Platform engineering & SRE
Kubernetes platforms, GitOps and CI/CD that let teams ship often while production stays calm.
Project
certifi
A self-hosted ACME v2 certificate manager that works for private domains.
Overview
certifi issues and renews TLS certificates using ACME DNS-01 challenges, so it needs no inbound HTTP and works for internal and private domains. The ACME client is written in pure Rust, with no external scripts.
Highlights
- certifi-server: a REST API and renewal daemon that runs headless as a certificate backplane
- certifi-cli: an idempotent, cron-friendly CLI that only writes files when something changes
- Optional React admin UI that updates live over server-sent events
- Five DNS providers in-tree: PowerDNS, Cloudflare, DigitalOcean, Hetzner DNS and Gandi LiveDNS
- Optional OpenBao secret backend for keys and credentials
- Multi-architecture (amd64 and arm64) container images published to GHCR
Related expertise
Cloud & infrastructure as code
AWS and Azure environments and migrations, defined in Terraform and Ansible.
Have a hard infrastructure problem?
Open to select consulting, contract and advisory work. Tell me what you are building and where it hurts.