Linux Systems Administrator - HRL Laboratories (IBM Research) Maker
I keep hardened Linux fleets and HPC clusters running in an environment where every host is audited, every binary is allowlisted, and downtime is expensive.
RHEL and Oracle Linux under STIG, SELinux enforcing, Active Directory identity, Ansible everywhere. At home the same instincts point at Raspberry Pis, sensors, and a garden that waters itself.
Day job at HRL Laboratories, now IBM Research. Regulated environment, so specifics stay general.
RHEL and Oracle Linux built and maintained against DISA STIG benchmarks: SELinux in enforcing mode, fapolicyd allowlisting, Duo MFA on privileged access, and continuous compliance scanning with remediation tracked to closure.
Compute and GPU nodes for engineering and research workloads: provisioning, scheduling, node health, and the unglamorous root-cause work when a node starts locking up at 3 a.m.
Active Directory integration across the Linux estate with Centrify and SSSD, Kerberized file shares, and MFA enforcement that holds up to audit without making engineers miserable.
Foreman and Katello for provisioning and lifecycle, Red Hat Satellite including an airgapped instance, and Canonical Landscape driving the Ubuntu fleet. Staggered rolling patch windows so nothing takes the cluster down with it.
Ansible for configuration, remediation, and compliance rollout. Elastic with Fleet for log and endpoint data, Grafana for the dashboards people actually look at, Nagios XI for the pages that wake someone up.
FlexLM license servers and OpenLM reporting behind EDA and simulation tooling, keeping expensive seats available to the engineers who need them and visible to the people paying for them.
Built because I wanted them to exist. Source on GitHub, mirrored from my own GitLab.
Raspberry Pi Flask KiCad
A seedling controller on a Pi Zero 2 W. PWM grow light with daily light integral tracking against a target, Camera Module 3 timelapse with an alignment viewfinder, soil moisture probes, and non-contact reservoir sensing that refuses to run the pump dry and pings me when it does. Health reports are generated from the sensor history.
Currently laying out its first custom full-size Pi HAT in KiCad, USB-C powered, assembled at the fab.
Raspberry Pi ESP32 MicroPython
Monitoring and automatic watering for two raised strawberry beds. Wireless ESP32 sensor nodes report moisture and climate to a Flask dashboard backed by SQLite, and the irrigation decides for itself when the beds need a drink.
Formerly openGardener. Same home server, same nginx, one more thing to keep alive.
Embedded control
An autonomous surface vessel project: navigation, control, and telemetry on small hardware. Developed on my self-hosted GitLab and mirrored out to GitHub.
HomeLab
A Proxmox cluster behind one nginx reverse proxy and a single public IP, fronting about fifteen services: GitLab with runners, NetBox, Proxmox Backup Server, a GPS-disciplined NTP server, and uptime monitoring. Everything runs the same controls I use at work, scaled down: per-vhost CSP and HSTS, Cloudflare origin certs with automated renewal, and nightly config sync to Git so nothing lives only in my head.
Live public
A GPS-disciplined stratum 1 NTP server on a Raspberry Pi, with a live status dashboard for chrony: satellite lock, offset, jitter, and drift over time.
Service Monitoring for services on my LAN.
Some services are intentially down.
One public IP
Every service above terminates on the same nginx box. Adding one is a vhost, a DNS record, and a cert.
Things I use often enough to have opinions about.
Email is best. I read it more reliably than anything with a notification badge.