DevOps and infrastructure
San Francisco, CA · danforthls@skyseekerlabs.net
Everything I run is declared in Git: five NixOS hosts, secrets, DNS and backups, with automated builds, reviewed pull requests and unattended jobs on timers. I'm looking for DevOps and infrastructure roles.
Run 5 NixOS machines (2 desktops, a home server, a public VPS, and a recovery/install ISO) from one Git-tracked flake, with every host reproducible from the repo and no hand-run setup steps. The home server's root filesystem is wiped on every boot, so only explicitly declared state survives.
see it →Automated remote installation and declarative NixOS configuration of servers using nixos-anywhere; 98% of setup is automated, with only secret provisioning done by hand. A full reinstall of the public VPS takes about 30 minutes, nearly all of it unattended.
see it →Run unattended Claude Code jobs on systemd timers: a weekly job updates the fleet's dependencies, builds every host, and opens a pull request for review; a daily job checks new security advisories against the package versions the fleet actually runs. The job prompts live in the Git repo, so a job only changes through a reviewed pull request.
see it →Set up declarative SOPS-based secret management shared across 4 machines, each decrypting with its own age key, stored in a public GitHub repo without leaking secrets.
see it →Ran a security audit of the 5-machine fleet with AI agents: wrote a threat model and severity rubric first, had agents audit 9 areas against it, and ranked the 158 findings by root cause. The most urgent was a live private SSH key left in /tmp, where automatic snapshots had copied it.
see it →Set up fleet-wide log collection with Grafana Alloy, Loki, and Grafana, and periodic ZFS, SMART, and systemd health checks that send a Discord alert when a disk or service fails. The alerts caught silent checksum corruption from a faulty USB drive enclosure, traced to its UAS link and fixed with a kernel quirk and a cable replacement.
see it →
Skyseeker