A personal corner of the internet

Hi, I’m Alau.
I build things
that keep running.

DevOps engineer. Software developer. Homelab tinkerer.

From .NET applications to the infrastructure behind them, I enjoy turning moving parts into reliable systems.

Explore my work Inside the homelab
Built by me. Hosted at home.
MY TOOLBOX.NET / C#AzureDockerGitHub ActionsTerraformCloudflareArgoCDLinux

GitHub

Source control & Actions CI/CD for every push

Terraform

Infrastructure as code for Azure and the homelab

ArgoCD

GitOps delivery for Kubernetes workloads

Cloudflare

Tunnels and DNS in front of everything I host

Docker

Packaging for the site, the sandbox and the lab

Azure

AKS, PostgreSQL and identity for the sandbox

01 / Sandbox

A place to run things.

Infrastructure, experiments
and useful side projects.

Infrastructure / Azure / v3

Azure platform sandbox

Keep the data. Rebuild the cluster. Pay for usage, not an always-on platform.

A Terraform platform for running small Kubernetes workloads on Azure with a clear separation between persistent services and disposable compute. The sandbox is available at alau.work.

  • Terraform
  • AKS
  • PostgreSQL
  • GitHub Actions
  • OIDC
  • Workload identity
  • ArgoCD
  • Cloudflare Tunnel
Explore the infrastructure source
Monthly estimate
$85–95 USD, before tax
AKS runtime target
60 hours per month
Remote states
Data + compute bootstrap stays separate
01 / Architecture

Three layers. Different lifetimes.

  1. Bootstrap / local stateFoundation
    • Protected state account
    • GitHub OIDC identity
    • Resource groups + budget
    Stays outside platform deletion
  2. Data / remote statePersistent services
    • Private network + DNS
    • PostgreSQL + blob storage
    • Key Vault + app identities
    Survives compute deletion
  3. Compute / remote stateDisposable AKS
    • 2 × D4as_v5 workers
    • Free control plane
    • Federated service accounts
    Recreated for scheduled sessions
Provisioning order: foundation → data → compute. Terraform manages Azure; application charts and ingress are separate.

Private by default

PostgreSQL is private inside the VNet. Applications use workload identity and DefaultAzureCredential, not storage keys.

Scoped access

GitHub Actions uses OIDC for the protected main branch. Entra RBAC handles operator and application access.

02 / Lifecycle

Build it. Use it. Turn it off.

  1. 01 / Push to mainValidate + apply

    Apply data, then compute.

  2. 02 / Start sessionStart + deploy

    Connect with Entra and run workloads.

  3. 03 / Stop sessionKeep the data

    Stop worker compute and retain services.

  4. 04 / Optional cleanupDelete compute

    Remove AKS and keep the data layer.

A later push recreates compute. Full data deletion is a separate confirmed action.

Automation with guardrails

Creation, deletion and session workflows share one concurrency group. A daily stop runs at 20:17 UTC with a retry at 21:17 UTC.

Cost-aware by design

Stopped AKS still retains disks and networking. Compute deletion removes the cluster while PostgreSQL, blobs and secrets remain available.

03 / At a glance

The important numbers.

Estimated monthly cost

$85–95 before tax, based on East US retail estimates and up to 60 AKS running hours. An always-on cluster would be roughly $310/month before variable usage.

What it provides

AKS, private PostgreSQL, blob containers, Key Vault, managed identities, workload federation and GitHub Actions automation.

The estimate is a planning range, not a spending cap. Azure budget alerts notify but do not stop resources.

04 / Full flow

From push to production.

flowchart LR
    GH["GitHub Actions\n(OIDC login)"] --> TF["Terraform"]
    TF --> Compute["AKS cluster"]

    Dev["Developer push"] --> Argo["ArgoCD"]
    Argo --> Compute

    User["User"] --> CF["Cloudflare Tunnel"]
    CF --> Compute
Terraform provisions the cluster; ArgoCD deploys apps onto it; Cloudflare is the only public entry point.

Other projects

WEB / PLATFORM01

This little corner of the web

A lightweight personal website built with HTML, CSS, and JavaScript. Served by Nginx and deployed to my home server through GitHub Actions.

  • HTML / CSS / JS
  • Docker
  • CI/CD
Explore the source
MUSIC / PERSONAL02

A change of pace

A collection of music I keep coming back to. Pick something from the collection, or let a random selection take the lead.

  • Curated collection
  • Random discovery
Find your next track

02 / Behind the scenes

Less cloud.
More living room.

This site lives on my own Ubuntu server. The homelab is where I experiment, automate, and get hands-on with the systems that make software work.

Every update follows the same path: build an image, publish it, and deploy it at home.

See the deployment workflow
THE PATH TO PRODUCTION
  1. 01

    Push & build

    GitHub Actions packages the static site.

    CI
  2. 02

    Package & publish

    Docker image stored in GitHub Container Registry.

    GHCR
  3. 03

    Bring it home

    Docker Compose runs Nginx on Ubuntu.

    HOST
  4. 04

    Hello, internet

    Cloudflare Tunnel connects you to this site.

    EDGE
You’re visiting part of the experiment.

03 / A bit about me

Curious by default.
An engineer by practice.

I’m Alau Bolatov, a DevOps engineer and software developer working with .NET, Azure, and infrastructure automation. I like understanding how things fit together, from the code to the container to the machine it runs on.

When the terminal closes, the music starts

Off the clock / On repeat

A soundtrack for the side projects.

Some familiar favorites. A few new directions. Pick a video or see where shuffle takes you.

Your collection / To go

A link. A music file.

Paste a YouTube video link to save its audio as an MP3 on the home server. Download it to listen in your favorite music player.

Use the key configured on your server. It is not stored by this website.

One video at a time, up to one hour and 150 MB. Use videos you own or have permission to download.

Saved audio

Enter your access key to load files saved on your server.