Chris SV — DevOps & Cloud Engineer

01 / Architecture

Live Platform Topology

The diagram below is the actual topology, not a sales graphic. Control plane on x86, workers on ARM, GitOps in the middle, three clouds off the side. What's labeled live is running; what's planned isn't claimed as done.

Control Plane

Ryzen 5950X, 64GB DDR4 on Ubuntu bare metal. k3s server node, management VMs via KVM/libvirt. This is where ArgoCD and the cluster control loop live.

k3s server · KVM · 5950X

Worker Nodes

3x Raspberry Pi 5 (8GB) in a Pironman 5 bramble rack. ARM64 workers with a Coral TPU available for edge inference.

k3s agents · arm64 · Coral TPU

GitOps & CI/CD

ArgoCD app-of-apps for declarative delivery. GitHub Actions handles build, scan, SBOM, sign, staged promote with approval gates.

ArgoCD · GitHub Actions · Supply Chain

Observability

Prometheus and Loki scrape cluster and app telemetry. Grafana Cloud renders live panels below. OpenTelemetry (OTLP) traces on cloud services. All edge-cached via Cloudflare.

Prometheus · Grafana Cloud · OTel

Zero Trust Networking

Cloudflare Access plus an outbound-only tunnel. No inbound ports. Grafana and ArgoCD sit behind Zero Trust auth. Public site on Cloudflare Pages and CDN.

Cloudflare Access · cloudflared

Multi-Cloud IaC

Terraform manages Cloudflare (DNS, Access, Workers), GCP (Cloud Run inference), AWS (S3, IAM), and Azure (Key Vault via External Secrets Operator).

Terraform · AWS · Azure · GCP

02 / Home Infrastructure

Network, NAS & Local AI

Everything above sits on a network I built from the ground up. The point of the lab is to teach myself production patterns I can take to work: segmentation, self-hosting, and running real models on real GPUs. The homelab is isolated on its own VLAN.

Network Foundation

OPNsense firewall and router with full VLAN segmentation and firewall rules. UniFi switches and APs tag and isolate each VLAN (IoT, lab, trusted kept separate). Tailscale mesh gives remote access with zero exposed ports. The k3s homelab runs on its own dedicated VLAN.

OPNsense · UniFi · Tailscale · VLANs

RoninNas (Unraid)

Ryzen 5950X, 128GB DDR4, NVIDIA RTX 3090 Ti + RTX 6000 + RTX 5000. 13-disk XFS array, ZFS NVMe cache mirror, and a dedicated ZFS NVMe pool for AI model storage. This box runs the local AI stack and most self-hosted services.

Unraid · 5950X · 3x GPU · ZFS NVMe

Self-Hosted Services

Roughly 15 Docker services: Nextcloud, Immich, Jellyfin, Paperless-ngx, Vaultwarden, Kopia backups, SWAG reverse proxy, and more. I wrote custom Dockerfiles to containerize niche apps that had no ready-made image. A Jenkins VM runs a scheduled nightly scan across the whole system.

Docker · Custom Images · Jenkins Nightly

Local LLM Inference

Ollama serving quantized Qwen family GGUF models (27B dense and 35B-A3B MoE), curated to a clean lineup. Open WebUI and SearXNG give a private chat and search frontend over Tailscale, with RAG across my Obsidian notes. I fixed tool-calling across the library and tuned multi-GPU scheduling to stop KV-cache overflow.

Ollama · Open WebUI · SearXNG · RAG

04 / Capabilities

Technical Expertise

Grouped the way I actually work: infrastructure, security, delivery, observability, supply chain, and the local AI and self-hosting work that runs at home.

IT Infrastructure & Networking

Linux (Ubuntu, RHEL, CentOS)Windows ServerActive DirectoryVMware/ESXiVLANsRoutingDNSCloudflareEndpoint & server support

Security & Compliance

Active Secret ClearanceCompTIA Security+System hardeningPatch managementVulnerability managementIAM & access controls

DevOps & Automation

TerraformAnsibleDockerKubernetes / k3sJenkinsGit / GitHub / GitLabCI/CD (GitHub Actions)HelmArgo RolloutsAPI-driven workflows

Observability & Cloud Ops

Grafana CloudPrometheusLokiOpenTelemetry (OTLP)GCP Cloud RunAWS S3Azure Key VaultArtifact RegistryCost-aware ops

Programming & Supply Chain

BashPythonPowerShellSQLREST / APITrivySyft (SBOM)Cosign (signing)CodeRabbit

Local AI & Self-Hosting

OllamavLLMOpen WebUISearXNGUnraidOPNsenseTailscaleUniFiDockerKVM/libvirtn8nObsidian MCP

05 / Work History

Professional Experience

Nine years keeping real systems running, from enterprise Windows and Linux fleets to a Navy contract cloud migration and the homelab this site is served from.

Azure Flank Speed Administrator

Rite-Solutions / Arcfield · U.S. Navy Contract · NUWC NAVSEA

Newport, RI · Aug. 2025 to Present

Stood up the team's first CI/CD pipeline on Azure Flank Speed GitLab Runner. Configured the shell executor to pwsh so .gitlab-ci.yml script blocks run PowerShell directly for Azure administration. Mixed-language pipeline: PowerShell for Azure and Windows, Bash for Linux and runner steps, Python for glue, YAML for definition.

Supported the on-prem to Azure Government migration across network, platform, and operations. Built Azure Data Factory pipelines for data ingestion. Used Azure AI Foundry to stand up local model environments for unclassified use.

Planned and built a local Ollama and vLLM class inference environment on GPU hardware for a specific classified program. Cost-aware VM and image lifecycle; partnered with Microsoft CSAs on secure, repeatable provisioning.

Azure GovGitLab CIpwshADFAI FoundryOllama/vLLM

IT Specialist

Rite-Solutions / Arcfield · NUWC NAVSEA

Newport, RI · Nov. 2024 to Aug. 2025

Supported large-scale device rollouts and tech-refresh across multiple base environments, reimaging Windows, thin client, and Linux (RHEL, CentOS) endpoints to baselines.

Diagnosed network access and compliance issues involving firewall policy, VLAN routing, Cisco ISE, and Trellix. Authored Ivanti RES automation modules for WMI repair, MECM client recovery, and Tenable / Nessus (ACAS) vulnerability remediation with strict stdout and setter-task patterns.

Administered Active Directory for thousands of accounts and devices. Managed high-volume ServiceNow workflows. Worked with STIG and vulnerability management teams.

Active DirectoryESXiRHELIvanti RESACAS/NessusServiceNow

Manager, On-Site & Remote Technical Support

Compass Computer Clinic

Jamestown, RI · Mar. 2024 to Sept. 2024

Managed IT support operations for small businesses: networking, security, backup solutions, and client-facing troubleshooting.

CRM Manager & On-Call Technician

Self-Employed

Austin, TX · Dec. 2020 to Aug. 2023

Provided remote and on-site IT support, server maintenance, network security enhancements, and user account provisioning for business clients.

On-Call Support Technician

C-Side Computer Solutions

Jamestown, RI · Dec. 2015 to Sept. 2020

Networking, VMware, Active Directory, and Linux or Windows administration for residential and small business clients. Introduced Azure and AWS cloud solutions.

Tech Consultant

Liberty Carvings Inc.

Jamestown, RI · Mar. 2015 to Present

Managed IT infrastructure, website development, cybersecurity posture, and cloud storage. Designed an agentic AI automation pipeline using n8n for inventory, client comms, and API orchestration.

n8nAPI OrchestrationWebCloud Storage

App Developer Intern & Marketing

G-Form, LLC

Providence, RI · July 2014 to Dec. 2015

Developed a prototype mobile application in C and C++. Represented the company at international trade shows for product demonstrations.

C / C++Mobile PrototypeTrade Shows

06 / The Platform Story

One Change, From Commit to Prod

The portfolio is the environment I built to prove real DevOps skills with real infrastructure. Here is one change flowing through the whole system.

Commit

A push to GitHub kicks off the build in GitHub Actions. Nothing ships without a PR and a passing pipeline.

→ GitHub Actions build

Harden the Supply Chain

Trivy scans the image for CVEs. Syft generates the SBOM, the provenance of every dependency. Cosign cryptographically signs the image so only verified artifacts deploy. CodeRabbit reviews the PR automatically.

→ Trivy + Syft + Cosign + CodeRabbit

GitOps Deploy

ArgoCD app-of-apps syncs to the k3s cluster. Staging promotes to prod behind an approval gate. No manual kubectl in production.

→ ArgoCD · staged promotion · approval gate

Observe

Prometheus and Loki scrape metrics and logs. Grafana dashboards render. OpenTelemetry traces flow from cloud services into Grafana Cloud.

→ Prometheus + Loki + OTel to Grafana Cloud

Lock Down

Cloudflare Zero Trust Access plus an outbound-only tunnel. No inbound ports. External Secrets Operator syncs Azure Key Vault into the cluster.

→ Cloudflare Access + ESO + no inbound

All on IaC

Terraform provisions everything across GCP, AWS, and Azure. The cluster, the DNS, the access policy, and the cloud origins are all declared as code.

→ Terraform · GCP · AWS · Azure

Honest roadmap: Argo Rollouts canary delivery and a dedicated secrets-scan stage are planned, not claimed. The AI inference demo is in progress.

07 / Agents & Automation

OpenClaw and Production Pipelines

Beyond the infrastructure, I build systems that reason and execute. The framing is simple: agents that reason, tools that execute, memory that persists, and humans in the loop.

OpenClaw Framework

A self-hosted, Discord-bound multi-agent orchestration running on a dedicated agent VM. Architecture is "OpenClaw brain, n8n hands": the agent reasons, n8n executes API calls, and Obsidian via MCP is the persistent memory. Hybrid model routing uses Claude Sonnet primary, Gemini fallback, and local Ollama for private or cheap tasks.

→ Multi-agent · n8n · Obsidian MCP · hybrid routing

AI Media Staging (Live)

For Liberty Carvings, n8n and Gemini auto-stage raw product photos into styled room settings, with a full WordPress REST integration. Batch-processed a 538-image library with auto-categorization and QC gates.

→ n8n + Gemini + WordPress REST · 538 images

Vitrine Autonomous Instagram

A Cloudflare Worker runs the Instagram Graph API publish pipeline with a D1 metrics store and an RLPH feedback loop (Reflect, Learn, Plan, Hypothesize with explore or exploit slot selection). All behind approval gates and rate-limit ceilings. The Worker stays always-on because the NAS sleeps for power savings.

→ Cloudflare Worker + D1 + RLPH loop

Judgment Calls

Refused unsafe auto-follow automation that risked Meta ToS bans and built compliant growth instead. I weigh business risk, not just whether something can be made to work. eBay listing automation follows the same Worker and gateway pattern, publishing unpublished offers as drafts.

→ Compliant automation · human approval gates

08 / Beyond the Console

Not on a Typical Résumé

The thread through all of it: I treat every environment as a place to learn something new, then automate it so I never do it manually twice.

Live Portfolio

Terraform-managed multi-cloud across GCP, AWS, and Azure with a hardened CI/CD supply chain (Trivy, Syft, Cosign, CodeRabbit) and automated staging to prod promotion via GitHub Actions.

Agentic Automation

Approval-gated n8n workflows with API integrations for inventory, client communication, and repeatable business operations.

Electric Car

Designed and built a fully electric car, starting at age 14 and completing it at 18.

Wearable Tech Patent

Filed a patent in wearable technology at age 19.

FIFA 2014

Participated in marketing and filming with soccer legend Pelé during the 2014 FIFA World Cup.

Languages

Fluent in written and spoken Spanish.

09 / Education & Credentials

Training & Education

Secret Clearance

Active · Since Sept. 2024

U.S. Department of Defense Secret clearance, currently active and maintained.

WGU · Cloud Computing

B.S. · Projected Graduation 2027

Focus on AWS, Azure, GCP, and enterprise cloud architecture.

Moses Brown School

Diploma · June 2014

College preparatory education with a foundation in math, science, and computer science.

DevOps & Cloud Bootcamp

Sept. 2023 to May 2024

Python, Linux, Git, GitHub, GitLab.
AWS: VPC, IAM, EC2, Lambda, API Gateway, RDS, DynamoDB, CloudWatch, ECR, S3.
IaC and orchestration: Terraform, Docker, Kubernetes, Helm, Ansible.
CI/CD and observability: Jenkins, Prometheus, Grafana, Nexus, Maven.
Capstone: full DevOps lifecycle for a microservice on AWS EKS.

AZ-200

2025

CompTIA Security+

Nov. 2023

GCP Pro Cloud Architect

May 2023

CompTIA A+

Jan. 2016 · renewed 2019