I keep the platforms running that others build on.

Migrating a container registry before the lights go out

Problem. The team's container registry (reg.mini.dev) announced shutdown with a hard deadline. 46 deployments across 3 accounts referenced images that would stop pulling in two weeks.

Built. Audited all 46 deployments, identified 7 unique images to mirror, and built registry-rollover.py — a Python script that re-tags and pushes images to DOCR and Harbor, updates deployment configs, and validates the rollover. Handled edge cases: 3 stale image tags that no longer existed, a private rescued image archive, and one blocked image (vendor rebrand). PR merged with tombstone markers for decommissioned references.

12 of 13 live deployments rolled over mechanically. Zero downtime.

View on GitHub

Building the first production Kubernetes cluster from scratch

Problem. All workloads ran on individual droplets with no orchestration, no shared ingress, and no centralized container registry.

Built. Provisioned a v5 DOKS cluster on DigitalOcean (ATL1), deployed Traefik as the ingress controller with cert-manager and Let's Encrypt for automatic TLS. Set up Harbor container registry at registry.weown.tools, migrated all images from DOCR. Currently deploying WordPress, Buzz multi-agent platform (Postgres, Redis, MinIO), and internal services. Namespace isolation, IngressRoutes, and DNS wired end to end.

First workload (weown.events) is live on the cluster. Buzz relay deployment in progress.

View on GitHub

Automating API key rotation with an open-source Vault fork

Problem. API keys were rotated manually every time they expired — the CEO was doing it himself. No audit trail, no automation, no scoped access.

Built. provision-openrouter-key.sh — a Bash script that provisions budget-capped API keys via the OpenRouter API and stores them in OpenBao (open-source HashiCorp Vault fork). Supports manual paste and fully automated modes with configurable credit limits. Tested against production tenants with rollback verification. Integrated into the existing deployment pipeline with a per-instance SECRET_BACKEND flag flip — no script rewrite needed to migrate a tenant from Infisical to OpenBao.

Key rotation went from a manual CEO task to a single command with audit logging.

View on GitHub

A Chrome extension that writes and sends LinkedIn messages for you

Problem. Cold outreach on LinkedIn is slow — find the person, write a personalized message, send, track, repeat. At scale it's hours of copy-paste.

Built. A Chrome extension (Side Panel API) that scrapes LinkedIn contacts by company, drafts personalized notes via Claude or Grok APIs, and, once you've reviewed them, sends connection requests with the notes — all from a side panel while browsing. Landing page with animated demo at outreach.mwk.dev. Started as a simple Next.js generator, evolved into a full product.

Try it at outreach.mwk.dev View on GitHub

Live AI agent migration across datacenters with zero downtime

Problem. Cross-datacenter latency between an AI agent in NYC1 and its platform in ATL1 was degrading performance.

Built. Provisioned a new ATL1 droplet, migrated all three containers (agent, dashboard, reverse proxy), updated DNS in Cloudflare, verified TLS and auth, then destroyed the old NYC1 droplet and released the reserved IP. Zero downtime throughout.

View on GitHub

Migrating 6 WordPress sites with a reusable IaC pipeline

Problem. Six WordPress sites ran on legacy infrastructure with no automation, no version pinning, and no documented migration path.

Built. A config-driven migration system — wordpress-v5-migrate.sh reads a YAML config, provisions v5 droplets via OpenTofu, sets up Docker + Caddy for automatic TLS, restores content via UpdraftPlus, runs wp-cli search-replace for URL migration, and documents before/after baselines. Remote Terraform state on DigitalOcean Spaces with locking. Migrated burnedout.xyz, weown.academy, weown.bio, and burnedoutadvisor.com with zero data loss.

What used to be a manual weekend project per site now runs from a single YAML file.

View on GitHub

Full agency site on Cloudflare Workers — no server, no bill

Problem. A client needed their React SPA rebuilt as a fast, SEO-friendly site on infrastructure they controlled, without a monthly hosting bill.

Built. 11-page Astro site deployed to Cloudflare Workers with D1 database, KV storage, and EmDash CMS. Dark theme rebuilt as a 1:1 replica of the original. Contact form wired to Formsubmit. DNS, Workers routes, and admin panel all configured on the client's own Cloudflare account.

View on GitHub

Buildathon infrastructure in 48 hours

Problem. A team needed production infrastructure for a Midnight Network hackathon project — a Health Markers Passport using zero-knowledge proofs — with a hard submission deadline.

Built. Provisioned a DigitalOcean droplet, containerized the Node.js/Express backend and Next.js 14 frontend with Docker, set up Caddy for TLS and API routing, configured DNS, and deployed the full stack. Live demo verified end-to-end: wallet connect, credential issuance, consent, proof generation.

Live at weown.health View on GitHub

Reusable Docker stacks for AI and WordPress

Built. HTTP healthchecks and pinned images for OpenClaw, default model + agent search for AnythingLLM, and a WordPress stack where Ansible pulls plugins from object storage at build time. Ran a Docker MCP Gateway POC for safe agent tool access.

View on GitHub

Seeing traffic and errors on a site that had neither

Built. SigNoz with OpenTelemetry collectors and structured Caddy access logs for a marketing site with live webinar traffic. Slow pages and 5xx spikes now visible in one place.

View on GitHub

From hand-run deploys to a one-minute pipeline

Problem. Every release was a manual wrangler run with an undocumented config workaround. "Deployed" and "live" kept disagreeing because content lived in D1 revisions, not the seed file.

Built. A GitHub Actions pipeline that builds the Astro site, patches the adapter's broken config, and deploys to Workers on every merge. Migrated the zone between Cloudflare accounts, added DKIM/DMARC email, wrote the runbook.

Merge to main → live in one minute. Nobody needs my laptop to ship.

View on GitHub

The dashboard that died every restart

Problem. An AI agent's dashboard went unreachable after container restarts. No errors in any log.

Root cause. Shared Docker network namespace silently broke on restart. Fixed with separate bridge networks and Caddy resolving through Docker DNS. Packaged the deployment as a Copier template.

Template on GitHub

A Kubernetes platform a small team can actually operate

Built. DigitalOcean Kubernetes provisioned with OpenTofu, apps delivered through Helm and ArgoCD, secrets in Infisical, and a Prometheus + Grafana + Loki stack so failures show up on a dashboard before Slack.

The team deploys by opening a PR. Access, secrets, and rollbacks follow the same path.

View on GitHub