Roman Mednitzer

Systems & Platform Engineer

Vienna, Austria

I look after production infrastructure for a living: Linux, virtualization, Kubernetes, observability, and backups that get restored, not just configured. At home I run a small lab and build things.

Now: IT Systems Engineer at Cubicure, a Vienna maker of industrial 3D printers
Interests: Linux and open source · how systems stay up and how they fail · EU technology regulation · trustworthy AI systems · hard science fiction and space · industrial and EBM
Member of: IEEE (Systems, Man, and Cybernetics Society; Computational Intelligence Society) · Austrian Computer Society (OCG)
Languages: German (native) · English (fluent)

About

I am Roman. I live in Vienna and have spent about ten years keeping computers running for other people. I like the whole stack, from the hardware in the rack to the software on top, and I like knowing how it actually works and where it breaks. That is also why there is a rack at home.

Most of what I know I taught myself, because I was curious, and I am curious about a lot of things: how operating systems work, how large systems stay stable or fall apart, cybernetics, how the EU regulates technology, and what it takes to trust an AI system with real work. I prefer open source because I can read it, and I would rather run something myself than rent it.

Away from the keyboard I build things, read hard science fiction, and listen to a lot of industrial and EBM. I have been a member of the IEEE Systems, Man, and Cybernetics Society and the Computational Intelligence Society since 2013, and of the Austrian Computer Society. The rest of this page is the work and the lab.

Experience

Where the ten years went. Most of them at one Austrian IT service provider.

Since 2026

IT Systems Engineer

Cubicure GmbH · Vienna

Systems engineering at a Vienna manufacturer of industrial 3D printers.
2025–2026

IT Systems Administrator

Kwizda Holding GmbH · Vienna

A year of group IT: a mixed Windows and Linux estate of a few hundred hosts and virtual machines across the group's companies. I owned backup and recovery, which meant being able to show a documented restore for anything that mattered, ran monitoring and alerting, looked after the server hardware, and helped move the group toward Kubernetes and GitOps.
2017–2025

IT Systems Engineer

EBCONT operations GmbH · Vienna

Eight years at a managed-services provider, and the place I learned the most. I carried the incident, problem, and change lifecycle for customers' production environments, ran virtualization clusters on enterprise SAN storage, built Kubernetes platforms with GitOps delivery, kept the internal source-control and CI services current, and ran a proof of concept for hyperconverged infrastructure and high-speed networking. Third-level support and on-call the whole way through.
2016–2017

IT Systems Administrator

medPhoton GmbH · Salzburg

Server and application operations at a manufacturer of radiotherapy devices, where the devices are safety-critical and audits are part of normal life. Incident handling and root-cause analysis, backup and recovery with integrity checks, ISMS and BCM work with ISO 27001 audit preparation, and the operating procedures and runbooks I wrote for the team.
2012–2016

IT Technician

Ledl.net GmbH and medPhoton GmbH · Salzburg

Apprenticeship in information technology with a systems engineering focus, completed 2016. It began at a hosting provider with web hosting, domains, and customer support, and finished at the medical-device manufacturer with technical support, backup and recovery, and ISO 27001 audit readiness.

Capabilities

The tools I reach for without thinking, at work and at home. The highlighted ones are where I would start.

Open source

Some of what I build for the lab is public. These are the pieces other people might find useful: an MCP server that lets an AI agent work a shell without being trusted blindly, and the code that builds and hardens the hosts.

relay-shell

Apache-2.0 · MCP

A Model Context Protocol server that gives an AI client a real shell, on the local host and over SSH on the hosts I administer: command execution, interactive PTY sessions, SFTP, port forwarding, and parallel commands across a fleet, all through one audited runner. Every call is classified into an authority tier, a policy mode (open, guarded, or read-only) decides which tiers may run, and a deny-list is checked first in every mode. Secrets are redacted, every call is logged with its output stored as a SHA-256 hash rather than the output itself, and everything is bounded by timeouts and output caps. The point is an agent that can do real work on my hosts while every action it takes is classified, bounded, and on record.

infra

Apache-2.0 · OpenTofu

Two OpenTofu modules for the lab's hosts: one for cloud-init Ubuntu VMs on KVM/libvirt, one for a Talos Linux Kubernetes cluster. Lab and production are kept apart, production state is configured for an encrypted, locked remote backend, and nothing merges without passing format, lint, security and secret scanning, and module tests against mock providers.

automation

Apache-2.0 · Ansible

Ansible for the same hosts: a CIS-based hardening baseline for SSH, auditd, the firewall, the kernel, and systemd services, plus playbooks for the SRE toolchain and local inference, and a proposed one for out-of-band management. Controls map to NIS2, the Cyber Resilience Act, GDPR, and ISO/IEC 27001 in a machine-readable file, so the compliance story comes from the code rather than from a document sitting next to it.

More at github.com/rmednitzer

The lab

I run a small fleet at home: a few Linux hosts on ZFS, a GPU box for local models, and a single-node Talos Kubernetes cluster whose state comes from Git alone. It started as a place to try things I could not try at work, and it grew.

Most of it exists so I can read the news the way I want to. A PostgreSQL knowledge base pulls in some 130 OSINT and news feeds, holds over 220,000 documents with embeddings and some 38,000 CVEs enriched with KEV and EPSS, and answers questions through hybrid vector and full-text search with reranking. Local models on llama.cpp do the summarising, scheduled agents write me a briefing every morning, and the data lives on a machine at home rather than in someone else's cloud.

It is also where I test my own habits. Every automated action, including the ones my AI tooling takes, goes through a plan, authorize, execute gate and lands in a hash-chained audit log. The hardening baseline is the automation repository above, applied to every host. Snapshots are scheduled and restores are tested rather than assumed. The Git that builds it all is self-hosted, so the lab depends on nothing I do not run. I break it regularly, on purpose and otherwise.