Roman Mednitzer
Vienna, AT · Senior Linux & Platform Engineer
I run production Linux, virtualization, and Kubernetes infrastructure in regulated, business-critical environments, and build open-source tools and platforms for the same problems. Mostly self-taught. Open source by default.
About
Ten-plus years operating production infrastructure in regulated, business-critical environments, from manufacturing to enterprise hybrid estates. Day to day, that means Linux (Ubuntu, Red Hat), virtualization (KVM, VMware), Kubernetes and GitOps, observability (Zabbix, Grafana, Prometheus, OpenTelemetry), and backup/DR with verified restores, all under change control and audit.
Open-source projects
A few projects I maintain: the infrastructure as code and configuration management that build and harden my own fleet, and a code-managed ISMS for the compliance side of the same work.
Infrastructure as code for the fleet with OpenTofu: a KVM/libvirt module for cloud-init Ubuntu VMs and a Talos Linux module that deploys a Kubernetes cluster with hardened machine configs, secret management, and automated bootstrap. Lab and production environments are separated, production state lives in an encrypted, locked remote backend, and CI gates every change with fmt, validate, TFLint, Trivy, and gitleaks. Decisions are documented as ADRs.
Ansible configuration management and hardening for the same fleet: 19 baseline roles (SSH, AppArmor, UFW, auditd, AIDE, fail2ban, and more) plus playbooks for the SRE toolchain, local LLM inference, and out-of-band Redfish management. Every control is mapped to NIS2, CRA, GDPR, and ISO/IEC 27001 in a machine-readable compliance file, with ansible-lint and schema checks enforced in CI. Targets Ubuntu 24.04 and 26.04 LTS.
A code-managed ISMS for ISO/IEC 27001:2022, NIS2/NISG 2026, and GDPR Art. 32: a reusable template layer with per-organization instances, three evidence layers (signed Git history, eIDAS qualified signatures for formal documents, continuous evidence collection), and offline-capable validators and packagers. Early stage by design: the framework tooling is public while instance content stays confidential, and content population is ongoing.
In-depth write-ups are on the projects page; my other repos are at github.com/rmednitzer.
Homelab
A self-run, all-open-source fleet, mostly Ubuntu. Local LLM inference runs on NVIDIA (llama.cpp, llama-swap) and AMD ROCm (Ollama), feeding PydanticAI agents through a self-built MCP gateway on Hetzner. Underneath is a single-node Talos Kubernetes cluster running VictoriaMetrics, OpenTelemetry, and Wazuh, plus ZFS with Sanoid snapshots and a Tailscale/WireGuard mesh.
Skills
- Linux & Virtualization
- Linux Ubuntu Red Hat SLES Proxmox KVM VMware ZFS
- Resilience / Security
- Backup/DR Veeam Wazuh Hardening ISO 27001 ISMS/BCM NIS2
- Containers / GitOps
- Kubernetes OpenShift Talos Docker Helm Argo CD GitOps
- Automation / IaC
- Ansible Terraform OpenTofu GitLab CI/CD
- Observability
- Prometheus Grafana Zabbix OpenTelemetry VictoriaMetrics Checkmk
- Homelab / Learning
- Local LLMs llama.cpp Ollama MCP PydanticAI LLMOps