Skip to content
EK

Search Posts

/ or to open • ↑↓ to navigate • ↵ to select • ESC to close
system boot
[ 0.000] ✓ Initializing eddykawira.com...

[ 0.124] ✓ Loading profile: Eddy Kawira

[ 0.256] ✓ Role: Infrastructure Engineer & AI Systems Architect | IT since 2003
[ 0.389] ✓ Specialization: Cloud Infrastructure, Homelab, AI Systems
[ 0.512] ✓ Experience: 20+ years across technical sales, IT services, and infrastructure
[ 0.645] → System ready. All services operational.
📚 View Blog 📄 Resume ⚡ Projects
SYSTEM INFORMATION
OPERATOR Eddy Kawira
PREVIOUS_ROLES Rack Power-Up Technician · AWS · Jul 2025 – Aug 2026
EXPERIENCE 20+ years
FOCUS_AREAS Cloud Infrastructure · Observability · AI-Ready Systems
CERTIFICATIONS ITIL Foundations · FAA Remote Pilot
HOMELAB Hyper-V / Proxmox VE · 8 Cores · 64 GB RAM

IT professional since 2003: on-prem infrastructure first, cloud for the last 10 years, and now architecting AI systems and autonomous agents. Focused on reliability, deterministic tooling, and high-throughput execution.

RUNNING SERVICES
AdGuard Home Sync PRODUCTION

Real-time DNS sync monitoring · 288 syncs/day · 99.9% uptime

DNS Bench ACTIVE

CLI + Web DNS benchmarking tool · Real-time metrics

Bytecore Agent AI

Modular AI agent runtime · Multi-platform deployment

Homelab Infrastructure SINGLE NODE

Hyper-V · Proxmox VE · Cloudflare Tunnel

View All Projects →

Homelab Infrastructure

Latest Posts

SLOT-0683
2U
AI INFRASTRUCTURE · MCP GEMINI MCP GATEWAY FOR PROXMOX VE Streamable HTTP Transport · OAuth 2.0 Ingress · Zero Inbound Router Ports · Hypervisor DMZ Microsegmentation 1. GOOGLE GEMINI Gemini Pro / Flash • Connected Workspace App • Streamable HTTP Client • SSE Stream Listener Authentication Layer • OAuth 2.0 RFC 6749 • Bearer Token Ingress • Scopes: read:telemetry • exec:ephemeral_lxc Protocol Format • JSON-RPC 2.0 Payload POST /mcp HTTP/1.1 Authorization: Bearer *** Content-Type: app/json 2. CLOUDFLARE EDGE Edge WAF & Shield • DDoS Absorption (Anycast) • Rate Limit: 60 req/min • TLS 1.3 Termination Cloudflare Tunnel • Outbound-Only QUIC/TCP • Inbound Router Ports = 0 • Edge Domain: mcp.example • Identity Header Injection Tunnel Daemon • cloudflared (CT 100) Ingress Rule: service: http://10.0.10.25 path: /mcp (Streamable) 3. MCP GATEWAY Fastify TypeScript Service • DMZ Host: 10.0.10.25:3000 • MCP Spec: 2024-11-05 • SSE Stream + POST /mcp Security & Invariants • Strict Zod Schema Parse • Zero-Leakage Masker • Safe Resource Scrubbing • Deterministic Error Trap Tool Dispatch Catalog • proxmox_cluster_status • proxmox_list_telemetry • proxmox_exec_ephemeral • pbs_datastore_metrics 4. PROXMOX VE CLUSTER Hypervisor REST Engine • HTTPS API: :8006/api2/json • Auth: PVEAPIToken=*** • mTLS & Internal SSL Least-Privilege Security • Role: PVEAuditor (Read-Only) • Ephemeral Operator ACLs • Hypervisor Root Protection • Zero Direct Public Exposure Target Workloads • DMZ Network (vmbr1) • Ephemeral Dev LXC Workloads • QEMU Guest Agent Signals • PBS Instant Snapshot Check PRODUCTION MCP GATEWAY SPECIFICATION & TELEMETRY MATRIX Protocol: Model Context Protocol (2024-11-05) Transport: Streamable HTTP + SSE · JSON-RPC 2.0 Validation: Zod Strict Input/Output Parsing Inbound WAN Ports: Strictly 0 (Zero Open Ports) Ingress Auth: OAuth 2.0 / Bearer Handshake Sanitization: 7-Layer Zero-Leakage Privacy Guard LIVE MEASURED TELEMETRY Telemetry Query Latency: ~42ms Fastify JSON-RPC Over SSE Stream
AI Development

Build an enterprise-grade Gemini Spark Connector for Proxmox VE using Model Context Protocol (MCP) Streamable HTTP, OAuth 2.0 / OIDC,...

15 min
SLOT-0651
2U
ZERO-TRUST HOMELAB ARCHITECTURE Zero Inbound Router Ports · Cloudflare Tunnels · Tailscale WireGuard Mesh · DMZ Microsegmentation PUBLIC / APP INGRESS Public Web Visitors HTTPS over Standard Web Cloudflare Edge • DDoS Mitigation & Anycast • Web Application Firewall (WAF) • Cloudflare Access (MFA / SSO) • Edge TLS Termination • Identity Header Injection Outbound QUIC Tunnel Zero Open Inbound Ports Port 7844/UDP Outbound Only WAN BOUNDARY 0 PORTS FORWARDED HOMELAB HYPERVISOR & MICROSEGMENTED DMZ Private Sysadmin Mesh (Tailscale WireGuard) • Point-to-point WireGuard mesh with ACL tag:admin · Zero public internet exposure • Access: Proxmox Web UI (:8006) · PBS (:8007) · SSH (:22 Key-Auth Only) Isolated DMZ Bridge (vmbr1 · 10.0.10.0/24) Egress Rule: FORWARD -i vmbr1 -d 192.168.1.0/24 -j DROP (Blocks lateral traversal to LAN) CT 100: cf-tunnel IP: 10.0.10.2 (cloudflared) Terminates QUIC tunnel Internal reverse proxy CT 101: app.example.com IP: 10.0.10.10 (Nginx/PHP) Listens on LAN IP only Zero direct WAN ingress CT 102: client.example.com IP: 10.0.10.11 (Production) Cloudflare WAF Protected CT 103: internal.example.com IP: 10.0.10.50 (:8080) Cloudflare Access MFA Gated
DevOps

For years, the standard advice for homelab enthusiasts and self-hosters wanting remote access to their servers was shockingly reckless: open...

17 min
LIVE
CPU:
MEM: