alau.dev
alau.work

alau.dev / v2 — served from a living room

I build systems that
stay up.

DevOps engineer and software developer. I work across .NET, Azure, Terraform and Kubernetes, and I run a small Ubuntu box at home that is serving you this page right now.

See the sandbox
Focus
Platform & delivery
Infra style
Ephemeral by default
This page
0 frameworks, 0 trackers
alau@homelab: ~ type help
Building Azure platform sandbox

Terraform creates AKS and PostgreSQL for a session, Argo CD deploys, and a schedule tears it all down.

 Running This site, at home

Nginx in Docker on Ubuntu, published through a Cloudflare Tunnel. Every push ships a new image.

 Listening 55 tracks on rotation

A soundtrack for side projects. Put one on and let shuffle take the lead.

The toolbox

From commit to cluster.

  1. Write
    • .NET / C#
    • Python
    • JavaScript
  2. Ship
    • GitHub Actions
    • Docker
    • GHCR / ACR
  3. Provision
    • Terraform
    • Azure
    • OIDC identities
  4. Run
    • AKS
    • Argo CD
    • Helm
  5. Edge
    • Cloudflare
    • Traefik
    • cert-manager

01 / Sandbox

A place to
run things.

Infrastructure, experiments and useful side projects. The main one builds the expensive parts of a cloud platform for a session, then destroys them when the work is done.

Infrastructure / Azure / v4

Azure platform sandbox

A small Azure learning environment for Kubernetes experiments. Terraform creates the ephemeral platform; GitHub Actions starts the session and hands deployment to Argo CD.

  • Terraform
  • AKS
  • Argo CD
  • Traefik
  • cert-manager
  • Cloudflare DNS
  • PostgreSQL
  • ACR
Read the infrastructure source
Planning estimate
$20–35
USD / month, before tax
Session target
~10%
of the month active
Cluster shape
1 node
D2s v3, 100 pods
Terraform state
1 / folder
in Azure Blob Storage
01 / Architecture

One folder. One resource group.

State · created once Bootstrap
  • State resource group
  • Blob Storage backend
  • Separate state per module
Always available · low idle cost Foundation
  • Network + subnets
  • Storage + Key Vault
  • Dashboard + ACR
Session · on demand Compute + database
  • One AKS D2s v3 node
  • 100-pod capacity
  • Private PostgreSQL

Idle: only state and foundation exist. AKS creates its own node resource group when a session starts.

02 / Lifecycle

Start a session. Clear the cost.

Deploy a module

Each Terraform folder has its own GitHub Actions workflow and its own state blob. The backend lock protects concurrent changes, and the shared Azure name and region come from repository variables.

git push → workflow: foundation.yml → terraform apply
03 / Full flow

From change to session.

  1. Developer push
  2. GitHub ActionsOIDC, no stored secrets
  3. Terraformstate in Azure Blob
  4. Database + AKSsession resources
  5. Argo CD + HelmGitOps
  6. Traefik + TLS
  7. Cloudflare DNS
08:00 UTC scheduled destroy returns the platform to idle

Each change goes through a focused workflow; cleanup removes the costly session resources.

Honest numbers. $20–35 is a planning estimate assuming AKS and PostgreSQL are active around 10% of the month. It is not a bill or a spending cap; Azure budget alerts notify but do not stop resources.

Also in the sandbox

Smaller things.

Web / platform

This little corner of the web

Plain HTML, CSS and JavaScript modules with a strict content security policy. Nginx serves it from Docker on my home server, deployed by GitHub Actions.

Source

Python / self-hosted

Private audio saver

A single-worker Python API that turns one video link into an MP3 on the home server, with an access key, strict URL validation and storage limits.

Try it

Music / personal

A change of pace

A collection of music I keep coming back to. Pick something, or let a random selection take the lead.

Listen

02 / Behind the scenes

Less cloud.
More living room.

This site lives on my own Ubuntu server. The homelab is where I experiment, automate and get hands-on with the systems that make software work.

Live

Trace your request.

  1. Youyour browser
  2. Cloudflare edgenearest data centre
  3. Tunnelcloudflared, outbound only
  4. Nginx :8080Docker on Ubuntu
  5. index.htmlthis page
Round trip
—
Edge location
—
First byte (page load)
—
Page weight
—

Measured in your browser. Nothing is sent anywhere else.

Pipeline

The path to production.

  1. 01

    Push & build

    GitHub Actions builds the static site and the converter.

    CI
  2. 02

    Package & publish

    Images are stored in GitHub Container Registry.

    GHCR
  3. 03

    Bring it home

    Docker Compose pulls and restarts services on Ubuntu.

    HOST
  4. 04

    Hello, internet

    A Cloudflare Tunnel connects you, with no open ports.

    EDGE
See the deployment workflow
docker compose ps

What is running.

  • alau

    nginx:stable-alpine · static site · port 8080 on the LAN

  • converter

    python 3.13 + yt-dlp + ffmpeg · 768 MB · 1 CPU · no host port

  • cloudflared

    tunnel to the edge · outbound connection only

The converter runs as a non-root user with no-new-privileges and is only reachable through Nginx.

03 / A bit about me

Curious by default.
An engineer by practice.

I’m Alau Bolatov, a DevOps engineer and software developer working with .NET, Azure and infrastructure automation.

I like understanding how things fit together, from the code to the container to the machine it runs on. Most of my side projects start with a question like “what would it take to run this myself?” and end with a workflow file and a README.

When the terminal closes, the music starts
  1. 01

    Destroy is a feature

    If an environment is cheap to delete, it is cheap to experiment with.

  2. 02

    Pipelines over checklists

    A deployment that needs a person remembering steps will eventually miss one.

  3. 03

    Small, boring pieces

    Nginx, a container, a tunnel. Fewer moving parts, fewer surprises.

  4. 04

    Honest numbers

    An estimate is labelled as an estimate. A budget alert is not a cap.

04 / Off the clock

A soundtrack for
the side projects.

Familiar favourites and a few new directions. Pick a track or see where shuffle takes you.

Track — / 55

The player loads only when you press play. It uses YouTube’s privacy-enhanced mode.

05 / Your collection, to go

A link in.
An MP3 out.

Paste a YouTube video link to save its audio as an MP3 on the home server, then download it to your favourite music player.

The key configured on the server. Kept in this tab only, never stored.

One video at a time, up to one hour and 150 MB. Only use videos you own or have permission to download.

/data

Saved audio

Enter your access key to load files saved on the server.

    Esc