Skip to main content

Cloud & Platform

Seven years building systems, now going deeper on how they're run. I'm a fullstack engineer specialising in cloud architecture and platform work: provisioning with Terraform, operating what I build, and understanding the failure modes before they find me.

  • AWS
  • Terraform
  • Docker
  • Go

Infrastructure I've run

AWS with Terraform

At Xedla Pay I author the AWS infrastructure as code. Applied in production: S3 and the remote state backend, with versioning, server-side encryption and public-access blocking. A second, validated module defines a staging environment of VPC and subnets, EC2, ECS, ECR, CloudWatch and IAM roles and policies.

Production ownership

At Kikokushijo Academy I own the deploy path for the learning platform: environments, releases, the database and hosting configuration. That is fullstack ownership including deployment rather than infrastructure engineering — the hosting itself is managed.

Multi-tenant SaaS

I build and operate Braandly and MosesTab. Tenant isolation, access control, hosting, monitoring and cost all sit with me. Braandly runs as a Docker image on a VPS behind a CDN, with Redis-backed queues, twenty-odd scheduled jobs and a self-built OAuth 2.1 server; MosesTab gives every church its own Stripe Connect account.

Agency infrastructure

Through Fovero I ran provisioning, deployment, DNS, certificates and uptime for client projects from 2020 onward. Unglamorous, and the reason I know what breaks.

Tools I've built

Go

healthcheck-service

A self-hosted uptime monitor in Go. Checks one endpoint on a schedule and alerts to Slack and email. Written because the hosted options cost more than the thing they were watching.

Go

supabase-pings

A single Go binary that keeps free-tier Supabase projects from pausing. Scheduled pings, nothing else.

Go

simple-go-webserver

A notes server built on Go's standard net/http with SQLite and no framework. Written to understand what the frameworks are doing.

Security work

Payment and transaction flows

At Helppo Africa and VeendHQ I worked on the security controls around money movement, for platforms serving 10,000+ and 15,000+ users respectively. In MosesTab, giving runs through per-church Stripe Connect accounts so funds never pool in a platform balance.

Multi-tenant access control

Braandly scopes every collection to a workspace, enforces it in three layers, and returns 404 rather than 403 on a cross-tenant request so the API never confirms another tenant’s record exists. A live audit once found roles unenforced on write endpoints — found, fixed, and worth saying out loud.

Auth built to spec

Braandly’s public API is fronted by a hand-built OAuth 2.1 server: authorization-code only, PKCE mandatory, RS256 access tokens verified statelessly, and opaque refresh tokens hashed at rest and rotated on use, with reuse detection that revokes the whole token family.

Writing and teaching

I've published explainers on least-privilege access and blast radius, and on supply-chain attacks against npm.

Certification roadmap

  1. AWS Solutions Architect Associate (SAA-C03) In progress
  2. CompTIA Security+ Planned
  3. AWS Security Specialty Planned

Get in touch

Building something on AWS, or looking for someone who'll own the deploy path as well as the code? Let's talk.

Get In Touch