Tariq Hassan
Contact

Tariq Hassan / Infrastructure & DevOps engineer Infrastructure that patches, backs up and explains itself.

By day I'm an endpoint engineer for a 7,800-device healthcare fleet across 30+ sites, under HIPAA and a two-hour priority SLA. On my own time I designed and run a three-node platform: 70+ containers defined in Ansible and Git, monitored, patched and backed up by automation. I want that to be my day job.

Get in touch Tour the platform

Open to DevOps, SRE and platform roles · Twin Cities, hybrid or remote

GitHubLinkedInPlatform source

Fig. 1Platform topologyLive
HTTPS tunnel · outbound only WireGuard Ansible · metrics · logs nightly backups WireGuard outside-in checks Visitors public internet Edge network TLS · WAF · geo rules Family devices apps over VPN Compute node Reverse proxy ban list + WAF 65 containers Docker Compose ZFS storage snapshots / 6 h Control node Ansible · DNS filter · VPN hub primary backups · this page Offsite node append-only backup copy watches from outside

Three machines in two locations. Hover or tap a part of the diagram to see what it does.

Nodes up
3/3
Containers
72
Uptime, 7 days
99.97%
Open incidents
0

Reading the platform…

01 · Profile

I run a home network like a production environment.

I got into infrastructure the practical way. In 2021 my lab was two virtual machines for practising Group Policy and DNS. Today it is a small production environment that my family depends on every day.

I run it with the habits of a production team. Everything is in code, every change is a commit, every alert says what to do about it, and every backup has been restored at least once. When a machine dies, one script rebuilds it from the repository.

At work I'm an endpoint engineer for a healthcare organization with more than 30 sites. I manage identity and devices across Active Directory, Entra ID, Intune and SCCM, and I resolve over 160 incidents and requests a month. That job taught me what an outage costs the people on the other end of it.

I'm looking for a DevOps, SRE or platform role where I can do full time what I already do every evening: automate the repetitive parts, measure everything, and leave systems easier to run than I found them.

Now
Endpoint Engineer, HCL America
Looking for
DevOps · SRE · Platform · Infrastructure
Based in
Minneapolis–Saint Paul, Minnesota
Works
On site, hybrid or remote (Central Time)
Degree
B.S. Computer Science, Metropolitan State University, 2026
Regulated data
HIPAA environment, two-hour priority SLA
Research
IoT security, presented at Cloud Computing 2023 (IARIA)

02 · Numbers

By the numbers

Measured, not estimated. The tiles marked live are read from the platform's own monitoring every five minutes.

At work

7,800+

devices in the healthcare fleet I support, across 30+ sites

At work

160+

incidents and service requests resolved every month

At work

2h

priority SLA, in a HIPAA-regulated environment

Career

6+

years in enterprise, healthcare and education IT

Platform

430

Ansible tasks define every machine. Nothing is set up by hand.

Live

72

containers running right now, on three nodes

Platform

0

inbound ports open to the internet

Live

99.97%

7-day availability across 28 monitored services

03 · Platform

A small production environment, run like one.

Three machines in two locations serve my family's photos, media, passwords, documents and home automation. The Git repository is the source of truth. This page is served from it.

Everything is code, and the code is checked every night.

Seventeen Ansible roles and 430 tasks describe all three machines, from disk layout to application settings. A new machine becomes a working node by running a playbook.

  • Idempotent by design. Where an app keeps settings in its own database, a task applies them through its API, so a rebuild comes back configured.
  • Secrets stay encrypted. Ansible Vault holds every credential. Nothing sensitive has ever been committed in plain text.
  • Drift is an alert. At 02:15 every playbook runs in check mode. If any machine differs from the repository, I hear about it.
  • Disaster recovery is a script. One command rebuilds a dead node on new hardware from the repository and the latest backup.

control node · nightly drift check

$ ansible-playbook site.yml --check --diffPLAY RECAP *********************compute   ok=264  changed=0  failed=0 $ homelab-drift-checksite.yml      0 tasks would changepi.yml        0 tasks would changeoffsite.yml   0 tasks would change# in sync with main@latest

An alert that doesn't say what to do is just noise.

Prometheus, Grafana, Loki and Alertmanager watch every node and container. Synthetic probes test each service the way a browser would, through the proxy.

  • 34 alert rules, 32 runbooks. Every alert carries what broke, who it affects, numbered fix steps and a runbook. A rule without them doesn't merge.
  • One notification per incident. Alerts are grouped by root cause, so a rebooting server sends one message, not twenty.
  • Quiet during maintenance. The weekly patch window silences what it will cause, then reports anything still broken afterwards.
  • Watched from outside. A monitor at the second site catches what the house can't see about itself, such as an ISP outage.

alerts.yml · one of 34 rules

- alert: BackupStale
  expr: time() - homelab_backup_last_success_timestamp > 26 * 3600
  for: 10m
  labels:
    severity: critical
  annotations:
    summary: "The {{ $labels.repo }} backup hasn't succeeded in {{ $value | humanizeDuration }}"
    impact: "Changes since then aren't backed up offsite."
    runbook: backupstale
    action: |
      1. Read the backup log
      2. Fix what it names (most often a node was unreachable)
      3. Run the backup again

Nothing listens on the internet. Everything is checked twice.

The house has no open inbound ports. Public traffic arrives through an outbound-only tunnel, and anything private is reachable only over WireGuard.

  • Two layers of filtering. The edge applies location and network rules and rate limits logins. The reverse proxy then checks a ban list and a web application firewall (CrowdSec with the OWASP Core Rule Set).
  • Bans travel. An address banned at the proxy is blocked at the edge within minutes.
  • Images are scanned nightly. A new fixable critical vulnerability in a running image raises an alert.
  • Patching is unattended. Every Sunday at 01:00 all three nodes update one at a time, with a snapshot taken first as a rollback point.

edge and proxy · live

Inbound ports open
0
Requests inspected by the WAF, 30 days
–
Addresses on the ban list now
–
Certificates
ACME DNS-01 every hostname
Admin interfaces
VPN only

A backup you have never restored is a hope.

Every night restic writes encrypted, deduplicated backups to two repositories. Roughly 159 GB and 108,000 files are protected.

  • 3 copies, 2 sites. Live data, a repository on the control node, and a second repository at another address.
  • Offsite is append-only. A compromised server can add to the offsite history but can never delete it.
  • Restores are tested. A scheduled job restores a sample from each repository and opens the databases it finds.
  • Rollback in seconds. ZFS snapshots every six hours and before every update.
  • Power cuts are handled. A UPS shuts the nodes down cleanly, and any job missed while a node was off runs after boot.

backups · live

Last successful backup
– ago
Last restore test
– ago
Copies and sites
3 copies 2 sites
Offsite repository
append-only
Snapshots
6 h and before updates

Small changes, shipped often, written down.

The platform changes almost every day. Each change is a commit that is deployed by a playbook and described in the docs, so the next person to read it could be anyone.

  • 477 commits since September 2026. The repository holds the playbooks, 28 documents and about 40,000 words of runbooks and design notes.
  • Scheduled work is boring on purpose. Backups, scans, patching and restore tests are systemd timers that catch up after an outage.
  • Cost-aware scheduling. Heavy jobs run in off-peak electricity hours, read from the utility meter over the local network.
  • On the roadmap. A dedicated router with VLAN segmentation for IoT, guests and servers, and a storage node with mirrored disks.

operations · live

Changes shipped, last 30 days
–
Monitored services up
–
Configuration drift
– checked – ago
Last unattended patch run
– ago
Median response of probes
–
Read the code on GitHubTariqDaCoder/homelab-showcase

A cleaned copy of the repository is public: the playbooks, roles, alert rules and recovery scripts, with addresses and secrets removed.

04 · Field notes

Four problems, and what changed.

Short write-ups from the platform's own history. Each one starts with something that was wrong.

Firmware + data

The dehumidifier that started 17 times a night

Problem
The house meter showed a 390 W load switching on and off all night. The basement dehumidifier was short-cycling, because its humidity sensor sits in its own airflow and reads up to 20 points high once the fan stops.
Approach
I put the unit on an ESP32 running ESPHome, cut it off from the vendor's cloud, and replaced its built-in logic with one continuous run in off-peak hours that ends when a trustworthy reading says the room is dry.

17→1compressor starts a night4.7→0.23kWh a day

Alerting

One notification per incident

Problem
A single reboot produced a burst of alerts, and an alert that only says a service is down is homework at 2 AM, not help.
Approach
An incident engine groups alerts by root cause, waits out blips and stays quiet during the patch window. Every alert must ship with its impact, numbered fix steps and a runbook.

34alert rules32runbooks1message per incident

Postmortem

The sixth rule

What happened
Adding a sixth custom firewall rule at the edge exceeded the plan's limit of five. The provider then rejected every update to the ban list, so new bans stopped reaching the edge. The stale-sync alert waited three hours before firing.
What changed
The rules were merged back under the limit, the deploy now refuses any change that would exceed it, and the alert's wait dropped to 45 minutes. Nothing got through: the proxy's own firewall kept blocking.

3 h→45 mintime to detect0requests let through

Backups

Proving the backup

Problem
A backup that has never been restored might not work, and a compromised server can delete every backup it is able to reach.
Approach
Nightly backups go to two repositories. The offsite one is append-only, so the server can add history but not remove it. A scheduled job restores a sample from each and opens the databases.

3copies2sites0untested backups

05 · Experience

Experience

Six years of keeping other people's systems working, in a hospital network and a school.

07/2025 to nowEdina, Minnesota

Endpoint Engineer

HCL America, for a healthcare organization with 30+ sites

  • Deliver Tier 2 and 3 support across a 7,800+ device fleet in a HIPAA-regulated environment, under a two-hour priority SLA.
  • Manage accounts, groups and permissions across Active Directory and Microsoft Entra ID: user lifecycle, OU management, group-based access and application deployment.
  • Onboard devices and users remotely with Entra ID and Intune, including enrollment and Entra join.
  • Manage the device lifecycle with MECM/SCCM and Workspace ONE, from deployment through CMDB tracking to disposal.
  • Resolve 160+ incidents and service requests a month in ServiceNow, and write the SOPs and knowledge-base articles that stop them recurring.
  • Support enterprise applications including Imprivata SSO, Citrix and Ivanti VPN, plus Avaya IP phones and enterprise print. HP Certified technician.

08/2019 to 07/2025Minneapolis, Minnesota

IT Support Technician

Metro Schools College Prep

  • Administered Active Directory accounts and Group Policy for faculty and staff across the whole user lifecycle.
  • Managed 500+ Chromebooks and 40 Windows devices for students and non-technical staff.
  • Resolved Tier 2 tickets for hardware, software, network and account issues, and explained the fixes in plain terms to teachers and administrators.

Education

B.S. Computer Science

Metropolitan State University, 2026

A.S. Computer Science

Normandale Community College

Research

IoT security

Cross-industry IoT vulnerabilities and mitigations through encryption and access control. Presented at Cloud Computing 2023, the Fourteenth International Conference on Cloud Computing, GRIDs, and Virtualization (IARIA).

Credentials

HP Certified Technician

Hardware warranty repair

HIPAA regulated-data handling

Daily practice in a clinical environment

06 · Toolbox

Toolbox

What I use, and where I use it. No skill bars: a tool is listed because I run it, either in enterprise production at work or on my own platform every day.

Automation and IaC

AnsibleGitBashPythonDocker Composesystemd timersJinja2 and YAMLAnsible Vault

Platforms

Linux (Debian, Ubuntu)DockerZFS and LVMRaspberry Pi (ARM)ESPHome on ESP32Windows 10 and 11iOS, Android, ChromeOS

Observability

PrometheusGrafanaLokiAlertmanagerBlackbox probesUptime KumaPromQL

Networking and security

WireGuardCloudflare Tunnel, WAF and DNSCaddy reverse proxyCrowdSec and OWASP CRSTLS and ACMEDNS filteringTrivy image scanningIvanti VPN

Identity and endpoints

Microsoft Entra IDActive DirectoryGroup PolicyMicrosoft IntuneMECM / SCCMWorkspace ONEImprivata SSOCitrix

Reliability and data

resticZFS snapshotsRestore testingUPS and NUTPostgreSQL and SQLiteRunbooks and SOPs

Service management

ServiceNowConfluenceCMDBHIPAA data handlingBeyondTrust remote support

runs on my platform dailyenterprise production at workboth

07 · Contact

Hiring for DevOps or platform? Let's talk.

I'm in the Twin Cities and open to on-site, hybrid or remote roles. The form goes straight to my phone, and I reply within a day.

↑↓ moveEnter openEsc close