple Silicon clusters.
sess — Fuzzy Tmux Session Manager in 3 Scripts
A 3-file tmux session manager: fzf-powered session picker, auto-naming by project directory, and a sane tmux.conf. 50 lines of bash that replaced my terminal chaos.
Zellij Session Manager — Every Terminal, Named, Resumable, Remote
A Zellij session management system: auto-naming from directories, auto-attach on shell open, capture existing terminals, fzf picker, Tailscale remote access, and reboot recovery. 4 scripts, 150 lines of bash.
typhoon Was Strangling Itself — WiFi Power-Save & the CPU Governor Trap on a k0s Worker
A k0s worker node's pods were stuck ContainerCreating and its CPU 'spiked too soon'. The real culprits weren't load — they were WiFi power-save (10% packet loss) starving the Calico CNI and a powersave governor pinning all cores at 800MHz. Full diagnosis, the fix script, and before/after evidence.
Salt on macOS — How kri Deploys and Operates the Fleet Control Plane
A deep dive into how kri deploys salt-master and salt-minion on macOS Mac Minis using Ansible — plist services, PAM auth, salt-api, and how minions find their master.
From One Mac to a Desk-Sized AI Cluster: Running LLMs with MLX (WWDC25 & WWDC26)
A practical walkthrough of Apple's MLX framework for local LLMs — inference, quantization, fine-tuning on a single Mac, then scaling to multi-Mac clusters with JACCL and Thunderbolt 5.
From Jekyll to the Edge: Rebuilding hellodk.io on Astro, Cloudflare Pages, and a Visual Card Grid
How I migrated a decade-old Jekyll blog to Astro 6 on Cloudflare Pages — theme choices, layout decisions, search, AI chat, and why I landed on a Jasper-inspired card grid instead of a text-only docs layout.