Skip to content
EK

Search Posts

/ or to open • ↑↓ to navigate • ↵ to select • ESC to close
system boot
[ 0.000] ✓ Initializing eddykawira.com...

[ 0.124] ✓ Loading profile: Eddy Kawira

[ 0.256] ✓ Role: Infrastructure Deployment @ AWS | AI Tooling & Automation Specialist
[ 0.389] ✓ Specialization: Cloud Infrastructure, Homelab, AI Systems
[ 0.512] ✓ Experience: 20+ years across technical sales, IT services, and infrastructure
[ 0.645] → System ready. All services operational.
📚 View Blog 📄 Resume ⚡ Projects
SYSTEM INFORMATION
OPERATOR Eddy Kawira
CURRENT_ROLES DCEO @ AWS
EXPERIENCE 20+ years
FOCUS_AREAS Cloud Infrastructure · Observability · AI-Ready Systems
CERTIFICATIONS ITIL Foundations · FAA Remote Pilot · AWS Cloud Practitioner (in progress)
HOMELAB Hyper-V / Proxmox VE · 8 Cores · 64 GB RAM

I design and run scalable systems, obsess over observability, and keep a battle-tested homelab to prototype ideas fast. Current focus: AI-ready infrastructure and safe automation at scale.

RUNNING SERVICES
AdGuard Home Sync PRODUCTION

Real-time DNS sync monitoring · 288 syncs/day · 99.9% uptime

DNS Bench ACTIVE

CLI + Web DNS benchmarking tool · Real-time metrics

Bytecore Agent AI

Modular AI agent runtime · Multi-platform deployment

Homelab Infrastructure SINGLE NODE

Hyper-V · Proxmox VE · Cloudflare Tunnel

View All Projects →

Homelab Infrastructure

Latest Posts

SLOT-0683
2U
AI INFRASTRUCTURE · MCP GEMINI MCP GATEWAY FOR PROXMOX VE Streamable HTTP Transport · OAuth 2.0 Ingress · Zero Inbound Router Ports · Hypervisor DMZ Microsegmentation 1. GOOGLE GEMINI Gemini Pro / Flash • Connected Workspace App • Streamable HTTP Client • SSE Stream Listener Authentication Layer • OAuth 2.0 RFC 6749 • Bearer Token Ingress • Scopes: read:telemetry • exec:ephemeral_lxc Protocol Format • JSON-RPC 2.0 Payload POST /mcp HTTP/1.1 Authorization: Bearer *** Content-Type: app/json 2. CLOUDFLARE EDGE Edge WAF & Shield • DDoS Absorption (Anycast) • Rate Limit: 60 req/min • TLS 1.3 Termination Cloudflare Tunnel • Outbound-Only QUIC/TCP • Inbound Router Ports = 0 • Edge Domain: mcp.example • Identity Header Injection Tunnel Daemon • cloudflared (CT 100) Ingress Rule: service: http://10.0.10.25 path: /mcp (Streamable) 3. MCP GATEWAY Fastify TypeScript Service • DMZ Host: 10.0.10.25:3000 • MCP Spec: 2024-11-05 • SSE Stream + POST /mcp Security & Invariants • Strict Zod Schema Parse • Zero-Leakage Masker • Safe Resource Scrubbing • Deterministic Error Trap Tool Dispatch Catalog • proxmox_cluster_status • proxmox_list_telemetry • proxmox_exec_ephemeral • pbs_datastore_metrics 4. PROXMOX VE CLUSTER Hypervisor REST Engine • HTTPS API: :8006/api2/json • Auth: PVEAPIToken=*** • mTLS & Internal SSL Least-Privilege Security • Role: PVEAuditor (Read-Only) • Ephemeral Operator ACLs • Hypervisor Root Protection • Zero Direct Public Exposure Target Workloads • DMZ Network (vmbr1) • Ephemeral Dev LXC Workloads • QEMU Guest Agent Signals • PBS Instant Snapshot Check PRODUCTION MCP GATEWAY SPECIFICATION & TELEMETRY MATRIX Protocol: Model Context Protocol (2024-11-05) Transport: Streamable HTTP + SSE · JSON-RPC 2.0 Validation: Zod Strict Input/Output Parsing Inbound WAN Ports: Strictly 0 (Zero Open Ports) Ingress Auth: OAuth 2.0 / Bearer Handshake Sanitization: 7-Layer Zero-Leakage Privacy Guard LIVE MEASURED TELEMETRY Telemetry Query Latency: ~42ms Fastify JSON-RPC Over SSE Stream
AI Development

Build an enterprise-grade Gemini Spark Connector for Proxmox VE using Model Context Protocol (MCP) Streamable HTTP, OAuth 2.0 / OIDC,...

14 min
SLOT-0651
2U
ZERO-TRUST HOMELAB ARCHITECTURE Zero Inbound Router Ports · Cloudflare Tunnels · Tailscale WireGuard Mesh · DMZ Microsegmentation PUBLIC / APP INGRESS Public Web Visitors HTTPS over Standard Web Cloudflare Edge • DDoS Mitigation & Anycast • Web Application Firewall (WAF) • Cloudflare Access (MFA / SSO) • Edge TLS Termination • Identity Header Injection Outbound QUIC Tunnel Zero Open Inbound Ports Port 7844/UDP Outbound Only WAN BOUNDARY 0 PORTS FORWARDED HOMELAB HYPERVISOR & MICROSEGMENTED DMZ Private Sysadmin Mesh (Tailscale WireGuard) • Point-to-point WireGuard mesh with ACL tag:admin · Zero public internet exposure • Access: Proxmox Web UI (:8006) · PBS (:8007) · SSH (:22 Key-Auth Only) Isolated DMZ Bridge (vmbr1 · 10.0.10.0/24) Egress Rule: FORWARD -i vmbr1 -d 192.168.1.0/24 -j DROP (Blocks lateral traversal to LAN) CT 100: cf-tunnel IP: 10.0.10.2 (cloudflared) Terminates QUIC tunnel Internal reverse proxy CT 101: app.example.com IP: 10.0.10.10 (Nginx/PHP) Listens on LAN IP only Zero direct WAN ingress CT 102: client.example.com IP: 10.0.10.11 (Production) Cloudflare WAF Protected CT 103: internal.example.com IP: 10.0.10.50 (:8080) Cloudflare Access MFA Gated
DevOps

For years, the standard advice for homelab enthusiasts and self-hosters wanting remote access to their servers was shockingly reckless: open...

17 min
SLOT-0647
2U
PROXMOX VE / PBS FIXING "OS ERROR 28: NO SPACE LEFT ON DEVICE" Linux Kernel ENOSPC Diagnostic Triage · LVM-Thin Metadata · Advanced Mode Rootfs Override task-viewer : pct restore 101 # Executing restore from PBS datastore... pct restore 101 pbs:backup/ct/101/snapshot allocating local-lvm:vm-101-disk-0 (size=20G) formatting ext4 filesystem... mounting /var/lib/lxc/101/rootfs... Extraction Progress: 52% Error: error extracting archive: failed to copy file contents: No space left on device (os error 28) [errno: ENOSPC] Logical volume "vm-101-disk-0" successfully removed. TASK ERROR: command 'tar xpf ...' failed: exit code 2 ⚠️ Automated Rollback: Proxmox frees block device, hiding the evidence 1. CONTAINER ROOTFS BOUNDARY (DECLARED VS PAYLOAD) Manifest specifies size=20G, but actual uncompressed payload is 29.85 GiB. FIX: pct restore 101 <backup> --storage local-lvm --rootfs local-lvm:45 2. HYPERVISOR /var/tmp STAGING EXHAUSTION GUI uploads buffer to /var/tmp/pveupload-*, filling modest 20-30G root partitions. FIX: export TMPDIR=/mnt/large-storage/tmp && pct restore ... 3. LVM-THIN METADATA POOL EXHAUSTION (lvs -a) Data%: 42% (Free) but Meta%: 100% — device-mapper driver suspends all write I/O. FIX: lvextend --poolmetadatasize +1G /dev/pve/data && lvchange --monitor y 4. INODE EXHAUSTION (df -i) & PBS CHUNK GARBAGE COLLECTION Millions of micro-files deplete ext4 inode tables; PBS datastore locked by dead chunks. FIX: Scale volume size for inodes · Run PBS garbage-collection start 60-SECOND DIAGNOSTIC TRIAGE CHECKLIST 1. Check Thin Metadata: lvs -a -o lv_name,vg_name,lv_size,data_percent,metadata_percent 2. Check Host Root: df -h / /var/tmp | 3. Check Inodes: df -i / /var/tmp UPSTREAM GOLDEN RULE Thin storage allocates on write — size rootfs generously!
DevOps

You are in the middle of a disaster recovery drill, migrating an LXC container between hypervisor nodes, or worse—restoring production...

18 min
LIVE
CPU:
MEM: