Nguyen Tien Dat

An LLM agent that runs read-only root-cause analysis on a Kubernetes incident and proposes the fix as a GitOps pull request.

• A fix merges only after a deterministic 4-stage Verification Gate passes — render, schema, policy, scope (Kustomize, Kubeconform, Kyverno; Conftest/OPA and Checkov for Terraform) — followed by a post-merge health check.
• Reproducible kind lab (Argo CD, kube-prometheus-stack, Loki, Kyverno via Helm); the agent is confined to read-only namespace RBAC, a NetworkPolicy and audit logging.
• Spec- and test-driven: 135-task plan, ruff + mypy strict + pytest in CI, checker versions pinned with mise for reproducible verdicts.

• Python
• LangGraph
• LiteLLM
• FastAPI
• Kubernetes
• kind
• Argo CD
• Helm
• Kustomize
• Kyverno
• Terraform
• OPA
• Checkov
• Prometheus
• Loki
• GitHub Actions

A volunteer event platform. I was also the sole front-end architect (React, TypeScript, Vite, 9 Tailwind themes).

• GitHub Actions pipeline — lint, build, deploy over SSH to a self-hosted VM behind Traefik and Cloudflare, gated on an end-to-end smoke test: push to production in about 2 minutes.
• 3-service stack (Nginx-served React, Express API, PostgreSQL) in multi-stage Docker with dev/prod Compose; JWT auth + RBAC for 3 roles.
• Hardened: banned-token enforcement, auth rate limiting on the Cloudflare client IP (X-Forwarded-For not spoofable), Nginx security headers, PostgreSQL off the host network.

• TypeScript
• React
• Vite
• Tailwind
• shadcn/ui
• Express
• Node.js
• PostgreSQL
• Web Push
• Docker
• Nginx
• Traefik
• GitHub Actions

8 services (Nextcloud, Gitea, Vaultwarden, WireGuard, Uptime Kuma, FreshRSS + 2 custom apps) in Docker Compose behind one Traefik proxy.

• Wildcard Let's Encrypt certificate via Cloudflare DNS-01; the Cloudflare proxy hides the origin.
• Hardened host: key-only SSH, fail2ban, default-deny ufw, unattended upgrades.
• Uptime Kuma checks 8 endpoints every 60 s; the server is documented in Git with a read-only recon script that detects drift.

• Ubuntu
• Docker
• Traefik
• Cloudflare
• WireGuard
• Uptime Kuma