SudoShea ⚡

Hands-on engineering lab repository, Ansible automation playbooks, and topology definitions for mastering Red Hat Certified System Administrator (EX200 on RHEL 10) and Juniper Networks Certified Associate Junos (JN0-106) tracks.

Ansible-driven IaC stack deploying systemd-native Podman Quadlets (Pi-hole v6 native HTTPS, Unbound recursive DNS, Vector, Loki, Grafana) with multi-OS support (Debian/RHEL), automated backup verification, and automated weekly systemd host/container maintenance.

Automated Linux security baseline enforcement role applying CIS Benchmark Level 1/2 controls across SSH, sysctl kernel parameters, auditd, shadow permissions, and dynamic firewall rules.

Non-destructive Python security suite featuring a unified CLI (audit.py), live OpenSSH evaluation (sshd -T), Podman container risk inspection, systemd journald SSH threat parsing, and report drift detection.

Automated Ansible role deploying Restic AES-256 client-side encrypted backups, retention pruning, offsite Rclone cloud sync, and automated weekly sandbox restore verification timers.

Ansible orchestration playbook executing zero-downtime rolling reboots across dual DNS nodes (pihole-primary & pihole-secondary) with pre-reboot peer health checks, reboot flag detection, and post-reboot container/resolution validation.

• Strategy: serial: 1 rolling execution with peer dig validation
• Validation: Automated Podman container readiness & local 127.0.0.1 DNS checks

Headless GNS3 server environment running on RHEL via Python with native KVM/libvirt acceleration, SELinux capability policies (ubridge), and systemd user services for virtualising Junos (vSRX) and Linux lab nodes.

• Engine: Python gns3server daemon + systemd user service
• Acceleration: KVM/libvirt + setcap for non-root ubridge

Standalone Ansible maintenance role deploying automated weekly user-scoped systemd timers for Podman image pruning, journal log vacuuming, cross-distro package cleanup, Pi-hole FTL SQLite vacuuming via podman unshare, and reboot auditing.

• Timer: homelab-maintenance.timer (Weekly Sun 04:00 AM)
• Execution: Rolling serial: 1 zero-downtime execution

Scheduled weekly systemd timer running automated Restic 10% data subset integrity checks and sandboxed restores into isolated /tmp environments with automated cleanup.

• Timer: restic-verify.timer (Weekly)
• Script: /usr/local/bin/test-restore.sh

Migrated container definitions to systemd-native Podman Quadlets (.container unit files) managed via Ansible for integrated service lifecycle management.

• Engine: Podman Quadlet + systemd
• Scope: Native user-scoped unit auto-reloads

Implemented automated CIS Level 1/2 compliance controls across Debian and RHEL node targets inside ansible-system-hardening.

• Scope: Kernel sysctl, SSH drop-ins, auditd, PAM
• Validation: Verified via linux-security-auditor

Integrated Nebula Sync for real-time automated gravity, adlist, and local DNS record replication between primary and secondary Pi-hole v6 instances.

• Engine: Nebula Sync container
• Scope: High-availability Pi-hole v6 cluster sync

Deployment of a lightweight Vector log collector, Loki indexing engine, and Grafana UI container stack over HTTPS to visualise systemd and container logs.

• Pipeline: Vector → Loki → Grafana HTTPS
• Scope: Real-time journald & container log aggregation

Private Root Certificate Authority (CA) workflow, Civetweb unencrypted key formatting, and annual automated TLS certificate renewal scripting without external reverse proxies.

• Protocol: Local Root CA + SAN extensions
• Automation: Annual renewal & container reload cron

Operational playbook defining local network layout, recursive DNS chaining via Pi-hole & Unbound, and verified cold-boot disaster restore steps.

• RTO Target: < 15 min core recovery
• Scope: Multi-OS DNS failover & route recovery

GitHub Actions workflows enforcing automated static code analysis across Python (Flake8), Shell (ShellCheck), Ansible (ansible-lint), and HTML (HTMLHint).

Architecting an automated Vault instance with Podman Quadlets to centralise SSH keys, API tokens, and Ansible secrets with transit auto-unseal capabilities.

Developing automated libvirt/qemu provisioning playbooks and Red Hat Kickstart (.ks) profiles for headless deployment of RHEL 10 lab nodes.

Expanding centralised observability stack with Node Exporter and cAdvisor metric collectors piped into Prometheus for system performance and container resource tracking.

Engineering real-time notification rules in Grafana and Vector to trigger instant push alerts (via Webhooks/Telegram) if primary DNS drops offline or backup verification fails.