Building systems
that stay up.
MSc student in Applied Computer Science with a hands-on background in designing and operating production-grade infrastructure — hypervisors, VLAN-segmented networking, zero-trust access, and full observability stack, all self-built and self-operated.
About
I'm Petr, and I'm looking for an infrastructure or platform engineering role — designing and running the systems other people's work depends on. My degree is in software development, but the work I find most compelling sits at the boundary between software and infrastructure: the layer where reliability, security and operational discipline actually get enforced.
Since 2024 I've administered a 240 TB storage and virtualisation server for a university department. Alongside it I've spent four years building and running my own infrastructure, which stopped being a sandbox a long time ago: people outside this household depend on several of the services, and my own monitoring is what tells me when something breaks. The architecture, the trade-offs, and the two tools I wrote for it are documented below.
If your team cares about doing these things properly, I'd like to talk.
Professional experience
Server administration
The work began as part of an IGA grant: assess what the department actually needed, then specify and procure a server that fit both the requirements and a fixed budget. I did the physical installation into the department's rack myself, and I have administered the machine ever since.
It provides roughly 240 TB of centralised storage with redundancy, and ACLs so each group reaches only the data it should. On top of that runs Proxmox, hosting virtual workstations with full desktop environments that staff reach over RustDesk.
Certifications
My homelab
Four years of building, breaking and rebuilding — hypervisors, segmented networking, zero-trust access and full observability.
What started four years ago as one machine under a desk is now two Proxmox nodes and a TrueNAS box carrying 25+ services across six VLANs, with a default-deny firewall between them. It is not just mine any more — friends and family outside this household use several of the services, and the busiest ones handle up to seven concurrent users.
Web services are never exposed by an open port; they come in through Cloudflare tunnels. Game and voice servers are port-forwarded, and that is precisely why they sit in a VLAN of their own — if one of them is breached, the blast radius stops at that segment instead of reaching storage, backups or anything else. Prometheus, Grafana, Loki and Wazuh watch all of it, and CrowdSec bans attackers at the proxy before they reach a service.
Selected projects
Software written for this environment and released as open source.
SpeedMeasure
Runs scheduled speed tests and builds an evidence trail for when the ISP drops below the plan you pay for.
WaterThingy
Tracks plants, pots and soil mixes, with a species library filled from the Trefle botanical API.
