Kevin Thomas

Projects

Grouped by what they do. Each card lists the stack; filter by technology below.

Platform & Infrastructure as Code

Everything is declared in Git and applied by script: containers, network, DNS and images. Rebuilds are repeatable and every change is reviewable.

Homelab Platform (GitOps)

49 containers in 12 Compose stacks on a self-hosted Unraid server, deployed from Git with secrets kept out of the repo, health checks on every service and weekly off-box backups.

  • Docker
  • Compose
  • Unraid
  • Git
  • GitHub Actions
Case study

Network as Code

Router DNS, dynamic DNS, SRV records and port forwards declared in versioned config and deployed with dry-run diffs: no hand edits in the router UI, and every change is reviewable.

  • Bash
  • Cloudflare API
  • Asuswrt-Merlin

Terraform & Image Pipelines

Infrastructure provisioned from code with remote state in Terraform Cloud, golden images built with Packer and hosts configured with Ansible playbooks.

  • Terraform
  • Packer
  • Ansible
  • QEMU/KVM

Security Lab

A dedicated Kali Linux VM for authorized testing of my own network, containers and VMs, with findings fed back into hardening and monitoring.

  • Kali Linux
  • Nmap
  • Libvirt

Observability & Telemetry

Custom collectors, health checks and time-series history make the platform's state visible at a glance, both live and over 90 days.

Multi-Protocol Player Telemetry

A dependency-free Python collector that asks 12 game servers how many people are playing, over four binary protocols and four JSON APIs. It publishes counts-only JSON for a public page, richer detail for internal dashboards and Prometheus metrics for 90 days of history.

  • Python
  • Sockets
  • Prometheus
  • VictoriaMetrics
Case studyLive ↗

Fleet Monitoring

50 health checks across HTTP, TCP, Docker and game-server probes, grouped per service with alerting. Kuma's metrics are scraped into a time-series database for SLO-style summaries.

  • Uptime Kuma
  • Prometheus
  • VictoriaMetrics
Live ↗

Hardware Telemetry

A custom monitoring-agent image that adds Intel GPU support alongside NVIDIA, giving one view of CPU, memory, temperatures and per-GPU load for a multi-GPU host.

  • Beszel
  • Docker
  • Intel GPU
  • NVIDIA

Dashboards as Code

An ops dashboard defined in Git (layout, apps and custom JSX widgets) and applied through its REST and MCP APIs by an idempotent sync script with a dry-run mode.

  • Python
  • REST
  • MCP
  • JSX

Identity, Edge & Security

Defense in depth: SSO with group-based access on every admin surface, a hardened edge and least-privilege automation tokens.

Zero-Trust SSO Gateway

Every admin app sits behind OIDC single sign-on with group-based access (admins vs. game moderators), passkey login and Cloudflare in front. LAN access is kept as break-glass.

  • OIDC
  • Tinyauth
  • Pocket ID
  • Nginx Proxy Manager

Cloudflare Edge Automation

Python tooling for cache-bypass rules on authenticated hosts, WAF rate limiting and cache purges, driven by a least-privilege API token whose scopes are added one at a time.

  • Python
  • Cloudflare API
  • WAF

Hardened Public Status Page

A public status page that exposes only an allow-listed set of read-only routes, with security headers, rate limits and sanitized heartbeat messages.

  • Uptime Kuma
  • Nginx
  • Cloudflare
Live ↗

CI/CD & Container Supply Chain

Images are built, published and refreshed automatically, with upstream drift caught before it becomes an outage.

Container Image Pipeline

A GitHub Actions matrix that builds and publishes service images to GHCR on every change and weekly for base-image security fixes, and opens an issue automatically when an upstream patch falls behind.

  • GitHub Actions
  • GHCR
  • Docker

Self-Hosted Build Runner

A self-hosted Actions runner that turns a 4 GB asset tree into Windows installers and Steam Deck payloads without proprietary assets ever entering Git.

  • GitHub Actions
  • Bash
  • Windows installers
  • Steam Deck

Web Console Image

A small image that fronts a browser terminal with a form-login proxy, tails server logs and exposes RCON behind SSO. It's rebuilt weekly.

  • Python
  • ttyd
  • Docker
  • GHCR

AI & Simulation

Local-first AI: LLM-guided agents over deterministic engines, running on private hardware.

Deck-Agent Playtest Harness

Five AI agents, one per deck, pilot their decks in a headless rules engine for self-play and human-vs-agent testing, with local LLMs advising a deterministic executor.

  • Python
  • Ollama
  • LLM agents
  • Simulation

Private AI Stack

Self-hosted LLM chat with local models on a workstation GPU and private web search. Nothing leaves the network.

  • Ollama
  • Open WebUI
  • SearXNG
  • CUDA

Game Platform Engineering

Phantasy Star Online: Blue Burst revived as a modern platform on newserv, with staged rollouts, data migrations, a player portal and native client patches.

Corellia: Phantasy Star Online Server Platform

A three-instance private server platform (production, canary and legacy) for Phantasy Star Online: Blue Burst, migrated from Tethealla to newserv with staged rollouts, account and character migration between server generations, and imports from another community server.

  • C++
  • Python
  • Django
  • Docker
  • MySQL
  • GitHub Actions
Case study

Player Account Portal

A Django portal with signup, Discord SSO, live server status, admin-managed announcements and per-player character views, reading the game database directly.

  • Python
  • Django
  • Discord OAuth
  • Docker

Game Client Patches

Native patches for the Phantasy Star Online: Blue Burst client, built on anzz1's community patch set: right-stick camera control with wall and door collision and DualSense support, widescreen and audio work, and a launcher, all shipped through the installer pipeline.

  • C++
  • Win32
  • Reverse engineering

Multiplayer Hosting & Operations

Production-style operations for real users: whitelists, backups, graceful shutdowns, performance logging and self-service join guides.

Minecraft Fleet

Four servers, from vanilla to a 470-mod pack, with per-server whitelists, scheduled backups, graceful-shutdown tuning, TPS/GC logging for lag reports and an SSO-protected web console.

  • Docker
  • Java
  • NeoForge
  • RCON
Live ↗

Arena (Classic FPS)

Four classic arena shooters as containers, two on custom-built images, password-gated per game and run from a web admin UI for maps, bots and match settings.

  • Docker
  • GHCR
  • GitHub Actions
  • UDP
Live ↗

Card Game Multiplayer

A self-hosted duel server with a public room list, plus per-player browser desktops so friends can play without installing anything.

  • Docker
  • Browser desktops
  • OIDC SSO
Live ↗