rajubk.
Open to opportunities·India

Hi, I'm Raju 👋

Platform Engineer& Full-Stack Developer

I build applications, then build and operate the production-grade infrastructure that runs them.

See 5 Apps Running LiveView AchievementsExplore the Platform
Raju BK
Raju BK.
7
Hypervisor nodes
Proxmox cluster
20+
Services operated
Self-hosted, end to end
6s
Database failover
Measured, not assumed
100%
GitOps delivery
Git is the source of truth

About

A developer who owns the whole stack

I'm a full-stack developer who got a little too curious about what happens after `git push`. That curiosity turned into a self-hosted platform running real production patterns — a highly-available Kubernetes cluster, replicated Postgres with point-in-time recovery, GitOps delivery, centralised secrets, single sign-on, and end-to-end tracing. Not because a job asked for it, but because I wanted to genuinely understand the systems I ship code onto.

Everything below is running right now on hardware I own and operate — including this website, which is served from that cluster. Nothing here is a tutorial follow-along: every component was chosen, debugged, hardened, and failure-tested by hand.

Own the whole path

From the React component to the node it schedules onto.

Verify, don't assume

Kill the primary. Pull the node. Read the console, not the status code.

Git is the source of truth

If it isn't reconciled from a repo, it will drift — and it always does.

Signal over noise

An alert that cries wolf is worse than no alert at all.

Live in production

5 applications you can open right now

Not mockups, not screenshots, not a repo you would have to build yourself. Every app below is serving real traffic from the cluster I run — open one in a new tab and use it.

Livebazaar.rajubk.comAndroid build in internal testing

bazaar

Amazon-style marketplace with real payments

A full-stack marketplace with a real Razorpay checkout, a separate admin dashboard, and its own native Android client built with Expo/React Native. The mobile app talks to a dedicated backend-for-frontend so it can reach a ClusterIP-only API without that API ever being exposed to the internet.

  • Real card payments — every item is priced ₹1 so you can run a live checkout end to end
  • Settlement is idempotent: three duplicate webhook deliveries move stock exactly once
  • Admin dashboard and the API itself are never reachable from the internet
  • Next.js
  • Express
  • PostgreSQL
  • Razorpay
  • Authentik/OIDC
  • React Native
  • Expo
Open bazaarSource
Livestore.rajubk.com

store

Service-split ecommerce platform

An ecommerce application deliberately split into a Next.js frontend and a separate Express API that is never exposed outside the cluster. Delivered through GitOps with per-commit database migration jobs, backed by the HA Postgres cluster and erasure-coded object storage for product media, with distributed tracing across both services.

  • Two-tier architecture with an internal-only API boundary
  • Product media served from four-node erasure-coded object storage
  • Every request traced end to end across both services
  • Next.js
  • Express
  • PostgreSQL
  • ArgoCD
  • OpenTelemetry
  • MinIO
Open storeSource
Livelms.rajubk.com

lms

Udemy-style course platform

A course platform that syncs its catalog straight from a Jellyfin media library, with a fully custom video player (scrub previews, resume, notes, certificates) and Razorpay checkout priced per course. No separate backend — Route Handlers and Server Actions talk to Postgres and Jellyfin directly.

  • Custom video player: scrub previews, resume-where-you-left-off, notes, certificates
  • Catalog synced live from a self-hosted Jellyfin media library
  • Per-course Razorpay checkout on the same payment rails as Bazaar
  • Next.js
  • PostgreSQL
  • Authentik/OIDC
  • Razorpay
  • Jellyfin API
Open lmsSource
Liveexpenses.rajubk.comOn Google Play — internal testing

expenses

Expense tracker for web and Android

An expense tracker shared between a Next.js web app and a native Android client, both signing in directly with Google or Facebook OAuth. The mobile app authenticates with PKCE and talks to the same API routes as the browser using a bearer JWT, so there is exactly one backend behind two very different clients.

  • Published to Google Play and running on real Android hardware
  • One API surface serving both the browser and the phone, PKCE on mobile
  • Sign in with your own Google or Facebook account
  • Next.js
  • PostgreSQL
  • Auth.js
  • React Native
  • Expo
Open expensesGet the Android appSource
Liverajubk.com

portfolio

This site

The site you're reading, and the first workload here ever exposed to the public internet. Runs in its own isolated namespace with a default-deny network policy, a non-root read-only container, and a vulnerability scan that blocks the pipeline on any high-severity finding.

  • Hardened well past defaults: default-deny networking, read-only non-root container
  • CI refuses to ship the image on any high or critical vulnerability
  • Served from the same cluster as everything else on this page
  • Next.js 16
  • Kubernetes
  • Traefik
  • Cloudflare
  • Trivy
Open portfolioSource

Achievements

Outcomes I can point at, not just tools I've touched

Every item below was designed, debugged and failure-tested by hand on infrastructure I run. The numbers are measured, not estimated — and nothing here is ranked above anything else, because all of it is load-bearing.

5apps live on the public internet

Shipped five applications the public can actually use

Five separate applications are serving real traffic from this cluster right now — a marketplace with live card payments, two ecommerce platforms, a course platform, an expense tracker with a native Android client, and this site. Each one has its own namespace, its own database, its own identity wiring and its own delivery pipeline. Click any of them and you are hitting hardware I own.

  • Next.js
  • Kubernetes
  • Cloudflare
  • End-to-end delivery
3×duplicate webhooks, one settlement

Real money moving through a self-hosted checkout

Integrated a live payment gateway end to end and made settlement genuinely idempotent, because a payment provider only guarantees at-least-once webhook delivery. Signature verification runs over the exact raw bytes received, every delivery id is deduplicated, and the order row is locked before it is marked paid. Proved it by accepting the same capture three times: stock decremented exactly once, the cart cleared once.

  • Razorpay
  • Webhook signatures
  • Idempotency
  • Row-level locking
0new ports opened

Native Android client against an internal-only API

Built and released an Expo/React Native Android app for an API that has no ingress at all. Instead of exposing it, the phone authenticates with OIDC + PKCE and talks to a backend-for-frontend that verifies the token against JWKS, derives identity from verified claims rather than a client-supplied header, and forwards only requests matching an explicit route allowlist. The app is on Google Play in internal testing.

  • React Native
  • Expo
  • OIDC + PKCE
  • BFF pattern
6sfailover

Highly-available PostgreSQL with point-in-time recovery

Ran a 3-instance CloudNativePG cluster on Kubernetes with streaming replication and anti-affinity forcing each instance onto a separate node. Proved it by deleting the live primary: a replica was promoted in six seconds with no data loss, writes resumed, and the killed instance rejoined as a replica. Continuous WAL archiving to object storage gives real PITR, not just nightly dumps.

  • CloudNativePG
  • PostgreSQL 17
  • PITR
  • MinIO
0downtime

Zero-downtime rolling capacity upgrade across the cluster

Doubled CPU and memory on three Kubernetes nodes without dropping a request. Executed as a strict one-node-at-a-time procedure — cordon and drain, verify backup freshness, graceful shutdown, resize, rejoin, then confirm etcd quorum and that real workloads actually came back healthy before touching the next node.

  • Kubernetes
  • Proxmox
  • etcd
  • Zero-downtime ops
0CVEs shipped

Hardened the first internet-facing workload on the cluster

Took a public deployment well past defaults: dedicated namespace, default-deny network policy with explicit allows, non-root user, read-only root filesystem, dropped capabilities and seccomp profile, rate limiting at the ingress, and a strict content security policy. A blocking vulnerability scanner gate in CI refuses to ship on any high or critical finding — cleared by stripping unused tooling out of the runtime image, which also cut it to 105MB.

  • NetworkPolicy
  • Trivy
  • CSP + HSTS
  • Cloudflare
2node failures tolerated

Erasure-coded distributed object storage

Stood up a 4-node MinIO tenant with erasure coding spread across separate physical hosts, sized to survive two simultaneous node losses. Verified by killing a live node mid-read: objects stayed available from the surviving set and the failed node rejoined cleanly. Diagnosing a stale operator release along the way meant tracing TLS webhook failures down to the certificate-issuance mechanism.

  • MinIO
  • Erasure coding
  • Kubernetes Operators
  • HA
3node Raft quorum

Centralised secrets management wired into every app

Deployed HashiCorp Vault in a 3-node Raft configuration with anti-affinity and internal TLS from a purpose-built certificate authority chain, then connected it to workloads through the External Secrets Operator so application configuration is synced from Vault rather than pasted into manifests.

  • Vault
  • Raft HA
  • External Secrets
  • cert-manager
10+apps behind SSO

Single sign-on across the entire estate

Chose and deployed an identity provider that serves both native OIDC and forward-auth, so applications with no built-in authentication support sit behind the same login as those that do. Debugged the whole authorization-code flow end to end — grant types, scope mappings, and redirect URI mismatches — rather than accepting the defaults.

  • Authentik
  • OIDC
  • Forward-auth
  • SAML
6mometric retention

Full-stack observability, from hypervisor to request trace

Built a unified observability platform covering metrics, logs, and distributed traces: every hypervisor and cluster node scraped, application traces collected through OpenTelemetry, dashboards and alert routing on top. Wrote a custom exporter to catch silently-failing backups, because the backup server reports no snapshot-age metric of its own.

  • OpenTelemetry
  • Grafana
  • VictoriaMetrics
  • Tempo + Loki
9hfalse alarm, root-caused

Engineered alert quality, not just alert coverage

Tracked a critical alert that had been firing for nine hours down to a cumulative counter that never resets — one historical blip had primed it permanently. Fixing it meant recognising the pattern class, then auditing every other rule for the same naive expression. Alerts that cry wolf are worse than no alerts at all.

  • Alerting
  • PromQL
  • SRE practice
  • Root-cause analysis
3apps on GitOps

Continuous delivery with drift detection and self-healing

Migrated deployments from imperative pipeline commands to GitOps: CI now only builds images and bumps tags, while the cluster continuously reconciles itself against Git and reverts manual drift automatically. Backed by self-hosted CI runners so the cluster API is never exposed to the internet.

  • ArgoCD
  • GitHub Actions
  • Self-hosted runners
  • Drift detection

Skills

The full stack, top to bottom

72 technologies across 8 domains — from React components down to the network policies and storage layers underneath them.

Cloud & Containers

  • Kubernetes
  • k3s
  • Docker
  • AWS EKS
  • AWS ECS
  • AWS S3
  • AWS IAM
  • Helm
  • Kustomize
  • Proxmox VE

Platform & SRE

  • ArgoCD / GitOps
  • HashiCorp Vault
  • External Secrets
  • cert-manager
  • Traefik
  • NGINX
  • NetworkPolicy
  • Trivy
  • Disaster recovery
  • Capacity planning

Observability

  • OpenTelemetry
  • Grafana
  • VictoriaMetrics
  • Prometheus / PromQL
  • Tempo
  • Loki
  • Alertmanager
  • Distributed tracing
  • SLO thinking

Frontend

  • Next.js (App Router)
  • React 19
  • TypeScript
  • Tailwind CSS
  • shadcn/ui
  • Server Components
  • Web performance
  • Accessibility
  • Responsive design

Backend & Data

  • Node.js
  • Express
  • PostgreSQL
  • CloudNativePG
  • REST API design
  • Database migrations
  • Redis
  • MinIO / S3
  • Schema design

Security & Identity

  • Authentik
  • OIDC / OAuth2
  • Auth.js
  • SAML
  • TLS automation
  • Content Security Policy
  • Container hardening
  • Secrets management
  • Least privilege

CI/CD & Automation

  • GitHub Actions
  • GitLab CI
  • Self-hosted runners
  • Playwright
  • SonarQube
  • Bash
  • Infrastructure as Code
  • Automated testing

Networking

  • pfSense
  • Reverse proxies
  • Cloudflare
  • DNS / Pi-hole
  • Let's Encrypt (DNS-01)
  • VLANs
  • Load balancing
  • kube-vip
KubernetesDockerAWS ECSAWS IAMKustomizeArgoCD / GitOpsExternal SecretsTraefikNetworkPolicyDisaster recoveryOpenTelemetryVictoriaMetricsTempoAlertmanagerSLO thinkingReact 19Tailwind CSSServer ComponentsAccessibilityNode.jsPostgreSQLREST API designRedisSchema designOIDC / OAuth2SAMLContent Security PolicySecrets managementGitHub ActionsSelf-hosted runnersSonarQubeInfrastructure as CodepfSenseCloudflareLet's Encrypt (DNS-01)Load balancing
k3sAWS EKSAWS S3HelmProxmox VEHashiCorp Vaultcert-managerNGINXTrivyCapacity planningGrafanaPrometheus / PromQLLokiDistributed tracingNext.js (App Router)TypeScriptshadcn/uiWeb performanceResponsive designExpressCloudNativePGDatabase migrationsMinIO / S3AuthentikAuth.jsTLS automationContainer hardeningLeast privilegeGitLab CIPlaywrightBashAutomated testingReverse proxiesDNS / Pi-holeVLANskube-vip

Live Infrastructure

This site is served from a platform I built and operate

Not a toy setup. A self-hosted Kubernetes platform running the same patterns you would expect behind a real production service — and the page you are reading right now is one of its workloads.

Compute

Highly-available Kubernetes

A k3s cluster with a replicated control plane, virtual-IP failover, ingress routing, and scheduling constraints that keep workloads spread across every node.

Data

Replicated PostgreSQL

Three Postgres instances across three physical hosts with streaming replication and continuous archiving. Failover measured at six seconds.

Security

Vault + External Secrets

Raft-backed secrets store with internal TLS, syncing application configuration into the cluster automatically.

Delivery

GitOps delivery

The cluster reconciles itself against Git continuously and reverts manual drift. Pipelines only publish images and bump tags.

Identity

Single sign-on

One identity provider fronting every internal service, via native OIDC where supported and forward-auth where it isn't.

Storage

Erasure-coded object storage

Four-node distributed storage for application media, tolerant of two simultaneous node failures — verified by killing one live.

Observability

Metrics, logs & traces

Every host and container scraped, application requests traced end to end, alerts routed to chat with a daily heartbeat proving the chain still works.

Resilience

Automated backups & DR

Scheduled hypervisor-level backups with an offsite cold-sync target, plus a custom exporter that catches backups failing silently.

Projects

Things I've built and shipped

Each of these runs on the platform above — built, containerised, delivered through a pipeline, and monitored in production. The ones marked live are open to the public internet right now.

bazaar

LiveAndroid

Amazon-style marketplace with real payments

A full-stack marketplace with a real Razorpay checkout, a separate admin dashboard, and its own native Android client built with Expo/React Native. The mobile app talks to a dedicated backend-for-frontend so it can reach a ClusterIP-only API without that API ever being exposed to the internet.

Real payments · native Android app · admin dashboard

  • Next.js
  • Express
  • PostgreSQL
  • Razorpay
  • Authentik/OIDC
  • React Native
  • Expo
Visit the live site

store

Live

Service-split ecommerce platform

An ecommerce application deliberately split into a Next.js frontend and a separate Express API that is never exposed outside the cluster. Delivered through GitOps with per-commit database migration jobs, backed by the HA Postgres cluster and erasure-coded object storage for product media, with distributed tracing across both services.

Two-tier architecture · internal-only API boundary

  • Next.js
  • Express
  • PostgreSQL
  • ArgoCD
  • OpenTelemetry
  • MinIO
Visit the live site

lms

Live

Udemy-style course platform

A course platform that syncs its catalog straight from a Jellyfin media library, with a fully custom video player (scrub previews, resume, notes, certificates) and Razorpay checkout priced per course. No separate backend — Route Handlers and Server Actions talk to Postgres and Jellyfin directly.

Custom video player · Jellyfin-synced catalog

  • Next.js
  • PostgreSQL
  • Authentik/OIDC
  • Razorpay
  • Jellyfin API
Visit the live site

expenses

LiveAndroid

Expense tracker for web and Android

An expense tracker shared between a Next.js web app and a native Android client, both signing in directly with Google or Facebook OAuth. The mobile app authenticates with PKCE and talks to the same API routes as the browser using a bearer JWT, so there is exactly one backend behind two very different clients.

Shared web + Android client · on Google Play

  • Next.js
  • PostgreSQL
  • Auth.js
  • React Native
  • Expo
Visit the live siteGoogle Play

portfolio

Live

This site

The site you're reading, and the first workload here ever exposed to the public internet. Runs in its own isolated namespace with a default-deny network policy, a non-root read-only container, and a vulnerability scan that blocks the pipeline on any high-severity finding.

Hardened · publicly exposed · zero known CVEs

  • Next.js 16
  • Kubernetes
  • Traefik
  • Cloudflare
  • Trivy
Visit the live site

shop

Full-stack storefront with SSO

A Next.js storefront wired into the homelab identity provider for single sign-on, instrumented with end-to-end distributed tracing, and shipped by a CI/CD pipeline running on self-hosted runners so the cluster API never touches the public internet.

Single sign-on · self-hosted CI

  • Next.js
  • Auth.js
  • OIDC
  • OpenTelemetry
  • PostgreSQL

nextjs-docs

Self-hosted mirror of the Next.js docs

A 500+ page mirror of the official Next.js documentation, rebuilt from nextjs.org's own Markdown export by a Python sync script that rewrites links, escapes MDX-breaking prose, and keeps every diagram local so the site never depends on the upstream site being reachable.

502 pages · fully self-contained mirror

  • Next.js
  • Fumadocs
  • Python

homelab-docs

Documentation site for this homelab

The reference documentation for the entire homelab this portfolio runs on — architecture, DNS and front-door routing, security, and every application's setup notes, written in MDX and organized with Fumadocs.

Living reference for the whole cluster

  • Next.js
  • Fumadocs
  • MDX

Experience

What I've been doing

Self-directed engineering work, run with the same rigour a production system would demand.

  1. OngoingIndependent

    Platform & SRE — Self-hosted production platform

    Design and operate a multi-node hypervisor and Kubernetes platform as a live testbed for production infrastructure patterns: highly-available databases, GitOps delivery, centralised secrets, single sign-on, and full-stack observability. Everything is failure-tested rather than assumed working.

    • Replicated Postgres with point-in-time recovery, failover verified at six seconds
    • Zero-downtime rolling capacity upgrades across the cluster
    • Metrics, logs and traces unified behind a single dashboard and alerting layer
  2. OngoingIndependent

    Full-Stack Application Development

    Build and ship Next.js applications end to end — from React interface through API and schema design, down to the Kubernetes manifests and delivery pipelines that put them in front of users.

    • Service-split architectures with internal-only API boundaries
    • Authentication via OIDC single sign-on, tracing wired through every request
    • Per-commit database migrations gated ahead of rollout
  3. OngoingIndependent

    Cloud Infrastructure — AWS

    Hands-on with managed Kubernetes and container services, object storage, and IAM-scoped deployment automation across reference projects — mapping the self-hosted patterns onto managed cloud equivalents.

    • EKS and ECS deployments with least-privilege IAM
    • S3-backed artefact and delivery pipelines

Contact

Let's build something that stays up

Open to platform, SRE and full-stack roles, interesting collaborations, or just a good conversation about homelabs.

Email MeGitHub
[email protected]India