Roman Mednitzer

Vienna, AT · Senior Linux & Platform Engineer

I run production Linux, virtualization, and Kubernetes infrastructure in regulated, business-critical environments, working with open-source software throughout.

focus: Linux · virtualization · Kubernetes/GitOps · observability · backup/DR
experience: 10+ years in regulated & business-critical environments · ISO 27001 ISMS implementation
approach: open source by default · mostly self-taught
languages: German · English
member of: IEEE · Austrian Computer Society (OCG)

About

I keep business-critical systems dependable in environments where both downtime and audit findings are expensive, from regulated manufacturing to enterprise hybrid estates. I run the infrastructure and prove the recoveries, and I implement the ISO 27001 ISMS that has to satisfy the auditor, so the engineering and the governance get built together rather than bolted on. The work leans on reproducible, evidence-backed automation under change control.

Open source

The same arc as the day job, in public: the governed control plane that operates the fleet, and the infrastructure as code and configuration management that build it.

relay-shell

Apache-2.0 · MCP

A Model Context Protocol server that gives an AI client real shell and SSH capability over hosts I administer: local and remote execution, interactive PTY sessions, SFTP, port forwarding, and parallel fleet commands behind one audited runner. Authority is tiered — open, guarded, and read-only modes over a global deny-list — and every call is secret-redacted, recorded as a SHA-256 hash rather than a raw body, and bounded by timeouts and output caps.

infra

Apache-2.0 · OpenTofu

OpenTofu modules that build the fleet: cloud-init Ubuntu VMs on KVM/libvirt, and a Talos Linux module that stands up the Kubernetes cluster. Lab and production are separated, production state lives in an encrypted, locked remote backend, and every change is CI-gated.

automation

Apache-2.0 · Ansible

Ansible hardening and configuration management for the same hosts: a baseline of roles covering SSH, auditd, firewalling, and kernel and systemd hardening, plus playbooks for the SRE toolchain, local inference, and out-of-band management. Every control maps to NIS2, CRA, GDPR, and ISO/IEC 27001 in a machine-readable file.

More at github.com/rmednitzer

Skills

The fleet

A self-run, all-open-source personal fleet, organized as a strict control-plane / data-plane split and driven end to end through a governed Model Context Protocol control plane. Linux hosts and a single-node Kubernetes cluster, meshed and observable, run with the habits I bring to production.

control plane

MCP gateway cloud VM · OAuth 2.1 + PKCE · CIDR-locked proxy

plan
authorize
execute

every mutation, hash-chained

data plane

Data & inference GPU host · loopback-only
Observability & SIEM Talos Kubernetes
Git, services & storage always-on · ZFS

Every automated action enters through the gateway, and nothing above read-only reaches the data plane without crossing the gate.

Control plane

cloud VM

An authenticated, typed MCP gateway on a cloud VM is where every automated action enters the fleet. OAuth 2.1 with PKCE sits behind a CIDR-locked reverse proxy, and no provider credential ever lives in the network-facing process. Anything above read-only crosses an explicit plan → authorize → execute gate with a single-use confirmation digest, and every call lands in an append-only, hash-chained audit log.

Data & inference

GPU compute server

A single workstation-class host carries all local inference and the authoritative data store. Local LLMs run on llama.cpp via llama-swap; PostgreSQL 18 holds the corpora plus a pgvector and Apache AGE knowledge graph, fed by more than 130 OSINT sources on a four-hour cycle and six scheduled analysis agents. Loopback-only by default.

Observability & SIEM

Talos Kubernetes

A single-node Talos Linux cluster (immutable, API-managed, no SSH) carries fleet-wide telemetry: VictoriaMetrics, VictoriaLogs, Tempo, and OpenTelemetry behind Grafana, with vmalert and Alertmanager on top, plus a Wazuh SIEM with realtime file-integrity monitoring and agents across the Linux and Windows hosts. Helm-deployed and Flux-reconciled.

Git, services & storage

always-on server

The fleet's own Git authority runs on self-hosted Forgejo, alongside Ansible job automation and the notification service, so the code that builds the fleet does not depend on anything I do not run. Encrypted Restic backups go off-host. ZFS everywhere on Linux, with Sanoid snapshots, scheduled scrubs, and a pre-change snapshot before anything risky.