Hi, my name is

Phyo Thura.

I keep things shipping.

DevOps engineer with a backend background. I design and maintain CI/CD pipelines, Kubernetes and Docker workloads, cloud and on-prem infrastructure — and the monitoring that tells us when any of it misbehaves.

See what I've builtGet in touch
all systems operationalDevOps Engineer · Bueng Kan, Thailandopen to talk
ops@wrecky — deploy
$ ▋
✓checkout2s
✓build image41s
✓trivy scan9s · 0 critical
✓sonarqube gate12s · passed
✓push → registry18s
✓deploy → self-hosted7s
→ deployed in 1m 27s · rollback ready
prometheus · targets7/7 up
  • proxmox-clusterpve-01 · pve-02UP
  • gha-runnerpve-runnerUP
  • minios3.internal:9000UP
  • sonarqubesonar.internalUP
  • grafana-lokiloki:3100UP
23
repos with CI I own
across the whole org
38
GitHub Actions workflows
build · scan · deploy
3
public clouds
AWS · Azure · DigitalOcean
10+
self-hosted platforms
run on my own metal
24/7
monitored & alerting
Prometheus · Grafana
GitHub ActionsKubernetesProxmoxDockerTerraformPrometheusGrafanaMinIOTrivySonarQubeNetBirdKeycloakRabbitMQKafkaCaddyNginxPostgreSQLCloudflareArgoCDLaravel ForgeLoki

01.$whoami

About me

  • 1 yearDevOps EngineerLookSocial● now
  • 4 monthsDevOps Engineer TraineeLeap Solutions Asia

I'm Phyo Thura — most people call me Wrecky. I'm a DevOps engineer in Bueng Kan, Thailand who owns the whole delivery path: the build, the container, the cluster, the server, and the rollback when it goes wrong.

I started out writing backend code in Laravel, Node.js and Python, then found the part I actually enjoyed was everything around it. Now I run the infrastructure that everyone else deploys onto.

Delivery

Every CI/CD pipeline in the org — 38 workflows across 23 repos, on self-hosted runners.

Infrastructure

Kubernetes, Docker and a Proxmox cluster, plus AWS, Azure and DigitalOcean where it fits.

Reliability

Prometheus, Grafana and Loki on every host, with alerts that fire before users notice.

Guardrails

SonarQube and Trivy gate each build; Keycloak and NetBird keep internal tools private.

Currently

  • Running self-hosted GitHub Actions runners on Proxmox VMs
  • Standardising build → scan → deploy across every repo
  • Cutting cloud spend by moving the right workloads on-prem
  • Studying for AWS Solutions Architect – Professional (SAP-C02)
Phyo Thura — DevOps Engineer
name
= "Phyo Thura"
alias
= "Wrecky"
role
= "DevOps Engineer"
based
= "Bueng Kan, Thailand"

02.$cat toolbox.yaml

The toolbox

What I actually reach for, grouped by the job it does. Nothing here is aspirational — it is all in production somewhere.

CI / CD

01

Every pipeline in the org, written and maintained by me — including the 2am ones that break.

  • GitHub Actions
  • GitLab CI
  • ArgoCD
  • Self-hosted runners
  • Multi-env deploys
  • Laravel Forge
  • Pipeline & deploy debugging

Containers & Orchestration

02

Build small, run isolated, ship the same artifact everywhere.

  • Docker
  • Docker Compose
  • Kubernetes
  • Helm
  • MetalLB · StorageClasses
  • Container registries

Cloud & IaC

03

Three providers, chosen per workload and per budget.

  • AWS
  • Azure
  • DigitalOcean
  • Terraform
  • Laravel Forge
  • Cloudflare

Web, Proxy & DNS

04

Getting traffic to the right container with a valid certificate.

  • Nginx
  • Caddy
  • Nginx Proxy Manager
  • Traefik
  • Domains & DNS
  • Let's Encrypt / TLS

Networking & Access

05

Private by default — nothing sensitive is reachable from the public internet.

  • NetBird
  • Tailscale
  • Headscale + Headplane
  • WireGuard VPN
  • Cloudflare Tunnel
  • SSH (keys, bastions, hardening)

Identity & SSO

06

One login for every internal tool, and an audit trail behind it.

  • Keycloak
  • Authentik
  • OIDC / SAML
  • JWT
  • Argon2id
  • RBAC & access audits

Virtualisation & OS

07

The metal under the containers.

  • Proxmox VE
  • KVM / LXC
  • Linux administration
  • Bash · systemd
  • Debian · Ubuntu · Fedora
  • Backups & snapshots

Observability

08

If it runs in production, it is scraped, graphed and alerting.

  • Prometheus
  • Grafana
  • Alertmanager
  • Loki
  • cAdvisor
  • Blackbox exporter

Quality & Security

09

Gates that run before anything reaches production.

  • SonarQube
  • Trivy
  • Secret scanning
  • Least-privilege runners
  • Dependency audits
  • Perimeter access checks

Databases & Storage

10

The stateful half nobody wants to be on call for.

  • PostgreSQL
  • MySQL / MariaDB
  • MongoDB
  • SQL Server
  • SQLite
  • MinIO (S3)

Messaging & Streaming

11

Queues and event logs, plus the jobs that chew through them.

  • RabbitMQ
  • Apache Kafka
  • Redpanda
  • Apache Spark / PySpark
  • Webhooks + retries

Code

12

Enough to be dangerous in every repo I have to deploy.

  • Python
  • Go
  • TypeScript / Node.js
  • PHP / Laravel
  • Java / Spring Boot
  • C# / .NET

Frontend & Apps

13

So I can debug the thing I'm deploying.

  • React
  • Next.js
  • Angular
  • Tailwind CSS
  • Flutter
  • WordPress

03.$gh run watch

Commit to production

The path every change takes. I built it, and I'm the one who gets paged when a stage goes red.

01

Commit

push / PR

Branch protection, conventional commits, and a workflow per environment.

02

CI runner

self-hosted · Proxmox

Lint, typecheck and build on our own metal with warm caches.

03

Scan & gate

Trivy · SonarQube

CVEs and code smells block the merge — not the on-call engineer.

04

Image

build & push

Multi-stage Docker build, tagged by SHA, pushed to the registry.

05

Deploy

Docker · Kubernetes

Rolling deploy per environment, with a one-command rollback.

06

Edge

Cloudflare · Nginx

TLS, caching and tunnels in front of every public service.

observed end to end
  • Prometheus
  • Grafana
  • Loki
  • Alertmanager
alert → chat, with a link to the panel that fired it

04.$docker ps --format '{{.Names}}'

Self-hosted, on my own metal

A shelf of platforms I run instead of renting. Cheaper, private, and I learn the internals by keeping them alive.

Proxmox VE

hypervisor

The cluster everything else sits on.

VMs and LXC containers for runners, databases and staging environments.

running

GitHub self-hosted runners

ci

Our own build fleet, labelled and pinned per project.

Faster builds, warm caches, private-network access — and no minute bill.

running

Prometheus + Grafana

monitoring

Metrics for every host, container and endpoint.

Dashboards the team actually reads, and alert rules that fire before users complain.

running

cAdvisor / Blackbox exporter

monitoring

Per-container resource metrics and external uptime probes.

Tells me whether it is the app, the container or the network — in one glance.

running

MinIO

storage

S3-compatible object storage on-prem.

Artifacts, backups and datasets without egress fees.

running

SonarQube

quality

Static analysis with per-branch project keys.

Quality gate in CI, results pushed straight to the team channel.

running

Trivy

security

Image, filesystem and dependency scanning.

Catches CVEs at build time instead of in production.

running

WordPress (self-hosted)

hosting

Client WordPress sites, one Docker container each.

Full control of PHP versions, backups and caching — no shared-hosting surprises.

running

Keycloak / Authentik

identity

Self-hosted identity providers with OIDC and SAML.

One login across Grafana and the internal tools, with real RBAC behind it.

running

Headscale + Headplane

network

Self-hosted Tailscale control plane, alongside NetBird.

A private mesh between servers — internal services never touch the public internet.

running

RabbitMQ / Redpanda

messaging

Message queue and Kafka-compatible event log.

Decouples services so a slow consumer never takes the API down with it.

running

Coder

devenv

Self-hosted cloud development environments.

Reproducible workspaces — new devs are productive on day one.

running

CVAT

ml-ops

Computer vision annotation platform.

In-house labelling for vision datasets, no third-party data exposure.

running

Label Studio

ml-ops

Multi-type data labelling.

Text, audio and image annotation pipelines for model training.

running

MobileSAM

ml-ops

Lightweight Segment Anything, served locally.

Assisted segmentation that speeds up manual annotation.

running

OpenCLAW

automation

Self-hosted agent automation.

Automating the repetitive operational work nobody wants to do twice.

running

05.$ls -la ~/projects

Things I've built & run

Platforms, pipelines and the plumbing between them. These are the ones I'd bring up in an interview.

Infrastructure & delivery owner

Websabuy Hosting Platform

A WordPress hosting control panel: one dashboard to create, deploy, back up and log into every client site — without ever typing a WordPress password.

  • Next.js
  • NestJS
  • Prisma
  • PostgreSQL
  • MariaDB
  • Docker
  • NetBird
  • GitHub Actions
  • Cloudflare
  • Three services I set up and ship: a Next.js control panel, a NestJS + Prisma + Postgres API, and a privileged host agent that drives Docker on the WordPress servers.
  • Passwordless wp-admin access via short-lived, single-use HMAC SSO tokens verified server-to-server by a MU-plugin.
  • One container per site with a shared MariaDB (separate DB + user each) — real isolation between tenants.
  • The agent binds only to a private NetBird IP; public traffic terminates at Nginx Proxy Manager with automated Let's Encrypt.
  • GitHub Actions builds the image, pushes it, and deploys to the shared self-hosted server on every merge.

Backend & pipeline engineer

Multiliner Core API

Ocean freight booking, unified. One API that speaks to multiple shipping carriers so freight forwarders stop re-typing the same booking into three different portals.

  • Go
  • PostgreSQL
  • Docker
  • DCSA v2
  • EDIFACT
  • JWT
  • REST
  • Carrier integrations for Maersk, ONE (ONEY) and OOCL (OOLU) behind a single unified endpoint.
  • Speaks both the DCSA v2 JSON standard and legacy EDIFACT messages, with smart field mapping and automatic carrier detection.
  • Go service with JWT + refresh-token auth, hexagonal internals (adapters / core / infrastructure) and Postgres persistence.
  • Containerised with Docker Compose and driven by Makefile targets for repeatable local and CI runs.

DevOps

TradeConnect Gateway

A multi-tenant gateway into Thai government trade systems — DFT, Customs, OCSB and the Thai Chamber of Commerce — behind one authenticated API.

  • Go
  • Fiber
  • GORM
  • RabbitMQ
  • Azure Blob
  • PostgreSQL
  • GitHub Actions
  • Four environment pipelines I authored: dev, UAT, pre-prod and prod, each with its own approval path.
  • Go / Fiber hexagonal modular monolith with RabbitMQ, Azure Blob Storage and SFTP adapters.
  • Encrypted API-key auth (AES-256-GCM at rest, Argon2id hashing) with per-tenant rate limiting and request auditing.
  • Webhook delivery with retries so downstream clients never poll.

Built and operated by me

Monitoring & Alerting Stack

Prometheus, Grafana and Alertmanager across every server we run — so a failure is a notification, not a customer email.

  • Prometheus
  • Grafana
  • Alertmanager
  • Loki
  • cAdvisor
  • Blackbox exporter
  • Docker
  • Prometheus scrapes node, container and application metrics from every host, on-prem and cloud alike.
  • cAdvisor for per-container resource usage and a blackbox exporter probing public endpoints from outside.
  • Grafana dashboards per service: request rates, error budgets, disk and memory headroom, CI runner load.
  • Alert rules with sensible thresholds and routing — disk filling up, container restart loops, TLS expiry, endpoint down.
  • Alerts land in the team chat with a link straight to the panel that fired them.

Sole author

Org-wide CI/CD Fleet

Every pipeline in the organisation — 38 GitHub Actions workflows across 23 repositories — designed, written and maintained by me.

  • GitHub Actions
  • Self-hosted runners
  • Proxmox
  • Docker
  • SonarQube
  • Trivy
  • Turborepo
  • Lint → typecheck → build → scan → deploy, standardised so any repo behaves the same way.
  • Runs on self-hosted runners on Proxmox VMs with warm dependency caches and concurrency cancellation.
  • SonarQube quality gates with per-branch project keys and Trivy image scanning in the same run.
  • Deploy results, scan summaries and access audits pushed to the team's chat automatically.
  • Beyond deploys: issue triage, project-board automation and stale-branch checks run as workflows too.

DevOps Engineer Trainee · Leap Solutions Asia

Bare-metal Kubernetes Platform

A from-scratch Kubernetes platform for data workloads — cluster, networking, storage, ingress, auth, streaming and observability, all installed by hand.

  • Kubernetes
  • MetalLB
  • Helm
  • Traefik
  • Kafka
  • Spark
  • MinIO
  • Loki
  • Keycloak
  • Jupyter
  • Installed and configured Kubernetes clusters for container orchestration and workload management.
  • MetalLB for Layer 2 / ARP load balancing, plus StorageClasses for persistent volume provisioning.
  • NGINX Ingress Controller and Traefik for external access and dynamic routing.
  • Apache Kafka for distributed stream processing, and Apache Spark deployed via Helm running PySpark jobs.
  • MinIO as S3-compatible cluster storage; Jupyter Notebooks provisioned in-cluster and wired to PySpark.
  • Prometheus + Alertmanager for observability, Grafana Loki for centralised logs, Keycloak integrated with Grafana for SSO.

05b.Before DevOps — things I wrote

Rangers 5

Mobile web platform for digital mini-games and event challenges.

2025 · React · TypeScript · Vite · MySQL

Room Reservation

Campus room reservation for MFU — staff, teacher, approver and student roles.

2023 · Node.js · JavaScript · MySQL

Assets Borrowing App

Mobile app for lending and borrowing campus assets, with borrower and owner flows.

2023 · Flutter · Dart · MySQL

Automatic Traffic Control

Capstone: a web app that allows or denies campus network traffic by policy.

2023 · Python · Cisco Catalyst 9800

Food Fusion

A culinary platform for home cooks and the community around it.

2022 · PHP · MySQL · JavaScript

Library Program

Library system with staff, teacher, librarian and student users.

2022 · Java

Typing Practice Program

Scored typing trainer with a persistent leaderboard to compete on.

2017 · C++ · Windows Console

06.$git log --oneline --reverse

How I got here

From writing features to owning the whole delivery path.

  1. DevOps Engineer

    @ LookSocial

    Present · 1 year · Bueng Kan, Thailand● now

    • Own the delivery path for the entire product portfolio — 23 repositories, 38 pipelines.
    • Built and run the self-hosted GitHub Actions runner fleet on a Proxmox cluster.
    • Introduced SonarQube quality gates and Trivy scanning into every build.
    • Stood up Prometheus + Grafana monitoring with alert rules across all servers and containers.
    • Operate the self-hosted platform shelf: MinIO, CVAT, Label Studio, Coder, and more.
    • Design and deploy multi-environment infrastructure across AWS, Azure and DigitalOcean.

  2. DevOps Engineer Trainee

    @ Leap Solutions Asia Co., Ltd

    Jan 2025 – Apr 2025 · 4 months · Bangkok, Thailand

    • Installed and configured Kubernetes clusters for container orchestration and workload management.
    • Set up MetalLB for Layer 2 / ARP load balancing and defined StorageClasses for persistent volumes.
    • Deployed NGINX Ingress Controller and Traefik for external access and dynamic routing.
    • Installed and managed the Prometheus stack with Alertmanager, and Grafana Loki for centralised logs.
    • Deployed Apache Kafka for stream processing and Apache Spark via Helm, running PySpark jobs.
    • Configured MinIO for S3-compatible cluster storage and integrated Keycloak with Grafana for SSO.

  3. B.Eng. Computer Engineering

    @ Mae Fah Luang University

    Aug 2021 – May 2025 · Chiang Rai, Thailand · GPAX 3.8

    • Capstone: automatic network traffic control for the campus network using Cisco Catalyst 9800 controllers.
    • Built the campus room reservation system that replaced a paper process.

  4. B.Sc. Computer Science

    @ University of Information Technology

    Dec 2016 – Apr 2020 · Yangon, Myanmar

    • Four years of Computer Science in Yangon before continuing my engineering degree in Thailand.

Certifications

  • AWS Certified Cloud Practitioner

    Amazon Web Services

  • DevOps and Software Engineering

    Coursera (IBM)

  • Huawei HCCDA — Tech Essentials

    Huawei

  • GitHub Foundations

    GitHub

Languages

  • Burmese

    Native

  • English

    Professional working

  • Thai

    Conversational

07. What's next

Let's build something reliable.

I'm always happy to talk infrastructure — pipelines that keep breaking, servers that need monitoring, or a platform you want to run yourself. My inbox is open.

phyoethura75@gmail.com