Canada · Independent work since 2022 · Open to remote roles & relocation

Yaqoob Ahmed

DevOps & Site Reliability Engineer

I build infrastructure that is rebuilt from code, fails safely, and has its recovery rehearsed, not assumed. On a 10-month contract, I moved a firm off costly proprietary software onto apps I built in-house, on AWS infrastructure that Terraform and Ansible rebuilt from code every weekday morning and destroyed every evening: ~66% fewer compute hours, and daily proof that the environment was reproducible. I've built on AWS, Google Cloud and Cloudflare and run my own Proxmox platform; the same patterns carry to any provider. I also build LLM agents that act through scoped, least-privilege tools.

View CV work@ycodes.ca github.com/yzahmed

Work history

Experience

DevOps & Full-Stack Engineer (Contract)

Dec 2025 – Sep 2026

Professional-services firm · Canada · Client name available on request

  1. Platform modernization & ephemeral AWS infrastructure

    • Cut compute hours by ~66% compared with always-on: Terraform and Ansible built the AWS environment before the 9 a.m. business day and destroyed it at 5:30 p.m., weekdays only (57.5 of 168 weekly hours).
    • Replaced the firm's costly proprietary software with in-house apps: a React front end and Node.js/TypeScript REST APIs that made core workflow data processing 25% faster.
    • Monitored production with Prometheus and Grafana, introduced CI/CD pipelines on a self-hosted Git and CI/CD platform I set up and ran (Gitea Actions), and wrote post-mortems for the incidents I resolved.
    Terraform Ansible AWS EC2 · S3 · IAM Prometheus · Grafana Node.js · TypeScript React

IndependentPlatform and reliability projects since 2022: see Selected work and the lab.

EducationMBA · Postgraduate Diploma, Web Development · Full-Stack Web Development Bootcamp

Full CV

Case studies

Selected work

Featured · Platform engineering

Self-Hosted Platform Lab — Proxmox VE, run as code

A single Proxmox VE host run with production discipline: unprivileged LXC containers and KVM guests built from scripts in one Git repository, with every change made through a pull request.

0 Port-forwards
336 s DR drill · PASS
19 Step rebuild runbook
60 min Idle apps power off
Proxmox VE KVM · LXC systemd Bash Cloudflare Tunnel + Access Tailscale · WireGuard nftables Least privilege

Reliability & platform

  • Self-Healing Reliability Lab

    A simulated trading workload built to fail safely, on Docker Compose. Kafka decouples order intake from the database, and MySQL GTID replication sits behind HAProxy. In a drill that kills the primary under load, a safety-gated control plane recovers writes in ~10 s with no failed client requests; failback stays a human decision, and every serious failure got a written postmortem.

    Docker Compose Apache Kafka MySQL GTID HAProxy Prometheus + Grafana

  • The Pocket Data Center

    Bare metal

    Wiped Android off a retired smartphone and ran postmarketOS with a Docker stack on ARM64 at ~4 W. Kernel sysfs charge limits protected the battery on 24/7 power, an OTG-attached SSD took database I/O off the internal flash, and if a power cut drained the battery below 15%, the phone sent an SMS alert over its cellular modem and shut the containers down cleanly.

    postmarketOS Docker ARM64 Cloudflare Tunnel sysfs · ModemManager

Security & PKI

Portability

Cloud-agnostic by design

The provider changes; the reliability engineering doesn't.

Each pattern, mapped to the platforms I've used for it.

Serverless compute
  • Google Cloud Run
  • Google Cloud Functions
  • Cloudflare Workers
  • Netlify Functions
Containers & orchestration
  • Kubernetes on Proxmox
  • K3s
  • Docker / Docker Compose
  • Proxmox LXC
Infrastructure as code
  • Terraform (AWS)
  • Ansible
  • Golden images
Ingress & edge
  • Cloudflare Tunnel / Access
  • NGINX
  • HAProxy
  • Caddy
Identity & least privilege
  • AWS IAM
  • Cloudflare Zero Trust
  • Tailscale ACLs
  • HashiCorp Vault
Observability
  • Prometheus
  • Grafana
State & storage
  • Amazon S3
  • Google Cloud Storage
  • MySQL (GTID replication)
  • PostgreSQL

Home lab

Infrastructure I operate

How the featured lab is reached, isolated, recovered and kept running.

  • Private Git forge

    A private Git forge on hardware I control, reachable only over HTTPS inside the private mesh. Sign-in is required, self-registration is off and the binary is checksum-pinned.

  • Zero port-forwards

    Public apps sit behind an outbound-only tunnel and SSO; nothing is port-forwarded. Admin access rides a private WireGuard mesh with ACL-enforced SSH, and the mesh routes only to the lab's internal network, not the home LAN.

  • Fail-closed app firewall

    Services talk over an internal-only bridge with no uplink. The app stack and the Git forge are default-deny. The app stack's firewall admits only the tunnel connector, and Docker won't start without it: a broken firewall means no service, never an open one.

  • Golden images & DR drills

    A scripted drill pulls the golden image back from off-site storage, restores it into a network-less guest and verifies it. A runbook rebuilds the host, and host config goes off-site weekly when it changes.

  • Self-healing & alerting

    A health-check watchdog restarts a service that stops answering, and systemd restarts the reverse proxy if it crashes. A 10-minute check loop alerts my phone only when a problem opens or clears, so every alert means something changed.

  • Least-privilege AI agents

    AI coding agents get a scoped, privilege-separated API token: read-only by default, full control only in a disposable pool. Destructive actions need my approval, and every task an agent starts is logged under its own identity.

Read the lab case study

Technical depth

Skills

Cloud AWS (EC2, S3, IAM) · Google Cloud (Compute Engine, Cloud Run, Cloud Functions, Cloud Storage, Cloud SQL, Firebase) · Oracle Cloud · Cloudflare (Workers, Pages, Tunnel, Zero Trust)
Linux administration Debian · systemd services & timers · nftables · LVM-thin · SSH · Bash · Alpine / postmarketOS on ARM64
IaC & CI/CD Terraform · Ansible (configuration management) · golden images · Git (pull-request workflow, 180+ pull requests since 2025) · GitHub Actions (pull-request checks, matrix builds, caching, least-privilege tokens, scheduled jobs, secret & vulnerability scanning, Cloudflare deploys) · self-hosted Git and CI/CD platform (Gitea Actions runners)
Containers Docker, Docker Compose, Docker Buildx (multi-arch) · GitHub Container Registry · Kubernetes (K3s; HA setup on Proxmox), Helm · Proxmox VE (LXC, KVM)
Reliability Prometheus, Grafana · alerting · SLO design, error budgets · incident response, troubleshooting, post-mortems · disaster recovery · high availability & failover · load testing (k6)
Networking & security DNS · load balancing (NGINX, HAProxy) · WireGuard, Tailscale · Cloudflare Tunnel & Access (SSO) · IAM & least privilege · HashiCorp Vault · TLS, X.509, PKI · default-deny firewalls · Trivy image scanning, SBOM & provenance, SHA-pinned actions, Dependabot
Data & messaging MySQL (GTID replication), PostgreSQL · Apache Kafka · Amazon S3, Google Cloud Storage, Cloud SQL
Languages & web Python, Go, TypeScript / JavaScript (Node.js, Express, React), SQL · REST APIs · WebSockets (Socket.IO) · WebRTC
AI / ML LLM agents & tool use · MCP servers · model training & fine-tuning · least-privilege agent access

Background

About

I got into systems engineering by repurposing old hardware and building things that ran unattended, to learn what breaks when no one is watching and how it recovers. I'm based in Canada and open to remote roles or relocation.

Location Canada · Remote
Focus DevOps · SRE
Platforms AWS · Google Cloud · Cloudflare · Proxmox
Status Open to relocation

Hiring?

Let's talk

I'm looking for DevOps, cloud and site reliability roles — remote, or with relocation. Email is the fastest way to reach me.

Email work@ycodes.ca Download CV (PDF) GitHub