Infrastructure Portfolio
Systems I operate
This is the production infrastructure I operate: DustBowl.Games and the bare-metal Kubernetes platform underneath it. Open a project for architecture diagrams, tooling, and operational metrics.
DustBowl.Games
Game infrastructure on Kubernetes
DustBowl.Games is a live multiplayer and game server hosting community operated on top of bare-metal Kubernetes. The platform automates fleet provisioning, DDoS mitigation, and database backups.
99.9%
Fleet Uptime
15+
Active Game Nodes
HA
PostgreSQL DB
Infrastructure Topology
manifest // live┌─────────────────────────────────────────────────────────┐
│ Cloudflare Edge Proxy / WireGuard UDP Filter │
└────────────────────────────┬────────────────────────────┘
│
┌────────────────────────────▼────────────────────────────┐
│ Traefik Sticky Ingress (Sticky SignalR + TCP/UDP) │
└───────────────┬─────────────────────────┬───────────────┘
│ │
┌─────────────▼─────────────┐ ┌─────▼─────────────────────┐
│ Blazor Server Frontend │ │ Game Server Deployments │
│ (Static SSR + SignalR) │ │ (Pterodactyl Wings Nodes)│
└─────────────┬─────────────┘ └─────┬─────────────────────┘
│ │
┌───────────────▼─────────────────────────▼───────────────┐
│ CloudNativePG High-Availability PostgreSQL Cluster │
│ Longhorn Persistent Volumes + Automated S3 Snapshots │
└─────────────────────────────────────────────────────────┘Architecture highlights
- Blazor Server frontend with sticky-cookie Traefik ingress for stateful game dashboards
- CloudNativePG PostgreSQL high-availability database cluster with automated failover
- Low-latency UDP game traffic routed via dedicated WireGuard proxies with custom DDoS filtering
Homelab & Cluster
Kubernetes on bare metal
This is the platform behind DustBowl.Games and WyattJohnson.tech. Harvester HCI runs beneath a 6-node RKE2 cluster with 60+ services, distributed storage, HA databases with off-site backups, GitOps, admission control, and monitoring.
4
Bare-metal nodes
60+
Self-hosted services
176
CPU cores (HCI)
448 GiB
RAM (HCI)
18
Postgres clusters
98%
Uptime SLA
Infrastructure Topology
manifest // live┌─────────────────────────────────────────────────────────────────┐
│ Cloudflare Edge / Tunnel │
└───────────────────────────────┬─────────────────────────────────┘
│ (Zero Inbound Open Ports)
┌───────────────────────────────▼─────────────────────────────────┐
│ MetalLB L2 VIP (kube-vip HA Control) │
├───────────────────────────────┬─────────────────────────────────┤
│ Traefik Ingress Router │ Cert-Manager TLS (Let's Enc) │
└───────────────┬───────────────┴─────────────────┬───────────────┘
│ │
┌─────────────▼─────────────┐ ┌─────────────▼─────────────┐
│ RKE2 Guest Cluster │ │ CloudNativePG (HA) │
│ 3 Control + 3 Worker │ │ 18 Postgres Clusters │
│ 60+ App Pods (Harvester)│ │ Nightly Wasabi S3 Sync │
└─────────────┬─────────────┘ └─────────────┬─────────────┘
│ │
┌───────────────▼─────────────────────────────────▼───────────────┐
│ Longhorn Distributed Block Storage (NVMe/SATA Tiered Volumes) │
├─────────────────────────────────────────────────────────────────┤
│ Harvester HCI Bare-Metal Nodes (Dell R740xd + 3x Beelink EQi12)│
└─────────────────────────────────────────────────────────────────┘Hardware
- 3× Beelink EQi12 mini PCs: 16 cores / 64 GiB each
- Dell PowerEdge R740xd: 80 cores / 256 GiB, iDRAC-managed
- Harvester HCI v1.7.1 hyperconverging compute + storage
- Custom 3D-printed rack mounts; ~120 W idle draw
Platform & orchestration
- Guest RKE2 Kubernetes: 3 control-plane + 3 worker nodes
- kube-vip HA API server with MetalLB L2 load balancing
- Traefik ingress + cert-manager (Let's Encrypt & internal CA)
- Managed through Rancher
GitOps & CI/CD
- Self-hosted Gitea with native Actions runners
- Pipeline: build, Semgrep + Trivy scan, then push to the internal registry
- ArgoCD for GitOps continuous deployment
- Helm + Kustomize for application delivery
Storage & data
- Longhorn distributed block storage
- 18 PostgreSQL clusters via the CloudNativePG operator
- Nightly off-site backups to Wasabi S3 (90-day retention)
Networking & access
- VLAN-segmented network with dual Pi-hole DNS (HA, DNS-over-HTTPS)
- Cloudflare Tunnel for public HTTP/S with zero inbound ports
- External WireGuard proxy with game-aware DDoS filtering for UDP (~10–15 ms)
Observability & security
- Prometheus + Grafana, InfluxDB, and Beszel host monitoring
- Public uptime monitoring via Uptime Kuma
- Kubewarden admission policies + hourly CIS benchmark scans
- Vaultwarden-managed secrets; MFA on every admin surface
What it runs
60+ containerized services spanning public, personal, and platform workloads:
- Public sites: dustbowl.games and this portfolio
- AI and automation: Open WebUI (Ollama) and n8n workflows
- Productivity: Outline wiki, Linkwarden, Vikunja, snippet manager
- Media and home: Home Assistant, Paperless-ngx, family apps
- Platform: Grafana, Rancher, ArgoCD, Gitea, Vaultwarden
PowerShell RMM & Patch Engine
Fleet-scale PowerShell & RMM automation
Engineered automated toolsets and remediation pipelines that maintain rigorous patch compliance, zero-touch third-party software updates, and self-healing endpoints across a 1,000+ machine fleet.
1,000+
Managed Endpoints
98%+
Patch Compliance
Zero-Touch
Deployment Model
Infrastructure Topology
manifest // live┌─────────────────────────────────────────────────────────┐
│ RMM Central Management & Trigger Engine │
└────────────────────────────┬────────────────────────────┘
│ (Signed PS Script Modules)
┌────────────────────────────▼────────────────────────────┐
│ Target Fleet: Windows Workstations & Servers │
├─────────────────────────────────────────────────────────┤
│ • Automated OS Patching & Kernel Reboot Scheduling │
│ • Dynamic Winget / Chocolatey App Packaging & Sync │
│ • Self-Healing Service Watchdogs & Event Log Auditing │
└────────────────────────────┬────────────────────────────┘
│
┌────────────────────────────▼────────────────────────────┐
│ Telemetry, ITIL Change Audit & Compliance Reports │
└─────────────────────────────────────────────────────────┘Core capabilities
- Modular PowerShell libraries for unattended maintenance windows and automated reboot suppression
- Continuous EDR agent enforcement and vulnerability remediation scripts
- Automated BitLocker key escrow and compliance auditing against CIS benchmark standards
Microsoft 365 & Zero-Trust Fleet
Modern cloud identity & device management
Architected and delivered modern workplace configurations combining Microsoft Entra ID Conditional Access, Intune device configuration profiles, and Microsoft Defender for Endpoint.
100%
MFA Enforcement
CIS L1/L2
Security Baseline
MDM/MAM
Device Compliance
Infrastructure Topology
manifest // live┌─────────────────────────────────────────────────────────┐
│ Microsoft Entra ID (Azure AD) Identity Core │
└────────────────────────────┬────────────────────────────┘
│ (Conditional Access Policies)
┌────────────────────────────▼────────────────────────────┐
│ MFA / FIDO2 Authentication + Compliant Device Check │
└────────────┬─────────────────────────────┬──────────────┘
│ │
┌───────────▼─────────────┐ ┌───────────▼─────────────┐
│ Intune Autopilot / MDM │ │ Defender for Endpoint │
│ Enforced Encryption │ │ Real-Time Threat EDR │
└─────────────────────────┘ └─────────────────────────┘Security Architecture
- Enforced phish-resistant MFA and risk-based sign-in Conditional Access policies
- Automated Windows Autopilot device enrollment with BitLocker and Defender baselines
- Exchange Online hardening with DKIM, DMARC, SPF, and Anti-Phishing protection
Edge WireGuard Anti-DDoS Proxy
High-performance edge proxy & DDoS mitigation
To provide resilient UDP routing for competitive multiplayer game servers hosted on Kubernetes, an edge proxy forwards filtered UDP packets over encrypted WireGuard tunnels directly into the cluster worker overlay.
10–15 ms
Added Latency
10 Gbps
Edge Ingress
100%
Encrypted Tunnel
Infrastructure Topology
manifest // live┌─────────────────────────────────────────────────────────┐
│ Public Internet UDP Game Traffic │
└────────────────────────────┬────────────────────────────┘
│
┌────────────────────────────▼────────────────────────────┐
│ Edge Shield Node: eBPF / XDP Rate-Limiting Filter │
└────────────────────────────┬────────────────────────────┘
│ (Point-to-Point WireGuard Tunnel)
┌────────────────────────────▼────────────────────────────┐
│ Bare-Metal Kubernetes Worker Node (RKE2) │
│ Pterodactyl Game Server Pods (Dedicated Ports) │
└─────────────────────────────────────────────────────────┘Implementation Details
- Kernel-level packet inspection using XDP filter rules before userspace parsing
- Zero-trust WireGuard peer network isolating edge nodes from internal LAN control plane
- Automated health checking and failover between secondary edge shield providers
WyattJohnson.tech Platform
High-performance Blazor SSR on Kubernetes
WyattJohnson.tech is designed for maximum speed, security, and uptime. It renders 100% static SSR without circuit overhead, includes automated Gitea Actions CI/CD pipelines, hardened container security contexts, and Prometheus metrics.
100%
Static SSR
A+
Security Headers
0
Database Overhead
Infrastructure Topology
manifest // live┌─────────────────────────────────────────────────────────┐
│ Gitea Git Push → Automated CI/CD Workflow │
└────────────────────────────┬────────────────────────────┘
│ (Build, Lint, Docker Push)
┌────────────────────────────▼────────────────────────────┐
│ Kubernetes Cluster: wyattjohnsontech-website │
├─────────────────────────────────────────────────────────┤
│ • Traefik Ingress with Sticky Session Routing │
│ • Hardened Container (Non-Root UID 1654, ReadOnly Root)│
│ • Live /metrics Prometheus & /healthz Health Endpoint │
└─────────────────────────────────────────────────────────┘Key Highlights
- Static Server-Side Rendering (SSR) for instant first paint and SEO indexability
- Kubernetes deployment managed via custom Helm chart and namespace-scoped deployer RBAC
- Continuous integration with code formatting verification and container security scanning
Direct Collaboration
Have an infrastructure or automation challenge?
Whether you need to stabilize Kubernetes, automate Windows/M365 fleets with PowerShell, or architect private cloud workloads, let's talk.