galaxy.rip · gadgetman.cloud
Two physical sites, each with its own private ASN, peered over BGP across a residential connection. Recycled enterprise hardware, open-source software, real monitoring, real automation, and a public read-only view of the whole thing. It's how I stay current on the infrastructure work that job descriptions ask for and most network roles never touch.
Two locations, one AS path
Primary site. Edge firewall, the compute cluster, and the monitoring stack.
Second site. Independent edge, independent addressing, same routing domain.
The stack
OPNsense on both edges with FRR handling BGP between sites, WireGuard tunnels carrying inter-site traffic, Unbound for DNS, Suricata and CrowdSec on the perimeter, and Cloudflare zero-trust access in front of anything that needs to be reachable from outside.
A five-node cluster — amp1, amp2, amp3, holodeck and dilithium — running Proxmox with Docker and Kubernetes workloads on top, plus Traefik ingress, an OpenMediaVault NAS, and the game servers that started the whole thing.
Prometheus scraping every node and network device, Grafana for the dashboards, Alertmanager routing to Discord and ntfy, Blackbox Exporter probing the things that face outward, VictoriaLogs for logs and smokeping watching the remote link.
Ansible manages configuration on infrastructure that already exists — the realistic case, rather than green-field provisioning. n8n handles the workflows: scheduled fleet updates over SSH, alert enrichment, and the assistant that answers questions about the lab in Discord.
Anyone can claim BGP on a résumé. Very few people will let you look. The lab page renders real device state from the running network every 60 seconds — if something falls over, you'll see it there before I've fixed it, and that's the point.
It is deliberately read-only: a server-side render with no control interface and no management API exposed to the internet.
Running your own infrastructure teaches the things enterprise roles insulate you from — what breaks at 2am, what a bad alert threshold costs you, how much of reliability is documentation, and why the boring automation matters more than the clever automation.
It's also where the SRE-shaped parts of my skill set actually come from: SLOs I set for myself, alerts I have to live with, and a pager that's my own phone.
lab.chancegearhart.com
Based in Spokane, WA. Open to remote, and to on-site roles in Spokane, Walla Walla and the Tri-Cities. Travel under 15%.