Platform Engineer · Infrastructure-as-Code · AI Integration

I bridge SQL/ETL (7+ years enterprise) and modern Infrastructure-as-Code. Operate a 9-node NixOS homelab, ship full-stack code (Rails 8, React 19, Rust), and treat Claude Code + MCP as load-bearing infrastructure — not as a chatbot.

📍 Warsaw, Poland · 🇪🇺 EU passport · 🏠 Fully remote · 🤝 B2B preferred 📫 portfolio · linkedin · diego88aku@gmail.com

Open to work — UK / Ireland / EU / worldwide. Platform Engineer, SRE, or AI-Native Platform roles.

flowchart LR
  SHARED["One NixOS flake<br/>shared base · feature flags<br/>18 security modules"]
  SHARED --> DESK["3 desktops · 3 laptops"]
  SHARED --> SRV["VPS_PROD · NAS_PROD"]
  SHARED --> LXC["7 Proxmox LXCs"]
  SHARED --> MAC["nix-darwin macOS"]

  style SHARED fill:#1a3a5c,color:#fff,stroke:#1a3a5c

• my_nixos — 260 Nix files, 16 flake profiles, 18 security modules, 1,156-line zero-touch installer. Feature-flag architecture: zero hostname checks in shared modules.
• LiftCraft (private) — Rails 8 + React 19 + TypeScript training platform with 45 analytics reports in a strict Analytics::Registry whitelist, exposed one-tool-per-report via a companion MCP server. Zero LLM-generated SQL. 60 models · 41 controllers · 64 services · ~66k LOC.
• Self-hosted homelab — 14 Docker Compose stacks on VPS + 21 containers on NAS (migrated TrueNAS SCALE → NixOS in 2026), production Prometheus/Grafana stack with 10+ exporters, PostgreSQL 17 multi-tenant (6 DBs, per-container ACLs, PgBouncer), Restic offsite backups over Tailscale.
• Claude Code as operator platform — declarative NixOS module: 82 allow rules + 34 deny rules, pre/post-tool-use hooks for sensitive-file blocking, 32 custom slash-command skills, 6 path-scoped rule files that auto-load on glob match. 5 MCP servers wired (Plane, Perplexity, Grafana, Postgres, n8n). Same config across every node on the fleet.
• Network fabric — WireGuard site-to-site (VPS ↔ pfSense) + self-hosted Headscale mesh (100.64.0.0/10) across every device I own. Nginx reverse proxy via the tunnel, split-DNS via pfSense, NFTables masquerade.
• NixOS Control Panel (private) — 14k-line Rust workspace (Axum + Tauri v2) that drives remote Docker, Proxmox LXC ops, and NixOS dry-run + deploy over russh SSH. One binary, web + desktop.

Full case studies with architecture diagrams on the portfolio.

Platform & IaC · NixOS · Nix flakes · Home Manager · Docker (rootless) · Kubernetes (k3s, learning) · Terraform (learning) · SystemD Observability · Prometheus · Grafana · Uptime Kuma · Restic · 10+ custom exporters Networking · pfSense · WireGuard · Tailscale/Headscale · Nginx · Cloudflare Tunnel · NFTables · LUKS · Fail2Ban Databases · PostgreSQL 17 · PgBouncer · MS SQL Server · T-SQL · Redis · MariaDB · ETL · Power BI Programming · Ruby on Rails · React · TypeScript · Python · Rust · Bash · Nix AI / LLM · Claude Code (operator-level) · Model Context Protocol (MCP) · n8n · agent orchestration Cloud · AWS (RDS, EC2, S3) · Hetzner · Azure (basics)

📦 my_nixos — my flagship. 16 profiles from one flake. ⌨️ SpinachKeyboardFramework — cross-platform keybinding unifier (TypeScript). 🛠 myScripts — 68+ shell scripts for cross-platform system management. 📊 CombineActuals — Ruby ETL toolkit for SAP → data-warehouse pipelines.

Many projects are private (LiftCraft, portfolio, Claude Code operator config, NixOS Control Panel, etc.) — happy to walk through in interviews.

• 📍 Based in Warsaw, Poland (EU passport — no visa friction within the EU).
• 🏠 Fully remote; 3-month notice on current role, B2B overlap legal in Poland.
• 💬 Best contact: diego88aku@gmail.com or via LinkedIn.
• 🗂 Living CV + full project write-ups: info.akunito.com.