The eye watches what I run. Point at a tool on its inner orbit.
Stuck in production? I have an eye on it.
Inside the eye
Everything you are about to fly past is something I run or built.
100+ node clusters, three clouds
One control plane across AWS, GCP and Azure. When a region fails, its workloads move to the others.
Every change goes through the ring
test, hygiene, analyze, stage, approve. Nothing reaches main until all five pass.
$2M a year, switched off
Cost automation finds idle cloud resources and right-sizes the rest. Saved over $2M a year.
7,200 threads, history kept
A chat migration broke every thread. The repair kept every author and became Threadvault.
Read the chart
Three years of keeping production running. The closer you look, the finer the print.
20/200$2M SAVEDa year, by finding idle cloud resources and right-sizing the rest
20/10010K DEPLOYScanary releases with automated rollback, through GitOps
20/70100+ NODES · 3 CLOUDSone control plane across AWS, GCP and Azure, with automated failover
20/5060% FASTER DEPLOYS · 99.9% UPTIMECI/CD, Kubernetes workloads and observability at DataGrokr
20/4062 → 0 OPEN SECURITY ALERTSone triage pass on DNS Intelligence, every dismissal written down
20/207,200 THREADS · HISTORY KEPT · AUTHORS RESTOREDthe chat migration that became Threadvault
Aug 2025 to now
DevOps Engineer II Techdome
Multi-cloud Kubernetes, cloud cost automation and GitOps delivery for production workloads.
2023 to 2025
DevOps Engineer DataGrokr
CI/CD pipelines, Kubernetes workloads and observability. Cut deployment time by 60% and kept services at 99.9% uptime.
2019 to 2023
B.Tech, Computer Engineering CHARUSAT University
Aiming to master DevOps end to end, by running every tool in production myself: service mesh, SIEM, runtime detection, GitOps. The Kubernetes lab below is where that happens.
Works with Kubernetes, Terraform, Helm, Argo CD, Linkerd, GitHub Actions, Prometheus, Grafana, Elasticsearch and Kibana, Falco, CrowdSec, Sealed Secrets, Trivy, Semgrep, CodeQL, OWASP ZAP, Ansible, Vault, Traefik, Cloudflare, OpenTelemetry and n8n, on AWS, GCP, Azure and Oracle Cloud, in Python, TypeScript and Bash.
Under the lens
Every tool here started as a real problem. Look closely; the screenshots are the real thing.
A chat migration broke 7,200 threads. The repair became an open-source CLI.
The move A resource move replayed 7,200 Azure Communication Services chat threads onto a new resource, with participants turned off.
The damage 7,022 messages showed the wrong author, and every thread rejected replies with CommunicationError Forbidden.
The repair Both defects were fixable only because the extract had kept each message's original sender and every participant list.
The tool I wrote the post-mortem, then turned the repair into Threadvault: an open-source CLI that finds these failures before a migration does. npm installs last month.
An SPF record that needs more than 10 DNS lookups fails, and nested includes hide the real count.
A domain scanner with 26 checks across DNS, TLS, security headers, DNSSEC, email authentication and reputation. It counts SPF lookups through every nested include, the way mail servers do.
Free for one domain. Pro and Team plans, from $5 a month, add monitoring, alerts on certificate, SPF, DMARC, MX and nameserver changes, and automatic DMARC report collection.
AWS bills automatically for running old versions. EKS extended support alone is about $365 a month per cluster.
A read-only CLI that scans every region for EKS, RDS, ElastiCache, OpenSearch, MSK and Lambda versions at or near end of support, with the AWS source for every date. npm installs last month.
npx retirement-radar scan
Or let it run for you: Radar Cloud connects through a read-only role and scans every account on a schedule (weekly free, daily on paid), with email and Slack alerts and the monthly cost of each finding.
A backup job that says "success" proves nothing. You only learn the file is empty, stale or corrupt on the day you need it.
Every six hours it pulls the newest offsite backup of each database, restores it into a throwaway copy (SQLite, or a PostgreSQL server it starts for the test), checks integrity, row counts and freshness, then destroys the copy. It alerts by Slack, Discord or email when a drill starts failing.
It drills the DNS Intelligence, Radar Cloud and Analytics databases today, and its evidence page is public.
A guessed ledger misstates the books, and the error surfaces months later inside Tally.
Turns HDFC bank statements into Tally ERP 9 vouchers for five family books. Every run must tie to the bank's own totals, and it never guesses. Private; Python and FastAPI.
npx threadvault doctornpm
The candidate-set rule
1 ledger fitspost it
0 fitdefault or Suspense
2 or more fitblock the whole run
Point it at your domain
This runs the real DNS Intelligence API: SPF lookups counted through every include, the DMARC policy, and how long the certificate has left.
Six services on one server I pay for, held to the bar I keep at work: watched from outside, backed up offsite, and every backup restored and checked every six hours. The numbers below are live.
GitHubCI on every PR; Actions checks Status every 10 min from outside
Staging VMa second Oracle VM: every server change lands here first (Ansible)
then live
Visitors reach every HetOps hostname over HTTPS through Cloudflare DNS, all on one Oracle Cloud VM run by Coolify. Each database is backed up daily to Cloudflare R2, Restore Drill restores those backups with a read-only key every six hours, Uptime Kuma probes every service every minute, and a GitHub Actions watchdog checks the status page every ten minutes from outside. A second Oracle VM is staging: Ansible applies every server change and Kubernetes upgrade there first, and only then to the live server.
How I ship
The same bar for side projects as for production. Nothing reaches main until the ring closes, and nothing reaches npm until I approve it with 2FA.
main
testNode 20, 22 and 24, plus a real run of the built artifact
hygieneworkflow audit, secret scan, signed and conventional commits
analyzeCodeQL security and quality queries
stagenpm publish staged from CI, with provenance
approvea human, with a second factor
Signed, protected main
Signed commits, linear history, required checks and no force-push on every repository.
feat(spf): count DNS lookups through nested includes
fix(security): block IPv4-mapped IPv6 in every written form
fix(auth): never build sign-in links from request headers
Careful dependencies
Dependabot waits 7 days before proposing a release, every Action is pinned to a commit, and new dependencies are reviewed for advisories and licences.
Least privilege
Read-only by design where possible, enforced by tests. Credentials hashed at rest. Releases need no stored token.
Argo CD makes git the only way in. Delete a deployment by hand and it is recreated from git within a minute.
SLO
99% of visits must succeed over any 7 days. When the error budget is spent, experiments freeze until it recovers.
mTLS
Linkerd encrypts every hop from the ingress to the database. Postgres accepts four named identities only: a pod that passed the network rules was still refused.
Logs
Every request, from ingress to database, lands in Elasticsearch on one timeline.
Audit
The Kubernetes audit log records who did what. A shell opened in a pod raises an alert mapped to MITRE ATT&CK.
Runtime
Falco watches system calls on the node and reports what actually ran inside a container, down to the command.
Edge
CrowdSec spots scanners in the access logs, and their IP is blocked at Cloudflare’s edge within two minutes.
Images
Every running image is scanned weekly. The first scan found 75 high and critical CVEs; today it finds none.
Changes
All of it lands in one feed: every deploy, scale, sync, experiment and alert. When an alert fires, the Change Timeline lists the changes just before it; a killed pod shows up 0.2 seconds after the click.
From people I've worked with
“What sets Het apart is their ability to accelerate deployments while simultaneously strengthening security measures.”
Combined across github.com/Het101 and github.com/Hetu29.
Shipped recently
Radar CloudDeadline Radar: certificates that will not renew, Reserved Instances, Savings Plans and domains with auto-renew off now sit on the same radar as old versions.
Radar CloudDashboard rebuilt around the deadline radar: what each account costs, the radar centre stage, and every finding one click from its blip.
Restore Drill0.3.0: alerts by Slack, Discord, webhook or email when a drill fails, recovers, or stays broken. Results are live on this page.
Restore Drill0.2.0: PostgreSQL dumps restored into a throwaway server started inside the agent, no Docker socket needed.
Restore DrillLive at drill.hetops.dev and open source: every few hours the newest offsite backup of DNS Intelligence and Radar Cloud is restored into a throwaway copy and checked.
Radar CloudLive at radar.hetops.dev: scheduled scans through a read-only IAM role, alerts by email and Slack, Free, Pro and Team plans.
Retirement Radar0.3.0: ElastiCache, OpenSearch and MSK; every date re-checked against AWS.
DNSSPF lookups counted through nested includes, a public SPF checker, and alerts when a domain crosses the limit.
DNSSecurity pass: 62 code-scanning alerts to 0, SSRF checks on every outbound hop, credentials hashed at rest.
DNSPaid Pro and Team plans: monitoring, alerts and automatic DMARC report collection.
Retirement RadarFirst release on npm, then a staged, provenance-signed release pipeline.
