rajubk.
Open to opportunities·India

Hi, I'm Raju 👋

Platform Engineer& Full-Stack Developer

I build applications, then build and operate the production-grade infrastructure that runs them.

See 4 Apps Running LiveView AchievementsExplore the Platform
Raju BK
Raju BK.
7
Hypervisor nodes
Proxmox cluster
30+
Services operated
Self-hosted, end to end
6s
Database failover
Measured, not assumed
100%
GitOps delivery
Git is the source of truth

About

A developer who owns the whole stack

I'm a full-stack developer who got a little too curious about what happens after `git push`. That curiosity turned into a self-hosted platform running real production patterns — a highly-available Kubernetes cluster, replicated Postgres with point-in-time recovery, GitOps delivery, centralised secrets, single sign-on, and end-to-end tracing. Not because a job asked for it, but because I wanted to genuinely understand the systems I ship code onto.

Everything below is running right now on hardware I own and operate — including this website, which is served from that cluster. Nothing here is a tutorial follow-along: every component was chosen, debugged, hardened, and failure-tested by hand.

Own the whole path

From the React component to the node it schedules onto.

Verify, don't assume

Kill the primary. Pull the node. Read the console, not the status code.

Git is the source of truth

If it isn't reconciled from a repo, it will drift — and it always does.

Signal over noise

An alert that cries wolf is worse than no alert at all.

Live in production

4 applications you can open right now

Not mockups, not screenshots, not a repo you would have to build yourself. Every app below is serving real traffic from the cluster I run — open one in a new tab and use it.

Liverajubk.store

print3d

3D-printed products storefront with real payments

A full ecommerce storefront for 3D-printed products — cart, guest and Google/Facebook checkout, live Razorpay payments, coupons, wishlists, back-in-stock alerts, and order tracking by link with no account required — paired with an internal admin for fulfilment, refunds, reviews, and analytics, and a CronJob that renders and publishes product videos to social platforms.

  • A real order verified end to end: payment, receipt email, review, a return, and a Razorpay refund
  • Guest checkout by design — track any order by link, or by order number plus email/phone
  • Payment confirmation lands from the browser callback or the webhook, whichever arrives first, exactly once
  • Next.js
  • PostgreSQL
  • Razorpay
  • Google/Facebook OAuth
  • WhatsApp Cloud API
Open print3dSource
Livelms.rajubk.com

lms

Udemy-style course platform

A course platform that syncs its catalog straight from a Jellyfin media library, with a fully custom video player (scrub previews, resume, notes, certificates) and Razorpay checkout priced per course. No separate backend — Route Handlers and Server Actions talk to Postgres and Jellyfin directly.

  • Custom video player: scrub previews, resume-where-you-left-off, notes, certificates
  • Catalog synced live from a self-hosted Jellyfin media library
  • Per-course Razorpay checkout on the same payment rails as the print3d store
  • Next.js
  • PostgreSQL
  • Authentik/OIDC
  • Razorpay
  • Jellyfin API
Open lmsSource
Livecineflix.rajubk.com

cineflix

₹1-per-title streaming front end for a home media library

A streaming site for a self-hosted Jellyfin library where every film and series costs ₹1, once. Jellyfin itself never touches the internet: the web app proxies HLS video to it, every byte request carries a signed, time-limited token issued only after the entitlement check, and the proxy strips Jellyfin's admin-scoped API key out of the playlists it serves. Browsing hits a Postgres mirror of the catalogue, synced every six hours, so the 2013-era media box only ever serves video.

  • Media server stays on the LAN — video is proxied with signed, expiring tokens
  • The ₹1 price is enforced by database CHECK constraints, not just application code
  • Catalogue browsing never touches the media server
  • Next.js
  • PostgreSQL
  • Razorpay
  • Auth.js
  • Jellyfin API
  • HLS
Open cineflixSource
Liverajubk.com

portfolio

This site

The site you're reading, and the first workload here ever exposed to the public internet. Runs in its own isolated namespace with a default-deny network policy, a non-root read-only container, and a vulnerability scan that blocks the pipeline on any high-severity finding.

  • Hardened well past defaults: default-deny networking, read-only non-root container
  • CI refuses to ship the image on any high or critical vulnerability
  • Served from the same cluster as everything else on this page
  • Next.js 16
  • Kubernetes
  • Traefik
  • Cloudflare
  • Trivy
Open portfolioSource

Achievements

Outcomes I can point at, not just tools I've touched

Every item below was designed, debugged and failure-tested by hand on infrastructure I run. The numbers are measured, not estimated — and nothing here is ranked above anything else, because all of it is load-bearing.

4apps live on the public internet

Shipped applications the public can actually use

Four separate applications are serving real traffic from this cluster right now — a 3D-printed products storefront with live Razorpay checkout and order tracking, a course platform with its own Razorpay checkout synced to a media library, a ₹1-per-title streaming service that never exposes its media server, and this site. Each one has its own namespace, its own database, its own delivery pipeline, and its own CI-driven image build. Click any of them and you are hitting hardware I own.

  • Next.js
  • Kubernetes
  • Cloudflare
  • End-to-end delivery
#1004real order, verified end to end

Real money moving through a self-hosted checkout

Integrated Razorpay end to end and made settlement idempotent: confirmation can land from the browser's post-payment callback or from Razorpay's own webhook, whichever arrives first, but the database update only fires while the order is still in a pending state, and stock rows are locked (SELECT ... FOR UPDATE) before the quantity is decremented. Proved it on a real order, not a synthetic test — payment captured, receipt emailed through the production SMTP relay, a review submitted and moderated, a return requested and approved, and an admin-initiated refund that Razorpay's own dashboard confirmed as processed.

  • Razorpay
  • Webhook signatures
  • Idempotency
  • Row-level locking
6sfailover

Highly-available PostgreSQL with point-in-time recovery

Ran a 3-instance CloudNativePG cluster on Kubernetes with streaming replication and anti-affinity forcing each instance onto a separate node. Proved it by deleting the live primary: a replica was promoted in six seconds with no data loss, writes resumed, and the killed instance rejoined as a replica. Continuous WAL archiving to object storage gives real PITR, not just nightly dumps.

  • CloudNativePG
  • PostgreSQL 17
  • PITR
  • MinIO
0downtime

Zero-downtime rolling capacity upgrade across the cluster

Doubled CPU and memory on three Kubernetes nodes without dropping a request. Executed as a strict one-node-at-a-time procedure — cordon and drain, verify backup freshness, graceful shutdown, resize, rejoin, then confirm etcd quorum and that real workloads actually came back healthy before touching the next node.

  • Kubernetes
  • Proxmox
  • etcd
  • Zero-downtime ops
0CVEs shipped

Hardened the first internet-facing workload on the cluster

Took a public deployment well past defaults: dedicated namespace, default-deny network policy with explicit allows, non-root user, read-only root filesystem, dropped capabilities and seccomp profile, rate limiting at the ingress, and a strict content security policy. A blocking vulnerability scanner gate in CI refuses to ship on any high or critical finding — cleared by stripping unused tooling out of the runtime image, which also cut it to 105MB.

  • NetworkPolicy
  • Trivy
  • CSP + HSTS
  • Cloudflare
2node failures tolerated

Erasure-coded distributed object storage

Stood up a 4-node MinIO tenant with erasure coding spread across separate physical hosts, sized to survive two simultaneous node losses. Verified by killing a live node mid-read: objects stayed available from the surviving set and the failed node rejoined cleanly. Diagnosing a stale operator release along the way meant tracing TLS webhook failures down to the certificate-issuance mechanism.

  • MinIO
  • Erasure coding
  • Kubernetes Operators
  • HA
3node Raft quorum

Centralised secrets management wired into every app

Deployed HashiCorp Vault in a 3-node Raft configuration with anti-affinity and internal TLS from a purpose-built certificate authority chain, then connected it to workloads through the External Secrets Operator so application configuration is synced from Vault rather than pasted into manifests.

  • Vault
  • Raft HA
  • External Secrets
  • cert-manager
10+apps behind SSO

Single sign-on across the entire estate

Chose and deployed an identity provider that serves both native OIDC and forward-auth, so applications with no built-in authentication support sit behind the same login as those that do. Debugged the whole authorization-code flow end to end — grant types, scope mappings, and redirect URI mismatches — rather than accepting the defaults.

  • Authentik
  • OIDC
  • Forward-auth
  • SAML
1mometric retention

Full-stack observability, from hypervisor to request trace

Built a unified observability platform covering metrics, logs, and distributed traces: every hypervisor and cluster node scraped, application traces collected through OpenTelemetry, dashboards and alert routing on top. Wrote a custom exporter to catch silently-failing backups, because the backup server reports no snapshot-age metric of its own.

  • OpenTelemetry
  • Grafana
  • VictoriaMetrics
  • Tempo + Loki
9hfalse alarm, root-caused

Engineered alert quality, not just alert coverage

Tracked a critical alert that had been firing for nine hours down to a cumulative counter that never resets — one historical blip had primed it permanently. Fixing it meant recognising the pattern class, then auditing every other rule for the same naive expression. Alerts that cry wolf are worse than no alerts at all.

  • Alerting
  • PromQL
  • SRE practice
  • Root-cause analysis
27apps on GitOps

Continuous delivery with drift detection and self-healing

Migrated deployments from imperative pipeline commands to GitOps: CI now only builds images and bumps tags, while the cluster continuously reconciles itself against Git and reverts manual drift automatically. Backed by self-hosted CI runners so the cluster API is never exposed to the internet.

  • ArgoCD
  • GitHub Actions
  • Self-hosted runners
  • Drift detection

Skills

The full stack, top to bottom

81 technologies across 8 domains — from React components down to the network policies and storage layers underneath them.

Cloud & Containers

  • Kubernetes
  • k3s
  • Docker
  • AWS EKS
  • AWS ECS
  • AWS S3
  • AWS IAM
  • AWS Lambda
  • API Gateway
  • DynamoDB
  • Vercel
  • Helm
  • Kustomize
  • Proxmox VE

Platform & SRE

  • ArgoCD / GitOps
  • HashiCorp Vault
  • External Secrets
  • cert-manager
  • Traefik
  • NGINX
  • NetworkPolicy
  • Trivy
  • Disaster recovery
  • Capacity planning

Observability

  • OpenTelemetry
  • Grafana
  • VictoriaMetrics
  • Prometheus / PromQL
  • Tempo
  • Loki
  • Alertmanager
  • Distributed tracing
  • SLO thinking

Frontend

  • Next.js (App Router)
  • React 19
  • TypeScript
  • Tailwind CSS
  • shadcn/ui
  • Server Components
  • Three.js / React Three Fiber
  • Web performance
  • Accessibility
  • Responsive design

Backend & Data

  • Node.js
  • Express
  • PostgreSQL
  • CloudNativePG
  • REST API design
  • Database migrations
  • Redis
  • MinIO / S3
  • Schema design
  • Azure Data Factory
  • Azure Databricks
  • ADLS Gen2 / medallion
  • Model Context Protocol

Security & Identity

  • Authentik
  • OIDC / OAuth2
  • Auth.js
  • SAML
  • TLS automation
  • Content Security Policy
  • Container hardening
  • Secrets management
  • Least privilege

CI/CD & Automation

  • GitHub Actions
  • GitLab CI
  • Self-hosted runners
  • Playwright
  • SonarQube
  • Bash
  • Infrastructure as Code
  • Automated testing

Networking

  • pfSense
  • Reverse proxies
  • Cloudflare
  • DNS / Pi-hole
  • Let's Encrypt (DNS-01)
  • VLANs
  • Load balancing
  • kube-vip
KubernetesDockerAWS ECSAWS IAMAPI GatewayVercelKustomizeArgoCD / GitOpsExternal SecretsTraefikNetworkPolicyDisaster recoveryOpenTelemetryVictoriaMetricsTempoAlertmanagerSLO thinkingReact 19Tailwind CSSServer ComponentsWeb performanceResponsive designExpressCloudNativePGDatabase migrationsMinIO / S3Azure Data FactoryADLS Gen2 / medallionAuthentikAuth.jsTLS automationContainer hardeningLeast privilegeGitLab CIPlaywrightBashAutomated testingReverse proxiesDNS / Pi-holeVLANskube-vip
k3sAWS EKSAWS S3AWS LambdaDynamoDBHelmProxmox VEHashiCorp Vaultcert-managerNGINXTrivyCapacity planningGrafanaPrometheus / PromQLLokiDistributed tracingNext.js (App Router)TypeScriptshadcn/uiThree.js / React Three FiberAccessibilityNode.jsPostgreSQLREST API designRedisSchema designAzure DatabricksModel Context ProtocolOIDC / OAuth2SAMLContent Security PolicySecrets managementGitHub ActionsSelf-hosted runnersSonarQubeInfrastructure as CodepfSenseCloudflareLet's Encrypt (DNS-01)Load balancing

Live Infrastructure

This site is served from a platform I built and operate

Not a toy setup. A self-hosted Kubernetes platform running the same patterns you would expect behind a real production service — and the page you are reading right now is one of its workloads.

Compute

Highly-available Kubernetes

A k3s cluster with a replicated control plane, virtual-IP failover, ingress routing, and scheduling constraints that keep workloads spread across every node.

Data

Replicated PostgreSQL

Three Postgres instances across three physical hosts with streaming replication and continuous archiving. Failover measured at six seconds.

Security

Vault + External Secrets

Raft-backed secrets store with internal TLS, syncing application configuration into the cluster automatically.

Delivery

GitOps delivery

The cluster reconciles itself against Git continuously and reverts manual drift. Pipelines only publish images and bump tags.

Identity

Single sign-on

One identity provider fronting every internal service, via native OIDC where supported and forward-auth where it isn't.

Storage

Erasure-coded object storage

Four-node distributed storage for application media, tolerant of two simultaneous node failures — verified by killing one live.

Observability

Metrics, logs & traces

Every host and container scraped, application requests traced end to end, alerts routed to chat with a daily heartbeat proving the chain still works.

Resilience

Automated backups & DR

Scheduled hypervisor-level backups with an offsite cold-sync target, plus a custom exporter that catches backups failing silently.

Projects

Things I've built and shipped

Each of these runs on the platform above — built, containerised, delivered through a pipeline, and monitored in production. The ones marked live are open to the public internet right now.

print3d

Live

3D-printed products storefront with real payments

A full ecommerce storefront for 3D-printed products — cart, guest and Google/Facebook checkout, live Razorpay payments, coupons, wishlists, back-in-stock alerts, and order tracking by link with no account required — paired with an internal admin for fulfilment, refunds, reviews, and analytics, and a CronJob that renders and publishes product videos to social platforms.

Real payments · guest checkout · order tracking

  • Next.js
  • PostgreSQL
  • Razorpay
  • Google/Facebook OAuth
  • WhatsApp Cloud API
Visit the live site

lms

Live

Udemy-style course platform

A course platform that syncs its catalog straight from a Jellyfin media library, with a fully custom video player (scrub previews, resume, notes, certificates) and Razorpay checkout priced per course. No separate backend — Route Handlers and Server Actions talk to Postgres and Jellyfin directly.

Custom video player · Jellyfin-synced catalog

  • Next.js
  • PostgreSQL
  • Authentik/OIDC
  • Razorpay
  • Jellyfin API
Visit the live site

cineflix

Live

₹1-per-title streaming front end for a home media library

A streaming site for a self-hosted Jellyfin library where every film and series costs ₹1, once. Jellyfin itself never touches the internet: the web app proxies HLS video to it, every byte request carries a signed, time-limited token issued only after the entitlement check, and the proxy strips Jellyfin's admin-scoped API key out of the playlists it serves. Browsing hits a Postgres mirror of the catalogue, synced every six hours, so the 2013-era media box only ever serves video.

Signed video proxy · price enforced in the schema

  • Next.js
  • PostgreSQL
  • Razorpay
  • Auth.js
  • Jellyfin API
  • HLS
Visit the live site

portfolio

Live

This site

The site you're reading, and the first workload here ever exposed to the public internet. Runs in its own isolated namespace with a default-deny network policy, a non-root read-only container, and a vulnerability scan that blocks the pipeline on any high-severity finding.

Hardened · publicly exposed · zero known CVEs

  • Next.js 16
  • Kubernetes
  • Traefik
  • Cloudflare
  • Trivy
Visit the live site

torquebay

Car-parts store with VIN fitment and a 3D exploded view

An auto-parts storefront for Indian-market cars: decode a VIN (manufacturer code, model descriptor, model year) or pick make, model and version, then choose parts straight off an interactive 3D exploded view of the car — around 160k triangles of PBR-textured assemblies, each mapped to its catalogue categories. A help assistant answers symptom questions instantly from curated intents; an earlier CPU-hosted LLM was pulled after it starved a cluster node, a trade-off made deliberately in favour of cluster stability.

VIN decoding · pick parts from a 3D model

  • Next.js 16
  • React Three Fiber
  • PostgreSQL
  • ArgoCD
  • GitHub Actions

parts-store

Multi-tenant dealer parts storefront

A heavy-equipment parts platform where each dealer gets its own storefront, currency, pricing and stock from one deployment. Serial-number fitment search, a two-level category tree with facets, rich product pages with metric/imperial specs, promo codes, saved lists, CSV quick-order, shareable carts, a full customer account area, and a platform admin that provisions dealers. Responsive layouts verified across 40+ routes from 320px to 1920px.

One deployment, many dealer storefronts

  • Next.js 16
  • PostgreSQL
  • Multi-tenancy
  • GHCR
  • ArgoCD

pixgram

Instagram-style photo sharing app

A photo-sharing app with feed, stories, profiles, likes, comments and uploads. Images are processed server-side into WebP plus thumbnails and stored in Postgres, keeping the pods fully stateless; sessions are hashed server-side tokens. Layout switches between a phone tab bar, a tablet rail and a desktop sidebar, checked across 16 routes at eight viewport widths.

Stateless pods · responsive from 320px to 1920px

  • Next.js 16
  • PostgreSQL
  • sharp
  • Kubernetes
  • ArgoCD

meesho-tagger

AI product tagging and video rendering for short-form reels

Upload a product video and Claude locates every product in each scene; the app then matches them to real listings, and renders a finished reel with animated price tags, motion effects and price-reveal animations, all drawn frame-by-frame and composited by ffmpeg in the cluster. Marketplace lookups run in the user's own browser through bookmarklets rather than scraping, and model usage is capped per day.

Vision model + ffmpeg pipeline, phone-first editor

  • Next.js
  • Claude API
  • ffmpeg
  • node-canvas
  • Kubernetes

vercel-hello

Vercel front end calling AWS without stored secrets

A Next.js app on Vercel with a custom domain (www.rajubk.space) that calls into AWS: a public Lambda behind API Gateway, and a private-VPC Lambda with no internet gateway or NAT, reaching DynamoDB through a gateway endpoint and fronted by an IAM-authorised API. Built as a worked example of connecting a managed edge platform to private cloud resources.

Edge platform → private AWS VPC

  • Next.js
  • Vercel
  • AWS Lambda
  • API Gateway
  • DynamoDB
  • VPC

affiliate-dashboard

Internal control plane for a content pipeline

An internal-only admin that runs a separate content pipeline end to end: a Postgres-backed product catalogue, click and impression analytics, and a publishing control surface that triggers and monitors Kubernetes CronJobs in another repo through a scoped ServiceAccount — including per-item "publish now" and video re-encode jobs, both confirmed live against real social posts.

Drives cross-repo Kubernetes Jobs from a web UI

  • Next.js
  • PostgreSQL
  • Kubernetes API

homelab-mcp

MCP server exposing this homelab to an LLM

A Model Context Protocol server that gives an LLM read-only visibility into the cluster this site runs on — cluster and pod health, ArgoCD sync status, secret and certificate health, and log tailing — over stateless Streamable HTTP with bearer-token auth, plus MCP resources and prompts for guided investigation.

Read-only, LLM-facing view into live cluster state

  • TypeScript
  • Model Context Protocol
  • Kubernetes API
  • ArgoCD

homelab-docs

Documentation site for this homelab

The reference documentation for the entire homelab this portfolio runs on — architecture, DNS and front-door routing, security, and every application's setup notes, written in MDX and organized with Fumadocs.

Living reference for the whole cluster

  • Next.js
  • Fumadocs
  • MDX

Experience

What I've been doing

Self-directed engineering work, run with the same rigour a production system would demand.

  1. OngoingIndependent

    Platform & SRE — Self-hosted production platform

    Design and operate a multi-node hypervisor and Kubernetes platform as a live testbed for production infrastructure patterns: highly-available databases, GitOps delivery, centralised secrets, single sign-on, and full-stack observability. Everything is failure-tested rather than assumed working.

    • Replicated Postgres with point-in-time recovery, failover verified at six seconds
    • Zero-downtime rolling capacity upgrades across the cluster
    • Metrics, logs and traces unified behind a single dashboard and alerting layer
  2. OngoingIndependent

    Full-Stack Application Development

    Build and ship Next.js applications end to end — from React interface through API and schema design, down to the Kubernetes manifests and delivery pipelines that put them in front of users.

    • Service-split architectures with internal-only API boundaries
    • Authentication via OIDC single sign-on, tracing wired through every request
    • Per-commit database migrations gated ahead of rollout
  3. OngoingIndependent

    Cloud Infrastructure — AWS & Azure

    Hands-on with managed Kubernetes, serverless and data services across AWS and Azure — mapping the self-hosted patterns onto managed cloud equivalents.

    • EKS and ECS deployments with least-privilege IAM
    • Private-VPC Lambda + DynamoDB behind an IAM-authorised API, called from Vercel
    • Azure batch data pipeline: Data Factory ingesting CSV, Excel, SQL and REST sources into ADLS, Databricks serverless jobs building bronze/silver/gold with SCD and audit

Contact

Let's build something that stays up

Open to platform, SRE and full-stack roles, interesting collaborations, or just a good conversation about homelabs.

Email MeGitHub
[email protected]India