████████╗███████╗
╚══██╔══╝██╔════╝
██║ █████╗
██║ ██╔══╝
██║ ██║
╚═╝ ╚═╝
~/tommyscode.dev
tommy@tommyscode — full-stack · infra · devops
------------------------------------
role
Full-Stack Developer & Infrastructure Engineer
uptime
8+ yrs · Moss Bros. Auto Group (2018–present)
owns
infrastructure, network & security — end to end
app
100+ module platform, built with the dev team
building
GitOps Kubernetes platform
stack
Laravel · PHP 8.4 · K8s · Terraform · Rust
focus
security-forward · GitOps · AI-assisted delivery
tommy@tommyscode ❯ whoami
Full-stack developer and infrastructure engineer on a small team. I own the infrastructure, networking, and security end to end — every server, boundary, and backup path — and build across the application alongside the other devs. Over 8+ years that's grown into a 100+ module platform: inventory, service, sales, finance, HR, reporting. Now leading a ground-up rebuild on Laravel + Kubernetes, with AI in the loop.
tommy@tommyscode ❯ skills
languages
PHPJavaScriptPythonRustSQLBash
backend
LaravelOctaneLivewireFilamentKeycloakGearman
platform / k8s
KubernetesArgo CDHelmKustomizeCiliumKEDA
iac & ci/cd
TerraformAnsibleDockerGitHub ActionsGitOps
security
Kyverno+cosignInfisicalTailscaledefault-deny netpolSSO / LDAP
observability
Prometheus / GrafanaLokiTempoOpenTelemetryUptime KumaSentrystandby-DB DR
data
PostgreSQL+pgvectorMySQL/MariaDBValkey/Redis
ai / llm
LiteLLMClaude CodeAI-assisted review
testing
PHPUnit / PestPHPStanPintTDD
tommy@tommyscode ❯ ls -l projects/
gitops-platform/in buildgreenfield GitOps platform on Kubernetes
cat gitops-platform/README.md
- problem
- An 8-year-old, in-house enterprise PHP app (100+ modules) needed a modern, secure, scalable foundation — with no existing platform to build on.
- approach
- Architected and shipped a greenfield GitOps platform on managed Kubernetes, end to end: Terraform-provisioned HA clusters, an Argo CD app-of-apps delivering a hardened default-deny addon stack, and a supply-chain trust chain (build → scan → cosign-sign → Kyverno admission). The app runs on top as role-based workloads.
- stack
- KubernetesArgo CDHelmKustomizeCiliumTerraformKyvernocosignKEDAInfisicalPostgres+pgvector
- impact
- Root-caused subtle production incidents and turned each into a durable runbook. Security-forward defaults throughout — least privilege, fail-closed admission, secrets never in Git.
auth-hardening/liveRedis-backed OIDC token lifecycle + hardening
cat auth-hardening/README.md
- problem
- A production post-2FA login loop — users bounced back to login after authenticating — traced to OAuth state being clobbered by concurrent /login requests.
- approach
- Built a Redis-backed OIDC token-lifecycle layer: a per-request state store, single-flight silent token refresh (one refresh per session; losers reuse the winner's token), and explicit fail-open / fail-closed grace rules.
- hardening
- Cached JWKS keys with re-fetch-on-signature-failure to survive IdP key rotation — then closed the DoS that opened (an unauthenticated forged-JWT flood triggering unthrottled key re-fetches) with an atomic per-realm throttle that overwrites rather than deletes the cache.
- stack
- PHPKeycloak / OIDCRedisJWT / JWKSPHPUnit
- signals
- Threat-modeled the full auth path; distributed-systems reasoning (lock TTLs, cache-stampede avoidance, rotate-then-persist ordering); shipped test-covered as focused hotfixes.
price-guardrail/liveblocks over-advertised contract prices
cat price-guardrail/README.md
- problem
- Desk managers could write a used-vehicle contract price above the vehicle's live advertised price — a pricing-compliance risk with no automated guard.
- approach
- At deal-save time, scrape the vehicle's live advertised price by VIN (Guzzle + JSON-LD), validate the contract price, persist a point-in-time snapshot, and link each deal to the snapshot it was checked against; a weekly report flags any sold-above-advertised deals.
- hardening
- A wall-clock scrape-timeout budget so a slow site can't pin PHP-FPM workers; a synchronous→async save-path refactor so the desk's browser never freezes; cross-schema foreign-key integrity guards.
- stack
- PHPEloquent (multi-DB)GuzzleJSON-LDPHPUnit
- signals
- TDD throughout; each change run through an adversarial code-review loop; shipped as focused hotfix PRs.
srvctllivecustom fleet-administration CLI in Rust
cat srvctl/README.md
- problem
- Repetitive, error-prone server administration across a whole fleet.
- approach
- A custom server-management CLI in Rust — firewall (iptables/ipset) rules, Fail2ban, database backups, disk monitoring, and general admin across the fleet.
- stack
- RustLinuxiptables / ipsetFail2ban
- impact
- Centralizes fleet ops into one tool; actively extended (backups, disk-space monitoring, storage syncing, mail cutover).
ai-gateway/livecentral LLM gateway — keys, teams, audit
cat ai-gateway/README.md
- problem
- LLM API keys were scattered across the dev team, with no single place to manage team access or audit usage.
- approach
- Stood up a LiteLLM gateway as one control point for the dev team — a single home for API keys and team-based access across Anthropic (Claude) and OpenAI, with per-team usage and an audit trail on tap if it's ever needed.
- stack
- LiteLLMAnthropic / OpenAI APIsDockerDigitalOcean
data-import/liveidempotent SFTP → DB import pipeline
cat data-import/README.md
- problem
- Large vendor report files must land in the app database automatically and idempotently.
- approach
- An automated SFTP-based import system processing vendor report files into the database via background job queues — safe to re-run without duplicating data.
- stack
- SFTPGearmanPHPMySQL/MariaDB
tommy@tommyscode ❯ approach
- verify, don't assume — tools and APIs change, so I confirm how something actually works today before relying on it.
- spec → plan → implement → live-verify, with a decision log.
- TDD by default — red → green → refactor; a bug gets a failing test first.
- adversarial code review on every change before it ships.
- behavior-preserving legacy refactors — extract typed services and data objects out of overgrown classes, guarded by integration tests and shipped incrementally.
- security-forward defaults — least privilege, fail-closed, secrets never in Git.
tommy@tommyscode ❯ ls downloads/
tommy-fetterleigh-resume.pdf — résumé · PDF