ops --recent

Projects & operations

Every project follows the same structure: problem → approach → tech → result. No unmeasured numbers; organisation details stay private (OPSEC).

Recent operations

OP-01Infrastructure

Data Center Migration

Data Center Migration
Problem
Corporate server workloads had to be moved to a new cloud / data center infrastructure without disrupting business continuity.
Approach
The IP plan, DNS and routing architecture were redesigned ahead of the move, and workloads were migrated in phases to keep downtime windows to a minimum.
Result
Workloads were moved to the new infrastructure, and the network architecture was reworked for the new environment.
Technologies
  • Routing
  • DNS
  • IP planning
  • Virtualization
OP-02Security

FortiGate HA Cluster Transformation

Next-gen firewall
Problem
The firewall infrastructure needed to move to a high-availability architecture, and a policy set that had grown over the years needed simplifying.
Approach
An Active-Passive HA cluster was built on next-generation appliances; security policies were reviewed one by one, cleaned up and optimised.
Result
The firewall layer now runs on a clustered architecture with a leaner policy set.
Technologies
  • FortiGate
  • HA
  • Firewall policy
OP-03Automation

Infrastructure Automation & Monitoring

Backup · Alerting · M365
Problem
Tracking database backups and managing Exchange Online archives and quotas meant regular, repetitive manual work.
Approach
Wrote scripts that automatically back up PostgreSQL to MinIO S3 and report the outcome to Telegram, plus PowerShell tooling for Exchange Online administration.
Result
Backup status is now visible through real-time notifications, and repetitive M365 tasks have moved into scripts.
Technologies
  • PostgreSQL
  • MinIO S3
  • Bash
  • PowerShell
  • Telegram Bot API
OP-04Infrastructure

Physical-to-Virtual Optimization

Physical → Virtual → Cost
Problem
The infrastructure had to be managed end to end, from the physical server room to virtual machines in the cloud.
Approach
Ran the relocation of the server room's FM200 fire suppression system, and analysed CPU / RAM / disk usage of the cloud VMs.
Result
Right-sizing recommendations and cost analyses were prepared based on actual resource usage.
Technologies
  • FM200
  • Right-sizing
  • FinOps
OP-05Internal tool

Database Backup Portal

Backup · Restore · DR
Problem
PostgreSQL, MySQL and MSSQL backups were managed in a scattered way, with different tools.
Approach
Built a portal that brings backup, restore and disaster recovery together in a single panel: GFS retention, MinIO/S3 targets, encryption, RBAC and 2FA.
Result
Automated backups are running for all three database engines; targets, schedules and notifications are managed from the panel without touching code.
Technologies
  • FastAPI
  • SQLAlchemy
  • MinIO S3
  • RBAC
  • 2FA
OP-06Security

Windows LAPS Management Tool

PowerShell · Windows Forms
Problem
Accessing local administrator passwords required broader privileges than necessary.
Approach
Wrote a permission-controlled LAPS tool in PowerShell + Windows Forms; the right to decrypt passwords was limited to a dedicated admin group.
Result
Password access is now tied to a separate role in line with least privilege, reducing unnecessary Domain Admins access.
Technologies
  • PowerShell
  • Windows Forms
  • Active Directory
  • LAPS
OP-07AI

This site · built with AI

Human-in-the-loop
Problem
A personal site that is production quality and OPSEC-clean, with no credit card on file and a cost of ₺0.
Approach
Design, code and build pipeline with Claude; a second opinion on content from ChatGPT. Every output went through human review: an OPSEC sweep, removal of unverifiable claims, and browser testing.
Result
Every page is pre-rendered static HTML: readable without JavaScript, with structured data and llms.txt for search engines and AI assistants. Cost ₺0, no third-party scripts, strict CSP enabled.
Technologies
  • Claude
  • ChatGPT
  • Python · Jinja2
  • Vanilla JS
  • Schema.org
  • Cloudflare Pages
OP-08Infrastructure

Multi-Data-Center Kubernetes Upgrade

RKE2 · Longhorn · cert-manager
Problem
Kubernetes environments spread across several data centers had drifted to different versions; compatibility between components made maintenance and upgrades difficult.
Approach
Started with an inventory using read-only commands. Each step ran first in the test environment, then in production environments one at a time with separate sign-off; components were upgraded in the correct order according to the official compatibility matrix.
Result
All environments are on the same supported versions, and the upgrade steps are documented as a reusable runbook.
Technologies
  • RKE2
  • Rancher
  • Longhorn
  • cert-manager
  • Helm
  • Linux
OP-09Disaster recovery

Kubernetes Backup & Restore Drill

Velero · Longhorn · etcd · PITR
Problem
The Kubernetes environments needed an end-to-end, verifiable backup and recovery strategy.
Approach
Combined open-source Velero + Longhorn volume backups, etcd snapshots and point-in-time recovery (PITR) for databases into a single strategy. Backups go to a separate location, and each backup user can write only to its own area with least privilege.
Result
Backups run automatically and their results are monitored with alerts. The strategy was validated in a drill by deleting a namespace and restoring it from backup.
Technologies
  • Velero
  • Longhorn
  • etcd
  • MinIO S3
  • wal-g
  • PostgreSQL
OP-10Documentation

Infrastructure Takeover & Documentation

Handover · Runbook · Topology
Problem
An undocumented infrastructure built by an external vendor had to be taken over.
Approach
The setup was surveyed read-only and recorded layer by layer. During the handover, access and permissions were reorganised according to least privilege.
Result
Comprehensive technical documentation plus a concise handover pack for new teams: architecture diagrams, disaster scenarios and a "which backup for which need" table.
Technologies
  • Markdown
  • Mermaid
  • Python
  • Runbook
  • RBAC
OP-11Security

PHP Security Patch Without Code Changes

Backport base image · Trivy
Problem
When a critical PHP vulnerability was published, applications whose code could not be changed quickly also needed fast protection.
Approach
Affected containers were identified by measurement and interim mitigations were applied the same day. For a permanent fix, a base image was built with the official source patch applied to the same PHP version; CI will not publish an image without patch verification and a smoke test.
Result
A path to patched images was opened without touching application code; images are scanned with Trivy.
Technologies
  • Docker
  • Buildah
  • GitLab CI/CD
  • PHP-FPM
  • Kubernetes
  • Trivy
ls ~/projects --built-with=claude-code

Internal tools built with AI

Tools built with Claude Code for the real needs of an infrastructure team. Figures are measured from git history; organisation, system and address details are withheld (OPSEC).

July – October 202616 git repositories~2,235 commitsmostly a single developer19 tools

Secure corporate file transfer system

Personal link + one-time code · virus scanning · encrypted storage · time-limited sharing · audit log · KVKK (Turkish data protection law)

  • 32 commits
  • solo developer
  • 5 days
  • ~10.6K lines

Guest Wi-Fi portal (Law 5651 compliant)

SMS verification · RADIUS · syslog · signed, timestamped log archive · KVKK consent

  • 118 commits
  • solo developer
  • 2 days
  • ~19.5K lines

Infrastructure request & overtime approval system

FastAPI · SQLAlchemy · LDAP authentication · approval workflows

  • 806 commits
  • solo developer
  • 1 month
  • 190 commits in the first 2 days
  • ~42K lines

Access control & time-attendance modernisation

Migration from a legacy C# WinForms app to FastAPI + PostgreSQL · bug sweeps and audit reports

  • 247 commits
  • solo developer
  • 1 week
  • ~45K lines

IT asset assignment & inventory portal

FastAPI · PostgreSQL · MinIO · GLPI and AD/LDAP sync · onboarding/offboarding flow

  • 144 commits
  • solo developer
  • ~15K lines

Database backup portal

FastAPI · GFS retention · MinIO/S3 · MySQL / PostgreSQL / MSSQL · encryption, RBAC, 2FA

  • 417 commits
  • solo developer
  • ~1.5 months

+13 smaller tools

  • Vehicle request & booking systemTaken over and extended · Next.js · state machine · e2e tests
  • Staff time & attendance trackingFlask · MSSQL · Redis · automatic export to an HR SaaS platform
  • Mail matching toolFlask · MSAL · Microsoft Graph
  • Meeting room status displayMicrosoft Graph API · room calendars
  • PST mergerPython · Windows desktop · Outlook
  • Company vehicle assignment trackerNext.js · Prisma · Power BI report
  • Corporate digital newsletterNext.js · page-flip PDF magazine
  • Hotel booking request formStep-by-step form · PDF · email
  • Flight ticket request formStep-by-step form · PDF · backend shared with mobile clients
  • Cafeteria menu portalFastAPI · menus from Excel
  • Employee suggestion & complaint systemWeb form · admin panel · Docker
  • Internal phone directoryNode.js · Excel import
  • Announcement displayPHP · visual announcements
tail -n 5 /var/log/cases.log

Case files · Troubleshooting log

Approach-focused summaries with environment and organisation details removed. Look first → then act.

CASE-503● case

Healthy backend, proxy returning 503

Caddy · health check

The backend returned 200 while the health check expected a 4xx, so the proxy marked the service "unhealthy" and served 503s. The fix was aligning the check with the expected response.

Read the full note
CASE-CPU● case

High CPU & load on PostgreSQL

pg_stat_statements

Looked at query statistics instead of server graphs, and narrowed down the source using execution times and the statistics reset timestamp.

Read the full note
CASE-LAPS● case

Controlled LAPS access

AD · PowerShell

The right to decrypt passwords moved to a dedicated group; not everyone needs to be a Domain Admin.

Read the full note
CASE-K8S● case

Certificate error in the pipeline

GitLab CI · kubeconfig

The problem was isolated from the application code and narrowed down to Kubernetes API access, certificates and credentials.

Read the full note
CASE-DR● case

Backups exist, but never rehearsed

Velero · Longhorn · etcd

A backup tool that looks installed does not mean backups are being taken. The real proof comes when a namespace is deleted and restored from backup.

Read the full note
CASE-PHP● case

PHP patch without code changes

Backport · base image

For applications whose code cannot be changed quickly, the official source patch is applied to the same PHP version; the applications are simply rebuilt on the new base image.

Read the full note
CASE-RBAC● case

Read-only Kubernetes role

Rancher · RBAC

Teams can see pods, services and deployments; they cannot read Secrets, make changes or exec into containers.

Read the full note

Got an infrastructure question, a project or a route tip?

Email is the fastest way. If I'm on the road, I'll reply from the next Wi-Fi.

Send an email