Expertise

The foundations agents and twins run on

Edge telemetry feeds the data platform. The data platform feeds the twins and the agents. All of it runs on infrastructure the client owns and can audit.

01Discipline

Cloud & Infrastructure

Architecting robust enterprise cloud landing zones, automated Terraform IaC pipelines, high-density bare-metal hypervisors, and autonomous zero-cloud-tax PaaS deployment platforms.

Terraform
AWS
Azure
Proxmox VE
Docker
NetBird
WireGuard
CrowdSec
Caddy

Hub-and-spoke multi-cloud topology: a transit hub connecting production, data and telemetry spokes with an on-premises edge over an encrypted mesh. — Enterprise Multi-Cloud & Zero-Trust Transit Hub. Reference topology; client specifics and addressing omitted.

AWS & Azure Enterprise Landing Zones

Production-grade multi-account architectures designed for security, governance, and seamless hybrid cloud interconnectivity.

Show detail (4)

Multi-Account Governance: AWS Organizations, AWS Control Tower, Service Control Policies (SCPs), and Azure Management Groups with strict subscription isolation.
Hybrid Networking: AWS Transit Gateway, Azure Virtual WAN, Hub-and-Spoke VPC peering, and IPsec VPN / Direct Connect / ExpressRoute dedicated routing.
Least-Privilege Security Boundaries: IAM permission boundaries, fine-grained role-based access control (RBAC), KMS/Key Vault envelope encryption, and AWS GuardDuty/Azure Defender security postures.
Egress & Ingress Control: Centralized NAT Gateway inspection pools, Web Application Firewalls (AWS WAF, Azure Front Door), and GeoIP egress filters.

Infrastructure as Code (IaC) with Terraform

Deterministic, modular Terraform automation enabling 100% reproducible environments across public clouds and local emulators.

Show detail (3)

Modular Architecture: Decoupled Terraform modules for Networking (VPCs, Subnets, Route Tables), Compute (ECS, EKS, AKS, EC2), Storage (S3, RDS, Blob Storage), and Security (IAM, SG, ACLs).
State Governance: Remote backend state locking with Amazon S3 and DynamoDB or Azure Blob Storage with optimistic concurrency control.
Cloud Emulator Sandbox: Built an automated CI/CD validation pipeline utilizing Floci 2.1.0 / LocalStack on a dedicated Proxmox VM, allowing developers to test 55+ AWS services locally before production cloud deployment.

Container Orchestration & Microservices (EKS, AKS, Docker)

High-efficiency container runtime administration spanning hyperscaler managed Kubernetes and bare-metal Docker engines.

Show detail (3)

Kubernetes Administration: Deployed and operated production EKS and AKS clusters utilizing Calico CNI, Traefik/NGINX Ingress Controllers, cert-manager automated TLS, and Prometheus-Operator monitoring.
High-Efficiency Alpine Containers: Standardized multi-stage container builds that shrink bloated 1GB+ dev images down to sub-80MB Alpine release artifacts.
Host Socket Execution & Sibling Containers: Mastered secure Docker socket (/var/run/docker.sock) mounting for containerized PaaS runners with strict filesystem path parity between host and container.

Bare-Metal Virtualization (Proxmox VE 8+)

Enterprise hypervisor engineering delivering bare-metal hardware speed with cloud-like virtualization flexibility.

Show detail (3)

High-Density Unprivileged LXC: Running 10+ isolated Linux containers with nesting=1 support for Docker engines at near-zero virtualization overhead.
PCI Passthrough & GPU Compute: KVM virtual machine hypervisors configured with IOMMU GPU passthrough (NVIDIA RTX 5060 Ti, 3090 Ti) for sovereign AI inference.
Linux Kernel Optimization: Persisted sysctl tuning (vm.swappiness=10, dirty_ratio=10) eliminating swap thrashing and keeping RAM latency deterministic.

Zero-Trust Mesh Networking (NetBird & WireGuard)

Encrypted multi-site hybrid overlay connecting distributed bare-metal nodes, edge gateways, and public entrypoints.

Show detail (3)

Peer-to-Peer WireGuard Overlay: Interconnected primary site, primary site, primary site, and primary site (DigitalOcean) without exposing raw ports to the public Internet.
Automated Service Proxy Ingress: NetBird Service Proxies dynamically registering public subdomains routing to internal host ports with Let's Encrypt TLS certificates.
Layer-7 Security & GeoIP Enforcement: CrowdSec intrusion prevention system paired with country-level GeoIP allowlisting (allowing IN/US traffic while neutralizing scanning bots).

02Discipline

Industrial IoT & Telemetry

Architecting ultra-reliable industrial telemetry backbones, high-speed ClickHouse time-series data lakes, enterprise MQTT clustering, and forensic power quality analytics.

ClickHouse
EMQX Enterprise
Node-RED
LoRaWAN
Modbus RTU/TCP
BACnet
ESP32
DuckDB

Industrial telemetry pipeline: field devices and gateways publish over MQTT to EMQX, which streams into ClickHouse for sub-50ms analytics. — Sub-50ms ClickHouse Industrial Telemetry Lakehouse. Reference topology; client specifics and addressing omitted.

ClickHouse Real-Time Time-Series Data Lake

ReplacingMergeTree / AggregatingMergeTree: 2,000,000+ active rows · Millions of daily telemetry events, Sub-50ms analytical response times for 30-day aggregations

Show detail (3)

High-Availability Clustering: Engineered 2-node ClickHouse cluster with ClickHouse Keeper Raft coordination and HAProxy leastconn load balancing.
Extreme Ingestion Throughput: Benchmarked peak ingestion rate of 7.8M rows/sec (500k rows ingested in 0.064s) using ClickHouse Native Format.
Window Function Optimization: Eliminated legacy neighbor() function calls in favor of ANSI SQL window functions (any(timestamp) OVER (PARTITION BY deviceid ORDER BY timestamp ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING)) on ClickHouse 25+.

Mandatory Forensic Energy Calculation Standards

NEVER calculate electrical energy consumption using SUM(active_power * dt) trapezoidal integration.

Show detail (5)

Active Energy (total_active_energy) (kWh): Calculated strictly via MAX - MIN over target window to determine actual billing consumption.
Line-to-Neutral Voltage (voltage_l_n) (Volts (V)): Identifies voltage sags (<215V vs 235V nominal) and grid over-voltage events that stress inductive motor loads.
Current Draw (current) (Amperes (A)): Monitors phase loading; triggers automated high-current alarms when threshold exceeds 15A.
Grid Frequency (frequency) (Hertz (Hz)): Audits national grid stability (nominal 50.0 Hz); flags thermal generator trips during deviations.
Power Factor (power_factor) (Ratio (0.00 – 1.00)): Measures electrical phase displacement; diagnoses capacitor bank failures when PF dips below 0.80.

Industrial Protocols & Fieldbus Integration

Field protocols integrated end to end, from physical layer to analytics.

Show detail (5)

Modbus RTU / Modbus TCP: Interfacing electrical smart energy meters (Eastron SDM630/120), chiller plant VFDs, and central cooling tower sensors.
BACnet IP / BACnet MS/TP: Building Management System (BMS) integration, commercial office VRF indoor units, and primary AHU dampers.
LoRaWAN (Long Range WAN): Long-range wireless transmission from rural 11kV substation feeders and steel tower gateways to cloud receivers.
MQTT 5.0 / Sparkplug B: Standardized lightweight telemetry payload streaming with stateful birth/death certificates.
BLE 5.0 (Bluetooth Low Energy): Localized indoor environmental beaconing, technician configuration diagnostics, and asset tracking.

Enterprise MQTT Messaging Backbone (EMQX 6.2.1)

EMQX Enterprise 6.2.1 container on private bare-metal with persistent Mnesia cluster state and multi-protocol listeners.

Show detail (3)

Direct ClickHouse Connector: Engineered direct rule engine SQL (MQTT-To-Clickhouse) listening on topic a site energy topic and streaming directly to ClickHouse via high-speed native sockets, eliminating Node-RED processing overhead.
Zero Data-Loss Migration: Executed hot upgrade from EMQX 5.9.0 to 6.2.1 with full Mnesia volume preservation, maintaining uninterrupted client sessions across all gateways.
Granular Multi-Tenant RBAC: Configured client authentication and ACLs with per-role identities for hardware gateways, decoding engines, and ESP32 sensors.

Custom Multi-Protocol Industrial IoT Gateway Design

ESP32 dual-core Xtensa LX6 microcontroller / ARM Linux SoM with isolated RS-485 transceiver, SX1262 LoRa module, SIM7600 4G LTE modem, and hardware watchdog.

Show detail (3)

Dual-Language Firmware: Written in modular C++ (FreeRTOS) and Python 3 with automated exception handling and memory leak guards.
Offline Resilience: Integrated 32MB onboard SPI Flash circular buffer storing up to 30 days of offline telemetry during grid or cellular outages.
Auto-Reconnect & State Recovery: Non-blocking state machine maintaining persistent TLS connections to EMQX, AWS IoT Core, Azure IoT Hub, and IBM Watson IoT.

03Reference

Technology stack

Cloud & Infrastructure

Amazon Web Services (AWS)Expert · 8 yrs: VPCs, Transit Gateways, ECS Fargate, EKS, RDS, S3, IAM boundaries, Route 53, and CloudWatch.
Microsoft AzureExpert · 7 yrs: Azure IoT Edge, Azure IoT Hub, AKS, Azure SQL Managed Instance, ExpressRoute, and Azure DevOps CI/CD.
Terraform / IaCExpert · 7 yrs: Modular infrastructure automation for AWS, Azure, and local cloud emulators (Floci 2.1.0, LocalStack).

Bare Metal & Hypervisors

Proxmox VE 8+Expert · 6 yrs: Unprivileged LXC clustering, Docker-in-LXC nesting, KVM IOMMU GPU passthrough, and ZFS storage pools.
Linux Kernel & Systems AdministrationExpert · 10 yrs: Debian/Ubuntu/Alpine systems tuning, systemd unit engineering, sysctl swap/memory optimization, and bash automation.
Docker & Docker ComposeExpert · 9 yrs: Multi-stage Alpine builds (<80MB), Docker socket sibling orchestration, container security, and live container fleets.

AI & LLMOps

LiteLLM GatewayExpert · 3 yrs: Centralized multi-model proxy with PostgreSQL API key management, Redis rate limiting, and custom guardrails.
Local Inference Runtimes (vLLM / Ollama / llama.cpp)Expert · 3 yrs: High-throughput model serving across RTX 5060 Ti, RTX 3090 Ti, Apple M5 Pro, and RTX 2060 with GGUF IQ4/Q4 quant.
Model Context Protocol (FastMCP)Expert · 2 yrs: Authoring custom FastMCP 3.4.5 servers over SSE/stdio for ClickHouse, DuckDB, Postgres, and SQLite tool dispatch.
Multi-Agent Systems & A2A AgencyExpert · 3 yrs: Hierarchical agent networks communicating via A2A protocols with role-gated personas and human-in-the-loop governance.

Big Data & Time Series

ClickHouse Time-Series DBExpert · 5 yrs: High-throughput time-series data lakes (2M+ rows), ReplacingMergeTree, ClickHouse Keeper HA, sub-50ms query latencies.
DuckDB & Parquet AnalyticsAdvanced · 4 yrs: High-speed analytical inspection of Parquet telemetry dumps and offline appliance electrical signature extraction.

IoT & Embedded Hardware

Industrial Modbus & BACnetExpert · 8 yrs: Interfacing HVAC chillers, VRF condensing units, BMS systems, and electrical energy meters over RS485 and Ethernet.
LoRa / LoRaWANExpert · 7 yrs: Long-range wireless telemetry architecture from rural substation feeders and distribution poles to steel tower gateways.
ESP32 & Microcontroller FirmwareExpert · 10 yrs: C++ and FreeRTOS embedded firmware, SPI/I2C sensor interfacing, offline flash circular buffers, and OTA updates.

Networking & Security

NetBird & WireGuard MeshExpert · 4 yrs: Encrypted peer-to-peer overlay networks across multi-site hybrid clouds with automated dynamic TLS reverse proxies.
CrowdSec & Network DefenseAdvanced · 4 yrs: Collaborative intrusion detection/prevention (IDS/IPS), GeoIP filtering, and TLS reverse proxy hardening.

Languages & Frameworks

Python (FastAPI / AsyncIO / Uvicorn)Expert · 9 yrs: RESTful microservices, MCP server authoring, telemetry data pipelines, and AI agent execution frameworks.
Node.js & Next.jsAdvanced · 6 yrs: Next.js 14+ static export, WebGL/SVG isometric digital twin frontends, and Server-Sent Events push pipelines.
C / C++ (Embedded Systems)Expert · 10 yrs: Hard real-time microcontroller firmware, Modbus register decoding, LoRaWAN MAC layers, and hardware interrupt routines.

Databases & Storage

Microsoft SQL ServerAdvanced · 6 yrs: Relational schema design, enterprise backup strategies, and 1TB database migrations to Azure Managed Instances.
PostgreSQL & RedisExpert · 7 yrs: Transactional state storage for LiteLLM multi-tenancy, and Redis high-speed rate-limiting caches.
Qdrant Vector DatabaseAdvanced · 3 yrs: Dense and hybrid vector search collections for enterprise RAG pipelines and autonomous agent memory.

Got a problem an agent, a twin or a better platform could solve?

Send a two-minute brief. You get a reply from me with a first view on approach, timeline and cost.

Send a project brief Email directly