DevOps / infra skills

Protect against data loss: back up the database, R2 assets, and code/config, set RPO/RTO targets, and run restore drills so recovery actually works.

Set up the CI quality gates that block bad code from reaching production, lint, typecheck, tests, and build, with branch protection, so only green code reaches deploy. This repo's deploy is git-push-to-hostssh; a client job names theirs.

Operate Cloudflare as the DNS + R2 object-storage + edge layer fronting a self-hosted fleet, DNS via a scoped Zone:DNS:Edit token + REST (the MCP has no DNS tools; touch only apex A + www, never MX/TXT/DKIM/SPF), R2 buckets via MCP + objects via the S3 API (the zero-egress restic backup target + per-app media buckets), proxy/TLS (SSL Full strict + Origin certs), and Workers/KV/D1/Hyperdrive.

Operate Coolify, the popular open-source self-hosted PaaS, for agencies and clients who run it, onboard a box, deploy apps from git (Nixpacks/Dockerfile) with automatic Let's Encrypt, give a service a custom domain (the FQDN gotcha), stand up one-click databases, wire backups, and cut DNS over.

Govern cloud + AI spend across the whole stack (the VPS fleet, R2, GPU/render, Claude API, and third-party adapters) with attribution, budgets, alerts, and unit-economics (cost per render/member).

Plan and apply Prisma/Postgres schema changes safely, classify additive vs destructive, back up, dry-run, apply with migrate deploy, and keep a rollback path.

Ship a release safely on a Next.js/Prisma stack behind a self-hosted control plane (hostssh in the example), pre-deploy checklist, git push to the control plane → blue-green deploy → prod, migration sequencing, env sync, post-deploy verification, and rollback.

Manage environment variables and secrets across local, the app's container env on the control plane (hostssh in the example), and any GPU box, audit parity, rotate keys safely, and keep secrets out of the repo.

Operate Google Cloud via the gcloud CLI + gcloud MCP, and set up the service-account auth pattern that makes Google-product MCPs (GA4, Search Console, Vertex) work when a Workspace org blocks unverified OAuth, create a least-privilege service account + key (chmod 600), grant roles, enable APIs, mint a scoped token for Admin-API writes, and ALWAYS restore the human account after activating an SA.

Operate Hostinger (a VPS provider many agency fleets run on, plus managed WordPress/shared hosting, domains, DNS, and email) through the hostinger-api MCP. Provision and recreate VPS boxes, manage the cloud firewall and snapshots, buy and point domains, edit DNS safely (without breaking email), and drive the periodic renewal migration.

Run any DevOps task end to end for a named stack, confirm the production-change gate, then route to deploy, migrations, infra, observability, incidents, CI, secrets, backups, or cost. The sender names the stack; the hostssh commands in the routed leaves are one worked example.

Run a production incident end to end, assess severity, mitigate/rollback, communicate, and write a blameless postmortem.

Set up and run monitoring for a named stack, errors, logs, uptime, queue health, and spend alerts with sane thresholds. The sender names the stack; the hostssh and Sentry commands below are one worked example.

Operate the video render + media-generation queue, dispatch jobs, monitor progress, retry failures, scale GPU workers, and control per-render cost.

Provision and operate the self-hosted GPU engine fleet (Voicebox, ComfyUI, whisper.cpp, MuseTalk, Remotion render workers) as services behind the MediaProvider seam, reachable from the app via Cloudflare Tunnel + Access.

Pick, license-check, and compose a short own-the-stack (analytics, wiki, helpdesk, email, LMS, search, identity) into a self-hosted deploy spec (hostssh or Coolify). Not the GPU box, not VPS capture/restore, not Coolify, not Paperless-only, not make-vs-buy.

Operate a self-hosted app fleet on a self-hosted control plane (hostssh is the worked example) instead of managed hosting (Vercel) and managed Postgres (Neon).