alau.dev
alau.work Contact

alau.dev — online · served from a living room

Alau Bolatov

Software EngineeringDevOpsAI

A DevOps engineer with five years of software engineering experience. I build cloud platforms and the pipelines that ship to them — Azure, Kubernetes, Terraform, Argo CD — and I’m now expanding into AI engineering and agent workflows.

View projects Contact

Chapter one · NightChapter two · Day

A study inspired by my Kazakhstan roots and the software engineering years.A Chicago studio for the DevOps chapter, with a corner for AI. Both rooms are imagined, not photographs.

Software engineering
5 yrs
DevOps
~3 yrs
Now exploring
AI · agents
Scroll to explore

01About

Curious by default. An engineer by practice.

I’m Alau Bolatov — a DevOps engineer with five years of software engineering experience and roughly three years of DevOps.

I like understanding how things fit together, from the code to the container to the machine it runs on. Most of my side projects start with a question like “what would it take to run this myself?” and end with a workflow file and a README.

My background spans .NET, Angular and Kafka on the application side, and Azure, Kubernetes, Terraform, GitHub Actions, Docker and Argo CD on the platform side. Next on the path: AI engineering and agent workflows.

When the terminal closes, the music starts
  1. 01

    Destroy is a feature

    If an environment is cheap to delete, it is cheap to experiment with.

  2. 02

    Pipelines over checklists

    A deployment that needs a person remembering steps will eventually miss one.

  3. 03

    Small, boring pieces

    Nginx, a container, a tunnel. Fewer moving parts, fewer surprises.

  4. 04

    Honest numbers

    An estimate is labelled as an estimate. A budget alert is not a cap.

02Skills

Three toolkits. One workflow.

The tools I reach for, grouped the way they work together: software that gets written, the platforms it runs on, and the AI that’s starting to help with both.

Toolkit 01

Software

Writing the thing.

  • .NET / C#
  • Angular
  • Kafka
  • JavaScript
  • Python
Toolkit 02

Cloud & DevOps

Shipping and running it.

  • Azure
  • Kubernetes · AKS
  • Terraform
  • GitHub Actions
  • Docker
  • Argo CD
  • Helm
  • Cloudflare
  • Traefik
  • Nginx
  • Linux
Toolkit 03 exploring now

AI

Where I’m heading.

  • AI engineering
  • Agent workflows
  • Coding agents with guardrails

My sandbox repositories carry instructions for coding agents: what they may change, and what needs a plan and a person first.

The toolbox

From commit to cluster.

  1. Write
    • .NET / C#
    • Python
    • JavaScript
  2. Ship
    • GitHub Actions
    • Docker
    • GHCR / ACR
  3. Provision
    • Terraform
    • Azure
    • OIDC identities
  4. Run
    • AKS
    • Argo CD
    • Helm
  5. Edge
    • Cloudflare
    • Traefik
    • cert-manager

03Projects

Built to run. Free to break.

Two platforms I operate myself, and two small tools that live on one of them.

Azure · Terraform · GitOps

Azure platform sandbox

A personal Azure environment laid out like a real non-production platform: hub-and-spoke networking, a private AKS cluster, a private PostgreSQL database and GitOps delivery with Argo CD.

Repositories
6
Cluster
1 node · private API
Auto-stop
after 3 h awake
  • Terraform
  • AKS
  • Argo CD
  • Helm
  • PostgreSQL
  • Key Vault

Homelab · Docker · Cloudflare

This site, at home

Nginx in Docker on Ubuntu, published through a Cloudflare Tunnel with no open ports. Every push builds a new image and ships it home.

Containers
3
Open ports
0

Music · Personal

A soundtrack for the side projects

55 tracks on rotation, played through YouTube’s privacy-enhanced mode. Pick one, or let shuffle take the lead.

Python · yt-dlp · FFmpeg

A link in. An MP3 out.

A private converter on the home server. It runs as a locked-down container behind Nginx and an access key.

04Experience

From code, to platforms, to agents.

One pipeline, three stages. Each one builds on the last.

  1. Foundation5 years of experience

    Software engineering

    Building applications with .NET and Angular, with Kafka in the mix — the code everything else exists to ship.

    • .NET / C#
    • Angular
    • Kafka
  2. Current role~3 years of experience

    DevOps

    Infrastructure as code, CI/CD and GitOps on Azure and Kubernetes: platforms that are cheap to destroy and easy to rebuild.

    • Azure
    • Kubernetes
    • Terraform
    • GitHub Actions
    • Docker
    • Argo CD
  3. In progressNow

    AI engineering

    Expanding into AI engineering and agent workflows, starting where I already work: delivery pipelines, infrastructure and the guardrails around them.

    • AI engineering
    • Agent workflows

05Contact

Open a channel.

The quickest way to find me is where the code lives.

01Sandbox

A platform I’m allowed to break.

A personal Azure environment laid out like a real non-production platform: hub-and-spoke networking, a private Kubernetes cluster, a private database and GitOps delivery. I have full access here, so this is where new features get built and strange problems get reproduced.

Region
centralus
hub and dev networks
Cluster
1 node
AKS D2s v3 · private API
Database
PostgreSQL 15
B1ms · private subnet only
Budget alert
$90
per month · alerts, not a cap
01 / Repositories

Six repositories, one platform.

Hover a repository to trace what it works with.

  • Terraform module

    Reusable Terraform modules for networks, AKS, PostgreSQL, Key Vault and more. Each module is released with its own tag, such as aks1.0.0.

    used by infra
  • Terraform infra

    The hub and dev environments, split into layers with one state file each. Pull requests plan; the main branch applies.

    pins module tags · runs jobs on runner
  • Helm helm

    Shared charts for services, namespace secrets and runners, packaged and pushed to the container registry as OCI artifacts.

    consumed by deploy
  • Argo CD deploy

    GitOps configuration: an app-of-apps for the cluster add-ons and an ApplicationSet that turns every service folder into an app.

    uses helm · deploys runner and sandbox-test-app
  • Docker runner

    A GitHub Actions runner image that lives inside the cluster, for jobs that need to reach private endpoints.

    deployed by deploy · serves infra
  • Node.js sandbox-test-app

    A small diagnostics service that checks config, secrets, the file share and the database connection end to end.

    deployed by deploy

All repositories are private.

02 / Architecture

A hub, a spoke and a tunnel.

  1. You
  2. Cloudflare edgeTLS and DNS
  3. Tunneloutbound only
  4. Traefikno public IP
  5. Servicesone namespace
Hub network · shared
  • Container registrycharts and images
  • Key Vaultworkload secrets
  • Private DNS zonefor PostgreSQL
  • Terraform stateone blob per layer
Dev network · spoke
AKS private API · 1 node
  • Argo CD
  • Traefik
  • cloudflared
  • external-dns
  • External Secrets
  • GitHub runners
  • services
  • PostgreSQL flexible serverdelegated subnet, public access off
  • Storage accountfile share for services
  • Managed identitiesfederated to the cluster

Running: one node hosts Argo CD, Traefik and the services. Requests arrive through an outbound tunnel, so nothing listens on a public IP.

03 / Delivery

From commit to cluster.

  1. 01

    Version a module

    A module change gets a new tag for that module only. An environment adopts it by changing one ref.

    source = "…//modules/aks?ref=aks1.0.0"
    module
  2. 02

    Apply the layers

    Hub: foundation → security → storage. Dev: foundation → storage → computational → security. The database step runs on the in-cluster runner because PostgreSQL has no public endpoint.

    push main → terraform apply, one job per layer
    infra
  3. 03

    Publish charts and images

    Charts go to the registry as OCI artifacts. The runner and test app images land in the same registry.

    helm push → oci://registry/helm
    helm
  4. 04

    Hand over to GitOps

    The cluster API is private, so the workflow installs Argo CD from inside the cluster and sets up the tunnel. From then on, a merge to main is a deployment, and external-dns gives every new Ingress host its DNS record.

    az aks command invoke → Argo CD → app-of-apps
    deploy
Cost

Keeping it cheap.

  • The cluster sleeps. Every three hours an Azure Automation runbook stops AKS if it has been up longer than three hours. Starting it again buys another session.
  • Small by default. One node on the free control-plane tier, a burstable database and a Basic registry.
  • No public ingress. The tunnel dials out, so Traefik needs no load balancer IP of its own.
  • Early warnings. Budget emails at 50%, 80% and 100%, plus a forecast alert.
Access

Keeping it closed.

  • Private cluster API. Admin commands run through Azure, not a public endpoint.
  • Private data. PostgreSQL is reachable only from inside the networks.
  • No stored keys in the cluster. External Secrets reads Key Vault with workload identity.
  • Runners inside. Jobs that touch private endpoints run on a self-hosted runner in the cluster.

Honest numbers. Budget alerts send email; they do not stop anything. The uptime limit is what keeps the bill small.

02Behind the scenes

Less cloud. More living room.

This site lives on my own Ubuntu server. The homelab is where I experiment, automate and get hands-on with the systems that make software work.

Live

Trace your request.

  1. Youyour browser
  2. Cloudflare edgenearest data centre
  3. Tunnelcloudflared, outbound only
  4. Nginx :8080Docker on Ubuntu
  5. index.htmlthis page
Round trip
—
Edge location
—
First byte (page load)
—
Page weight
—

Measured in your browser. Nothing is sent anywhere else.

Pipeline

The path to production.

  1. 01

    Push & build

    GitHub Actions builds the static site and the converter.

    CI
  2. 02

    Package & publish

    Images are stored in GitHub Container Registry.

    GHCR
  3. 03

    Bring it home

    Docker Compose pulls and restarts services on Ubuntu.

    HOST
  4. 04

    Hello, internet

    A Cloudflare Tunnel connects you, with no open ports.

    EDGE
docker compose ps

What is running.

  • alau

    nginx:stable-alpine · static site · port 8080 on the LAN

  • converter

    python 3.13 + yt-dlp + ffmpeg · 768 MB · 1 CPU · no host port

  • cloudflared

    tunnel to the edge · outbound connection only

The converter runs as a non-root user with no-new-privileges and is only reachable through Nginx.

04Off the clock

A soundtrack for the side projects.

Familiar favourites and a few new directions. Pick a track or see where shuffle takes you.

Track — / 55

The player loads only when you press play. It uses YouTube’s privacy-enhanced mode.

05Your collection, to go

A link in. An MP3 out.

Paste a YouTube video link to save its audio as an MP3 on the home server, then download it to your favourite music player.

The key configured on the server. Kept in this tab only, never stored.

One video at a time, up to one hour and 150 MB. Only use videos you own or have permission to download.

/data

Saved audio

Enter your access key to load files saved on the server.

    Esc
    alau@homelab: ~ — console