SudoShea ⚡

Ansible-driven IaC stack deploying rootless Podman containers (Pi-hole v6 native HTTPS, Unbound recursive DNS, Vector, Loki, Grafana) with multi-OS support (Debian/RHEL), 3-2-1 AES-256 encrypted backups, and automated host security patching.

Automated Linux security baseline enforcement implementing SSH hardening, PAM rules, firewall rules, and kernel sysctl tuning.

POSIX-compliant Shell script framework for lightweight, zero-dependency host security hardening and lockdown.

Python security audit tool featuring real-time SSH threat monitoring daemon and automated compliance inspection routines.

Integrated Nebula Sync for real-time automated gravity, adlist, and local DNS record replication between primary and secondary Pi-hole v6 instances.

• Engine: Nebula Sync container
• Scope: High-availability Pi-hole v6 cluster sync

Deployment of a lightweight Vector log collector, Loki indexing engine, and Grafana UI container stack over HTTPS to visualize systemd and container logs.

• Pipeline: Vector → Loki → Grafana HTTPS
• Scope: Real-time journald & container log aggregation

Private Root Certificate Authority (CA) workflow, Civetweb unencrypted key formatting, and annual automated TLS certificate renewal scripting without external reverse proxies.

• Protocol: Local Root CA + SAN extensions
• Automation: Annual renewal & container reload cron

Operational playbook defining local network layout, recursive DNS chaining via Pi-hole & Unbound, and verified cold-boot disaster restore steps.

• RTO Target: < 15 min core recovery
• Scope: Multi-OS DNS failover & route recovery

Client-side AES-256 GPG snapshot automation, automated weekly dry-run restore tests, and 3-2-1 offsite cloud replication runbook.

• Schedule: Daily 02:00 AM (7-day rolling)
• Integrity: Weekly automated restore test

Lightweight Python log monitoring daemon integrated into linux-security-auditor parsing auth logs in real time to trigger alert hooks.

GitHub Actions workflows enforcing automated static code analysis across Python (Flake8), Shell (ShellCheck), Ansible (ansible-lint), and HTML (HTMLHint).

Migrating container definitions to systemd-native Podman Quadlets (`.container` files) managed via Ansible roles for deeper systemd service integration.

Automated auditing role validating host OS configurations against CIS (Center for Internet Security) benchmarks for Debian and RHEL node targets.

Self-hosted Headscale control plane to orchestrate a private, secure WireGuard mesh network connecting remote devices and homelab nodes.

Telemetry stack deploying Node Exporter and cAdvisor metrics collectors piped into Prometheus and visualised via custom Grafana dashboards.

Integrating Mozilla SOPS and HashiCorp Vault workflows into Ansible automation for secure, age-encrypted credential handling in public repositories.

Implementing automated Ansible Molecule testing pipelines utilising Podman drivers to validate role idempotency and task execution in CI.