Christian W.-Senior DevOps & Infrastructure Engineer – GitOps, ArgoCD and Infrastructure as Code

Built and advised on the IT infrastructure: site virtualization on Proxmox VE with OPNsense as firewall, WireGuard VPN hub and site-to-cloud connection. Services via HAProxy, SSL via acme.sh/Let's Encrypt, DNS via Unbound. IaC with Terraform and Ansible. Backup with a Python tool and ZFS containers. In addition: analysis of DOKS and staging cluster on RKE2 with GitOps via ArgoCD.

• Built site infrastructure on Proxmox VE, with OPNsense as a virtualized firewall and WireGuard as a VPN hub.
• Implemented Infrastructure as Code throughout: Proxmox containers, VMs and the DigitalOcean Droplet are provisioned with Terraform, then VMs and services are configured with Ansible. This makes the environment reproducible and allows it to be rebuilt after an outage.
• Published internal services through HAProxy and terminated SSL there: acme.sh automatically obtains certificates from Let's Encrypt via DNS challenge, while name resolution runs through Unbound DNS.
• Set up secure remote access for employees: encrypted access to the company network and internal services from outside the office, implemented through the WireGuard VPN hub.
• Implemented site-to-site VPN: WireGuard tunnel between the OPNsense hub at the site and a DigitalOcean Droplet as the cloud endpoint. Additional endpoints at Scaleway and Exoscale are planned.

Technologies: Proxmox VE, Terraform, Ansible, Kubernetes (DOKS), Kubernetes (RKE2), ArgoCD, Helm / Helmfile, PostgreSQL, OPNsense, WireGuard VPN, HAProxy, acme.sh / Let's Encrypt, Unbound DNS, DigitalOcean, Scaleway, Exoscale, On-Premise NAS, ZFS, Python 3 / boto3, systemd, GitHub Actions, CI/CD Pipelines

Overall project responsibility for designing and implementing the network and NAS infrastructure of a production studio. Responsible for hardware selection, assembly and RAID configuration of a custom NAS server (FANTEC 12-Bay Chassis, AMD Ryzen), as well as lossless migration of existing production data.

• Designed and implemented network and NAS infrastructure for a production studio: advised on the optimal storage and network solution for ongoing production operations.
• Built custom NAS server (FANTEC 2HE 12-Bay Chassis, AMD Ryzen): hardware selection, assembly, RAID configuration and complete data migration; existing production data transferred without loss.
• Overall project responsibility from consulting to commissioning: evaluation, procurement, setup and acceptance in one assignment without additional service providers.

Technologies: Custom NAS Build, AMD Ryzen, FANTEC 12-Bay Chassis, RAID, Gigabit Ethernet, Data Migration

Overall responsibility for infrastructure architecture, IaC and web application development in one engagement. Integration of Rust components for client-side computation, development of Ansible playbooks for automated VPS provisioning, and Terraform-based, reproducible infrastructure provisioning. Zabbix monitoring and WireGuard-based P2P communication setup.

• Performance optimization: integrated Rust components for client-side calculations in web applications, noticeably reducing CPU load on servers
• End-to-end IT responsibility in one engagement: covered infrastructure architecture, IaC, deployment automation and web application development, with no separate DevOps provider required.
• Developed Ansible playbooks for automated VPS provisioning: reduced setup time from ~3 hours (manual) to 15 minutes, versioned in Git
• IaC migration: introduced Terraform + Ansible infrastructure provisioning, completely eliminated manual server configuration, and enabled reproducible deployments for all VPS instances
• Set up Zabbix monitoring for all managed systems, with proactive alerting configuration preventing unplanned outages
• Implemented secure P2P communication setup: reduced server load by ~40% compared to a centralized model

Technologies: Rust, Node.js, TypeScript, Chrome Extensions API, Manifest Version 3, Ansible Automation, Terraform, Proxmox VE, Linux (Debian/Ubuntu), WireGuard VPN, Zabbix Monitoring, Docker

End-to-end responsibility for rebuilding the entire network infrastructure of a coworking space with 16 offices and 40 workstations. Responsible for planning and installing Aruba switches and UniFi APs, VLAN isolation per tenant, QoS configuration for stable video calls, and setting up Zabbix monitoring. Planning, installation and commissioning delivered onsite in 1 day.

• Rebuilt the entire network infrastructure for 16 offices (40 workstations, 500 m², up to 64 simultaneous users): newly purchased Aruba switches + UniFi APs, with VLAN isolation per tenant ensuring data separation without compromising the shared internet connection.
• Configured QoS for video calls: prioritized video calls in a shared environment, ensuring stable connection quality even during simultaneous full usage by multiple office units.
• Set up Zabbix monitoring: network problems are detected proactively before affecting coworking operations, with no unplanned outage after commissioning.

Technologies: UniFi Network, UniFi Controller, Aruba Networks, Zabbix Monitoring, Ansible Automation, VLAN, QoS

End-to-end implementation of the ERPNext implementation and dealer portal: requirements gathering (requirements specification and functional specification) with key users and external dealers through to acceptance. ERPNext backend + Quasar dealer portal as a two-layer platform architecture, offline-capable field service PWA, and BPMN modeling of warranty, ordering and service processes. Additionally: CI/CD (Jenkins, Proxmox-HA-Cluster).

• ERPNext workflow automation completely replaced the manual Excel processes for the automotive/e-mobility customer: 1.300+ warranty cases are processed digitally, reducing processing effort by 87%.
• Built an offline-capable field service PWA (Vue 3/Quasar) that enables field teams to manage spare parts, register vehicles, process warranties and receive real-time updates via Socket.io. The app connects directly to the ERPNext/Frappe backend via OAuth2, allowing service technicians to record orders directly onsite instead of processing them later in the office.
• Designed a two-layer platform architecture: ERPNext as the backend for master data, inventory and accounting, with a Quasar dealer portal as a self-service frontend. The clear separation between the internal ERP system and external dealer access serves more than 300 users.
• Hierarchical multi-tenant architecture with server-side row-level security: data access based on the relationship customer → dealership → dealer group (multiple site addresses per dealership for warranty billing), filtered directly at database query level (Frappe_permission_query_conditions), not only in the UI. 300+ external dealer accounts see only their own vehicles, registrations and warranty claims.
• End-to-end project responsibility: workshops and structured requirements gathering with internal key users (warehouse, service, accounting) and external dealers as end-user representatives, requirements specification, functional specification, and formal acceptance by management before go-live.
• BOM-based spare parts search for 30 vehicle models with 1.800–3.000 items per model: dealers can find, save and order spare parts directly in the portal, with orders automatically transferred to ERPNext as warehouse orders.
• Modeled processes in BPMN and implemented them directly in the Frappe Workflow Engine: warranty, ordering and service processes fully documented, role-based state transitions, 1.300+ warranty cases processed, completely replacing manual Excel processing.
• LMS integration for 300+ dealers and employees: integrated an e-learning portal with training materials, certification workflows and progress tracking, fully digitizing dealer onboarding and product training.
• Print Formats with Jinja templating: delivery notes, quotations and invoices generated entirely in ERPNext in the customer-specific corporate design.
• CI/CD pipeline with Jenkins + Proxmox HA-Cluster: zero-downtime deployments, off-site backup strategy (LXC container snapshots on Hetzner Storage Box) and Zabbix monitoring for 2.5 years of uninterrupted production operation.
• Developed a reusable frontend ecosystem as custom npm packages (Frappe-JS-SDK, UI library, in-app messaging, analytics tracker) with JWT/OAuth2 authentication and real-time messaging (Socket.io) between dealers and the internal service team, including custom API endpoints in the Frappe backend.
• Scope of custom development: ~18 business-related custom DocTypes in the Frappe backend (warranty claim alone with 52 fields and a defined status workflow) and 330+ Vue-3/Quasar components in the frontend, secured by end-to-end tests (Playwright), unit tests (Vitest) and security linting.

Technologies: ERPNext Version 15, Python (Frappe Framework 15), TypeScript/JavaScript, Quasar/Vue.js, Pinia, Socket.io (Realtime), PWA (offline-capable), TailwindCSS, Jinja (Print Formats), Jenkins CI/CD, Proxmox VE, Terraform, Ansible

Independently designed and implemented the high-performance infrastructure for 4K video production. Built the highly available 10Gbit/2.5Gbit network architecture as well as redundant Synology and TrueNAS storage systems. Responsible for Zabbix monitoring and Ansible automation for proactive monitoring of storage and network.

• Reduced project loading times for 4K video editing tenfold: a new 10-Gbit network infrastructure reduced waiting time from 5–10 minutes to under one minute.
• Built highly available 10-Gbit/2.5-Gbit network architecture: more than 30 ORF productions ran through production and editing without a single network or storage outage.
• Provided high-performance storage: Synology RAID 5 with 6 drives and 96 TB for SAF event production, plus 100 TB TrueNAS with 10-Gbit throughput in the office, encrypted and redundant.

Technologies: 10Gbit Ethernet, 2.5Gbit Ethernet, Managed Switches, Synology NAS, TrueNAS, ZFS, RAID 5, NAS, macOS, Ansible, Zabbix, WireGuard VPN, High-Availability Infrastructure

Built and operated the entire office IT infrastructure for a court-appointed and sworn building expert. 30-year archiving infrastructure on TrueNAS ZFS with automated snapshots and offsite replication, as well as overall responsibility for 12+ devices including NAS, A3/A0 printers and phones. Set up WireGuard VPN for secure mobile access and built Zabbix monitoring and Ansible automation.

• 30-year archiving infrastructure for a court-appointed and sworn building expert: TrueNAS ZFS with automated snapshots and offsite replication, ensuring expert reports and construction plans are legally compliant and permanently secured.
• Overall responsibility for 12+ devices (2 desktops, 3 mobile devices, 2 NAS, A3/A0 printers, 2 phones): centralized management without an external IT service provider for ongoing operations.
• WireGuard VPN for mobile access: secure access to office systems and the expert report archive during construction site visits and court hearings, with no confidential data stored in cloud services.

Technologies: TrueNAS (ZFS), Proxmox VE, WireGuard VPN, Zabbix Monitoring, Ansible Automation, Debian Linux, GDPR Compliance

• Development of a digital consulting matchmaking platform for beeex GmbH to support companies with digitalization and automation.
• Development of a responsive frontend interface with Ionic/Angular that works on different devices.
• Implementation of the backend with NestJS, TypeScript and MS Azure for a robust, scalable server architecture.
• Introduction of a comprehensive rating system for users to ensure the quality and transparency of consulting services.
• Integration of subscription models with automated billing through Global Payments for recurring revenue.
• Ensuring smooth and reliable payment processing between consultants and users.
• Close collaboration with the marketing team to align the platform with the needs of the target audience.
• Project-related technical activities: Ionic, NestJS, TypeScript, Global Payments, MS Azure DevOps.

DevOps Engineer in the infrastructure and CI/CD environment. Led two Junior DevOps Engineers and trained 35+ developers in CI/CD, code quality and Infrastructure Automation. Built GitLab and Jenkins pipelines with Docker for 30+ applications and operated the infrastructure (HAProxy, Apache, Proxmox VE, pfSense) for 200 employees, as well as IaC with Ansible and Puppet.

• Accelerated release cycles by 60%: Fully automated deployment for more than 30 production-ready applications using GitLab CI/CD and Jenkins multi-stage pipelines with Docker integration.
• Led two Junior DevOps Engineers and trained 35+ developers in CI/CD, code quality and Infrastructure Automation.
• The infrastructure ran for three years without a critical outage: HAProxy and Apache for the online shop, Proxmox VE and pfSense for the internal network with 200 employees.
• Infrastructure as Code: Introduced Ansible + Puppet for automated server provisioning, completely eliminating manual deployments

Technologies: GitLab CI/CD, Jenkins CI/CD, Docker, Proxmox VE, pfSense Firewall, HAProxy Load Balancer, Apache Web Server, Ansible, Puppet, PHP 7.4/8.0, Laravel, Zend Framework, Zabbix, phpunit, PHP_CodeSniffer

Sole responsibility for the long-term operation of business-critical IT infrastructure with two Proxmox hosts and TrueNAS Scale (ZFS Mirror). Responsible for versioned, reproducible operations using Terraform and Ansible, offsite disaster recovery through automatic ZFS snapshot replication via WireGuard VPN, and proactive Zabbix monitoring.

• Two Proxmox hosts with TrueNAS Scale (four 8-TB drives in a ZFS Mirror each) keep business-critical production data highly available, except during scheduled maintenance windows.
• Implemented offsite disaster recovery: ZFS snapshots are automatically replicated via WireGuard VPN to a second location
• Proactive Zabbix monitoring with alerting

Technologies: Proxmox VE, Terraform, Ansible Automation, TrueNAS Scale, ZFS, ZFS Snapshot Replication, WireGuard VPN, Zabbix Monitoring, macOS