About me

I've been doing this for thirty years, which means I started before "DevOps" was a word and watched the whole thing arrive — bare metal, then virtual machines, then the cloud, then the realisation that none of it matters if developers can't ship. These days I work the platform side of that problem: the tooling, pipelines and golden paths that let a few hundred engineers move without standing on each other.

I'm London-based, originally Norwegian, with Polish heritage that the surname gives away. I contract through Calitii, now part of Synechron, which puts me on regulated-sector programmes — banks and public-sector bodies where "move fast and break things" is not on the table and the audit trail has to be real.

What I'm doing now

I'm product owner and lead architect on SARC — orchestrated compliance for regulated delivery. The pitch is short: your evidence lives in a self-hosted, tamper-evident ledger inside your own cloud, wired to ServiceNow and your CI, so audit week stops being a fire drill and nobody outside your infrastructure is holding your audit trail. One install covers DORA, ISO 27001, SOC 2, SOX, NIST 800-53, PSD2 and PCI-DSS; the same repository deploys to AWS, Azure, GCP, OpenShift or a laptop off a single switch; and it runs identically on GitLab CI, GitHub Actions and Azure DevOps, so adopting it isn't a CI migration. There's a public walkthrough of the portal, and the full write-up here.

What I've been doing before that

Two large engagements, both delivered. At Jefferies, a US investment bank, I led the migration of six business units off Bitbucket and Bamboo onto GitHub Enterprise and Actions — reusable workflow templates across Maven, Gradle, .NET, Python and Node, self-hosted runners on AKS, and the GitHub Enterprise governance written as Terraform so it was reviewable instead of a pile of console clicks. The bit I'm proudest of is the boring bit: production Bamboo pipelines cut over to Actions with nobody noticing.

At the National Energy System Operator I led a team building Backstage as an internal developer platform — self-service scaffolding, golden-path templates, and one place to find who owns what. The work was as much about defining the operating model as writing the code.

How I work

I'm happiest when I can do the whole arc — architect the thing, write the Terraform, then stand in front of the CTO and explain why. I don't think those are separate jobs. The architecture decisions that survive contact with production are usually made by people who've also had to operate it at 3am.

A couple of things I believe, after enough scar tissue to mean them: security controls developers route around are worse than no controls, because they cost you the same and buy you nothing. Infrastructure you can't rebuild from a clean checkout isn't infrastructure, it's a liability with a hostname. And most "we need a platform team" problems are really "we never wrote down the golden path" problems.

War stories

At Live-Tech Games I scaled a platform to a million concurrent users on AKS — a redesign into microservices and some fairly aggressive autoscaling, under a launch deadline that did not move. At Ofgem I moved legacy regulatory applications onto a microservices architecture and wrote the DevSecOps blueprints the organisation standardised on. At R3 I ran a multinational DevSecOps team on their distributed-ledger products and put real SRE practice in place — SLOs, error budgets, the lot.

Open source & side projects

A lot of how I learn a tool is by building something real with it and putting it on GitHub. Most of these started as "I wonder if…" on a weekend and turned into things I actually use.

Delivery & governance. Fides is a tamper-evident evidence ledger for the SDLC; Hecate is the cross-environment promotion layer FluxCD never had; and the Agentic SDLC reference build is the operating model for agent-written software as a repository that runs, with gates proven to refuse rather than merely to pass. The Factory suite — PFactory, AIFactory, TFactory, CFactory — is the pipeline that uses them.

AI & LLM tooling. Mostly MCP, in one form or another: Janus, an MCP gateway built to survive a security review; Myrmex Hive, agent orchestration with zero inbound ports; lxconnect, which runs an MCP server on an Android phone; and the WebMCP portals — Muninn for GitHub, Huginn for GitLab, and an AWS dashboard that hands your own account to the agent in the browser tab. Earlier on there was ollama-skill-cv-rag for RAG over CVs and skills, and SOW-generator for drafting statements of work.

NixOS & cloud infrastructure. nixarchy vendors the whole Omarchy desktop onto NixOS instead of reimplementing it; cloud-nixos builds and deploys hardened NixOS server images across AWS, GCP, Azure and European clouds with sops-nix and OpenTofu; and nixos-k3d-lab turns a multi-node Kubernetes dev cluster into a NixOS service with no registry in sight. nixos-template is the batteries-included starting point, and nixos_config is my whole estate declared in Nix.

Developer tools. skill-pool is the team layer for Claude Code's .claude/ directory; herdr is a terminal multiplexer for coding agents; dionysus presents Markdown from a terminal or a browser and ships its own MCP server; and gogmail puts Google Workspace in a TUI. SkillAi and the rest get the full write-up over on the showcase.

Away from the keyboard

I tinker with NixOS and the COSMIC desktop more than is strictly reasonable, and I've written a few Rust applets for it. I was a governor at the Norwegian School in London for four years. I speak English, Norwegian and Polish. And I'll happily lose an afternoon to a music festival lineup.

They say cloud makes you feel younger. I've been 25 for about twenty-five cloud years now.

If any of this is your kind of problem, I'm easy to find — LinkedIn, GitHub, or olaf@freundcloud.com.