Cloud & Platform Engineering
GKE clusters with private nodes and Workload Identity, Cloud Run worker pools for bursty GPU jobs, AWS with CDK, and bare-metal fleets converged with Ansible. Environments you can rebuild from the repository.
- Google Cloud
- AWS
- Kubernetes
- Ansible
- Cloudflare
CI/CD & Developer Experience
One reusable deploy workflow instead of three copy-pasted templates. Trunk-based flow, database migration jobs that clean up after themselves, keyless OIDC auth to the cloud, Jenkins where it already lives.
- GitHub Actions
- Jenkins
- Docker
- ytt
- OIDC
Reliability & Performance
Disaster recovery plans with real recovery targets, a runbook per failure mode, restores rehearsed with the whole team. And the hard-to-reproduce performance issue nobody else could pin down, found and fixed.
- Prometheus
- Grafana
- Checkmk
- Load testing
- PITR
E-commerce & Payments
Fifteen-plus storefronts on Magento 1 and 2, WooCommerce and bespoke PHP, from ERP-connected B2B to parts retail with fitment search. Sixteen payment providers integrated, plus Italian e-invoicing and fiscal receipts.
- Magento EE / CE
- WooCommerce
- Stripe · Adyen · PayPal
- SAP / ERP sync
- Elasticsearch
Backend & Web Development
Booking platforms on Laravel with Stripe instalments and refunds, Python and TypeScript services, and C when it has to be fast: custom nginx and PHP modules included. A SaaS we have run ourselves for twelve years, so we know what maintenance really costs.
- PHP 8 / Laravel / Symfony
- Python
- Node / TypeScript
- C · nginx modules
- PostgreSQL / MySQL
Mobile & AI Apps
Flutter and native apps with Firebase and RevenueCat, four Play Store products from one codebase, and GPU inference fleets serving photo-restoration models behind a single job queue.
- Flutter
- Kotlin / Swift
- Firebase
- ComfyUI
- PyTorch
Security Hardening
WAF and adaptive DDoS protection, identity-aware access to internal tools, minimum TLS policies, bucket and secret hygiene, and sustained CVE and dependency triage across the fleet.
- Cloud Armor
- IAP
- Secret Manager
- SonarQube
- CVE triage
VPNs & Geo-aware Routing
Site-to-site and remote-access VPNs, GeoIP-aware traffic steering, direct endpoints for regions where CDN traffic is filtered, and resilient tunnels between regions.
- WireGuard
- OpenVPN
- GeoIP
- autossh
- Cloudflare DNS
High-availability Databases
MariaDB Galera with rolling restarts, PostgreSQL with high availability and PgBouncer pooling, MongoDB replica sets across regions, Redis Sentinel with automated failover, Elasticsearch clusters.
- Galera
- PostgreSQL HA
- MongoDB
- Redis Sentinel
- Elasticsearch
TLS & PKI
Certificate estates across many domains and countries, DNS-validated automation with no downtime, private CAs for VPNs, and a certificate reseller platform we have operated since 2012.
- Let's Encrypt
- Sectigo
- certbot DNS-01
- Private CA
- Mega SSL Store
Data Pipelines & BI
Event ingestion at billions of rows a month, ETL into metrics warehouses, scheduled pipelines on Dagster, dashboards on Metabase, and the SQL views that keep them honest.
- Dagster
- Metabase
- Pandas
- Cloud Scheduler
- SQS
IoT & Embedded
Custom Zigbee firmware for switches that misbehave, LoRa mesh feasibility down to the airtime formula, Home Assistant automations, and smartcard reader drivers going back to 2008.
- Embedded C
- Zigbee
- LoRa / nRF52
- Home Assistant
- Smartcards