Roman Mednitzer

Vienna, AT · Senior Linux & Platform Engineer

I run production Linux, virtualization, and Kubernetes infrastructure in regulated, business-critical environments, working with open-source software throughout.

focus: Linux · virtualization · Kubernetes/GitOps · observability · backup/DR
experience: 10+ years in regulated & business-critical environments · ISO 27001 ISMS implementation
approach: open source by default · mostly self-taught
languages: German · English
member of: IEEE · Austrian Computer Society (OCG)

About

I keep business-critical systems dependable in environments where both downtime and audit findings are expensive, from regulated manufacturing to enterprise hybrid estates. The range is the point: I run the infrastructure and prove the recoveries, and I implement the ISO 27001 ISMS that has to satisfy an auditor, so the engineering and the governance are built together instead of bolted on. I lean on reproducible, evidence-backed automation rather than one-off fixes, all under change control.

Open source

Open source by default: the same arc as the day job, in public. The infrastructure as code and configuration management that build and harden the fleet, and the governed control plane that operates it.

infra

Apache-2.0 · OpenTofu

Infrastructure as code for the fleet: a KVM/libvirt module for cloud-init Ubuntu VMs and a Talos Linux module that stands up a hardened Kubernetes cluster. Lab and production are separated, production state lives in an encrypted, locked remote backend, and CI gates every change with fmt, validate, TFLint, Trivy, and gitleaks.

automation

Apache-2.0 · Ansible

Ansible configuration management and hardening for the same fleet: a compliance-aligned baseline of hardening roles plus playbooks for the SRE toolchain, local inference, and out-of-band management. Every control is mapped to NIS2, CRA, GDPR, and ISO/IEC 27001 in a machine-readable file, with ansible-lint and schema checks in CI.

relay-shell

Apache-2.0 · MCP

A governed Model Context Protocol server that hands real shell and SSH capability to an AI client without giving up control. One audited runner covers local and remote execution, SFTP, port forwarding, and parallel fleet commands, with privileged flows gated behind explicit policy. Three modes (open, guarded, read-only) sit over a global deny-list; every call is secret-redacted, recorded as a SHA-256 hash rather than a raw body, and bounded by timeouts and output caps. Ships with CodeQL, dependency review, pip-audit, and gitleaks in CI.

More at github.com/rmednitzer, including a code-managed ISO 27001 ISMS and edge-AI experiments.

Skills

The fleet

A self-run, all-open-source personal fleet, organized as a strict control-plane / data-plane split and driven end to end through a governed Model Context Protocol control plane I designed and run myself. Five hosts and a single-node Kubernetes cluster, meshed and observable, run the way I run production.

Control plane

cloud VM

An authenticated, typed MCP gateway that is the only externally reachable surface. OAuth 2.1 with PKCE sits behind a CIDR-locked reverse proxy, and no provider credential ever lives in the network-facing process. Anything above read-only crosses an explicit plan → authorize → execute gate with a single-use confirmation digest, and every call lands in an append-only, hash-chained audit log.

Data & inference

GPU compute server

A workstation-class box (Core i9, 128 GB ECC, RTX 4500 Ada) carries all local inference and the authoritative data store. Local LLMs run on llama.cpp via llama-swap; PostgreSQL 18 holds the corpora plus a pgvector and Apache AGE knowledge graph, feeding sixteen scheduled OSINT and analysis pipelines. Loopback-only by default.

Observability & SIEM

Talos Kubernetes

A single-node Talos Linux cluster (immutable, API-managed, no SSH) carries fleet-wide telemetry: VictoriaMetrics, VictoriaLogs, Tempo, and OpenTelemetry behind Grafana, plus a Wazuh SIEM with realtime file-integrity monitoring. Helm-deployed and GitOps-reconciled.

Edge & mesh

workstations

A ROCm desktop with software-defined radio, a roaming laptop, and a hardened Windows management surface round out the fleet, joined over a Tailscale and WireGuard mesh. ZFS everywhere on Linux, with Sanoid snapshots, scheduled scrubs, and a pre-change snapshot before anything risky.