High-Concurrency Remittance Infrastructure with Audit Controls
Real-time remittance core on CIS-hardened Debian with Fastify, PostgreSQL, and centralized audit logging.
Miguel Lozano - Cloud & DevSecOps Engineer
I harden infrastructure
and cut its cloud cost.
Linux hardening, perimeter WAF (Caddy and Coraza) and cloud cost review for teams that run their own production. I publish what I build and how I decided it. Metrics appear only when records support them.
Case Studies
View All →
Self-Hosted Stack for a Digital Agency
Consolidation of fragmented SaaS subscriptions into a self-hosted open-source stack featuring pull-based Portainer management and perimeter defense via Caddy with Coraza WAF.
Cloud Exit from AWS to Bare Metal
Infrastructure migration from AWS to self-hosted bare metal using K3s, NIST 800-53 control selection, and transition to fixed hosting costs.
Cost Control for a Third-Party API: Cache Layer and WAF
Cache-aside layer using Valkey, perimeter WAF with Caddy and Coraza, and rate limiting to control third-party API costs.
Projects
View All →
Caddy WAF UI
Go 1.27.3 native sidecar UI for caddy-waf: per-site WAF mode toggle, CRS exclusions, IP rules, and snapshot rollback without modifying the base Caddyfile.
Developmi Hardened
Layered Ansible infrastructure baseline for Debian 12 and Ubuntu: NIST 800-53 compliance, Tailscale zero trust, and containerized runtime application bundles.
Multitenant ELT: Self-Hosted Data Pipeline for Small Agencies
Self-hosted data pipeline for small agencies serving multiple clients, with tenant isolation across PostgreSQL schemas and Docker networks using dlt and dbt.
Caddy and Coraza WAF Integration
Caddy v2.11.7 with Coraza WAF v2.6.2 and OWASP CRS v4.30: Cosign-signed images, Trivy scanning, SLSA provenance, and non-root execution for edge proxy security.
Latest Articles
Read Articles →Sep 21, 2026
Zero-Trust CI/CD: Securing Pipelines with Ephemeral OIDC
A DevSecOps guide to securing CI/CD pipelines: eliminate static IAM secrets by implementing ephemeral OpenID Connect tokens and strict claim validation.
Sep 18, 2026
etcd Fsync Latency: Preventing Kubernetes Cluster Freezes
An SRE deep dive into Raft consensus failure modes: how WAL fsync latency causes leader elections, lease expiration storms, and control plane paralysis.
Sep 16, 2026
S3 Object Storage Repatriation: Petabyte Cloud Economics
FinOps audit of AWS S3 at scale: API request fees, egress costs, EU Data Act leverage, and achieving 80% TCO reduction with sovereign MinIO or Ceph clusters.
Sep 14, 2026
eBPF Runtime Security: In-Kernel Tetragon vs Falco Alerting
DevSecOps comparison of eBPF kernel enforcement via Tetragon versus user-space alerting with Falco: preventing TOCTOU attacks and optimizing CPU overhead.
How I Engineer
Non-negotiable axioms that guide every decision.
Engineering is the Reduction of Uncertainty
The best engineering does not accumulate technology. It eliminates risks, removes unnecessary complexity, and returns control to the organization.
Boring Technology Wins
If a technology is not proven and you cannot read its logs under pressure, it does not enter production. Complexity is the fetish of the mediocre.
Capital Efficiency is an Engineering Metric
Every dollar wasted on unused cloud resources is a direct result of poor technical decisions. Financial inefficiency is a technical defect.
Have a specific infrastructure problem? Let's talk.