I build the whole path — the interface, the services behind it, and the cluster they run on — and keep all of it in code.
Website • LinkedIn • Telegram • to@risen.dev
Open to Senior Full-Stack and Platform / DevOps roles — remote (contractor or EOR), or hybrid in Yerevan
Previously: X5 Group (food.ru, ~7.5M MAU) · SberEducation · Haiku Dev
- Infrastructure is a repository. Machines, clusters, deploys, dashboards and alerts are declared and reconciled by GitOps. Nothing in production is changed by hand.
- Broken states shouldn't compile. Typed contracts from the database to the UI, validation at every boundary, and enough metrics to know something is wrong before a user reports it.
- The interface gets the same bar as the backend. States, motion, accessibility and the exact frame under the cursor are designed and measured, not left to whatever a generator outputs.
- Agents type, I specify. Requirements, constraints and failing tests come first. Nothing ships until edge cases, security and performance bars pass.
| Domain | Technologies |
|---|---|
| Platform |         |
| Backend |    |
| Data |      |
| Frontend |    |
| Generation | Why it changed |
|---|---|
| Ansible roles + kubeadm on VPS | the hosts had no API and no Terraform provider |
| Terraform + Talos on DigitalOcean | an API arrived, but values like registry credentials were awkward to build |
| Terragrunt | brought in for templating, and turned into nesting nobody could follow |
| Pulumi + Talos + Flux | everything in code, no generated config |
Bare metal and cloud in one cluster. Secrets come from Infisical through External Secrets and never live in the repo. Cloudflare and DragonflyDB sit at the edge. Releases and rollbacks take under 3 minutes.
Talos on Hetzner via Pulumi, Flux GitOps, and content-hash image builds, so an unchanged service is never redeployed. VictoriaMetrics alerts. CI runs 400+ integration tests against real PostgreSQL and Redis before any image is built. An operator MCP server queries production in plain language through column-level database grants; writes go through a port with human confirmation and an audit journal.
Private repository — happy to walk through it on a call.
Built with a business partner. Launched to ~1,500 players and closed on funnel data: free channels were bringing in players who didn't pay.
- Provably fair, not "trust us": HMAC over a server seed committed before the round and a client seed the player controls. The commitment is published first and the seed revealed after, so anyone can recompute the outcome.
- Rounds survive a deploy: each game lives in a Temporal workflow, not in a server's memory. p95 state-sync latency was 120 ms in load tests with 300 concurrent sessions.
- Money is idempotent: TON and Telegram Stars payments go through transfer and settlement services that are separate from gameplay.
- 10 ASP.NET Core services: payments, wallets, affiliate, gaming and auth. NATS pub/sub, Redis, distributed locking and Hangfire.
- Money movement is transactional and idempotent under concurrency, on a 27-entity PostgreSQL schema with EF Core.
- Integration tests run on Testcontainers against real PostgreSQL, Redis and NATS.
The model proposes and the code decides. Grounding checks reject any claim the source resume can't back, page fitting runs against the real PDF renderer, and an eval harness on real resumes picks prompts and models by measured quality and cost. Live payments five weeks after the first commit.
- Casts to the TV untouched: a 4K HEVC HDR file with Dolby audio goes to the television as-is, over Google Cast or DLNA, while the window stays a working remote. A copy is made only when the set can't take the original, and even then the video is stream-copied.
- Torrents play while they download: piece priority follows the playhead, the seekbar shades what has arrived, and the next episode is prefetched.
- A real interface over mpv: mpv renders into a native view behind a transparent webview, with the UI composited on top as HTML. On macOS that meant patching libmpv, which had no
--widsupport. - Measured, not assumed: seek previews land on the exact frame (naive keyframe mapping showed the wrong scene 60% of the time), and audio and subtitle choices are re-found in the next episode by language and codec, never by track index.
- DeskVolt: a battery widget for wireless peripherals from six vendors (Logitech HID++ 2.0, SteelSeries, Corsair, HyperX, DualSense) over reverse-engineered HID protocols. Native Win32 with Direct2D, under 10 MB resident.
- dubsync: moves a dub from one release onto another, aligned with GCC-PHAT segment by segment to ~50 ms. Every match carries a confidence score, so a bad one is reported instead of shipped.
- nestjs-zod: original author. ~5.5M downloads/month; one schema serves validation, types and API docs. Transferred to another maintainer in 2024.
- eslint-kit: author. A preset-based ESLint config, now obsolete since Biome. It was the right answer while ESLint was the only option.