I design, deploy and maintain reproducible Linux infrastructure — communication, files, mobile devices — for organizations that want to take back control of their digital tools, without depending on a single vendor.
Leaving proprietary platforms has become a concrete concern — GDPR, strategic dependency, rising costs. But replacing Slack, Teams or an MDM with an open source alternative isn't enough if it's hand-rolled, poorly secured, or impossible to maintain over time.
I do the work that turns a promising open source tool into reliable infrastructure: automated, reproducible, documented, and maintainable after I'm gone.
I work across the whole chain: architecture, deployment, automation, updates, monitoring and incident response.
Installation, configuration, operations, updates, diagnostics and incident response in production. The goal: infrastructure that stays observable, documented and operable over time.
Ansible describes the expected state of the machines, Docker controls the application environment, Git makes it possible to know exactly what's deployed.
Separating responsibilities rather than building monolithic systems: runtime, application, persistent data, secrets, reverse proxy and deployment don't share the same lifecycle.
Environments combining MFA, RADIUS, LDAP/Active Directory and identity federation. Secrets management, privilege limitation, separation of responsibilities.
Three stacks, one method — and a possible combination for organizations that want to go all the way with their digital sovereignty.
Complete Matrix/Synapse infrastructure — encrypted messaging, bridges to WhatsApp, Telegram, Signal — to leave Slack or Teams without losing touch with the people you talk to. Multi-server architecture, strict separation of responsibilities, ready for strong authentication.
See the Matrix case study →Enrollment process for refurbished smartphones running /e/OS, connected to your Nextcloud — files, contacts, calendar synchronized, with no dependency on Google. A credible alternative to proprietary MDMs to control your devices end to end.
See the mobile fleet case study →A technical base split into three repositories — application image, deployment role, site instance — to deploy a new Grav site without starting from scratch, with a one-command rollback.
See the Grav CMS case study →Digital sovereignty doesn't just mean replacing proprietary software with open source software. An organization is only truly in control of its infrastructure if it can understand how it works, know where its data lives, back it up, rebuild it, and evolve it without depending on a single vendor.
Critical data and components stay under the organization's control.
Infrastructure must be rebuildable, migratable or replaceable without artificial dependency on a provider.
Important configuration shouldn't depend on manual steps that can't be reproduced.
The infrastructure must remain operable by someone other than the person who built it.
The same rigor, applied to other kinds of projects.
What a simple Grav CMS deployment taught me about persistence, lifecycle boundaries, and maintainable architecture.
Read the article →Rolling out MFA is the first concrete step of an identity infrastructure project
Read the article →A field report on deploying Nextcloud in a staging environment managed with Ansible and Docker.
Read the article →I identify the components, their responsibilities, their dependencies and their lifecycles. Automation comes after — never before.
Every deployment is automated and replayable identically — on a new server, after an outage, or to duplicate an installation.
These elements don't share the same function, the same lifecycle, or the same security requirements. No secret ever sits in plain text.
A system doesn't stop at the first docker compose up. Updates, rollback, backups, monitoring and diagnostics are designed in from the start.
See the work, don't just hear about it.
Everything I deliver is documented and, whenever possible, published as open source.
Whether it's leaving a proprietary subscription, rolling out a fleet of sovereign devices, or bringing order to an infrastructure that grew without a plan — let's talk about it.
Linux System Administrator · DevOps / Infrastructure Engineer · Infrastructure Consultant