Bill Gernert
Platform & infrastructure automation
Can you actually automate everything?
Server provisioning, Windows and Linux. User lifecycle from a YAML definition to Active Directory and Entra. Certificate and secret rotation. Alert triage. Even the job search itself. Wired together end to end, watched by a net of Grafana dashboards, and treated as production.
That's the question this lab exists to answer. Fifteen-plus years of system administration and infrastructure design, applied to a greenfield build with open source at its core: Jenkins and Ansible for execution, Vault for secrets, NetBox for inventory, git for every definition. Automation is only as good as its sources of truth, so drift has nowhere to live.
The scale tells the story: 200 backlog items delivered through 1727 PRs, every one reviewed and merged by me. Recovery is proven, not promised. A pipeline verifies backups weekly, and the practice is live-fire: Vault destroyed and restored in 97 seconds.
And AI isn't just tooling here. A local LLM and the Claude API operate as agents inside the platform, triaging alerts each morning, analyzing incidents, and reporting on lab health, all cost-gated and audited like everything else.
AutomationLab
AutomationLab is a self-hosted platform on a five-node Proxmox HA cluster, automated from bare VM to running service and documented as I go. It is a working system, not a demo: the same pipelines, guardrails, and runbooks an on-call engineer would actually use.
Provisioning is a pipeline, not a checklist. A Jenkins job drives a request through NetBox IP allocation, per-VM Terraform workspaces (Proxmox), a human approval gate, Zabbix registration with a unique per-host PSK in Vault, and Ansible configuration - with roll-forward on partial failure and a clean decommission path that reverses every step. Linux and Windows.
Everything is config-as-code, reviewed like code. Argo CD reconciles the cluster; the
Jenkins controller config lives in git; every change is a branch and a PR to main
behind branch protection, with yamllint / ansible-lint / terraform lint gates and Trivy +
Gitleaks security scanning as required checks.
It heals and reports on itself. A Zabbix classify-and-heal engine detects failures and applies OS-aware fixes, recording every outcome so heals are auditable; a Tier-1 path restarts stuck services in minutes. Alerts route through a self-hosted mail platform to role-based groups.
Identity, secrets, and edge are first-class. On-prem Active Directory syncs to Entra ID via AD Connect; the full user lifecycle (provision, deprovision, disable-first offboarding, four-eyes approval, delayed cleanup sweep) is automated, backed by an internal PKI (AD CS). HashiCorp Vault (AppRole) holds every secret. External access is a Cloudflare Tunnel to Traefik ingress with Access SSO on every app.
Projects
Six pipelines, told as stories: automated server provisioning across Windows and Linux, a template factory that rebuilds golden images instead of patching them, a job reporting pipeline, self-healing monitoring, a decommission that refuses to run when its plan would destroy nothing, and an AIOps morning triage that is cost-gated twice over. Each one gets the problem, the stages, the code, and what broke - including the gate that spent its whole life reading the wrong exit code.
Platform
The subsystems those pipelines run on: provisioning with roll-forward semantics, a self-healing engine that records only what it can actually observe, identity automation from first day to last, AIOps triage that fails closed, observability where a tile with no signal is never green, and a secrets tier whose recovery I proved by destroying it. Each writeup names the limits too.
Security
One authority for secrets and nothing on disk. Nothing port-forwarded, nothing listening on the internet, and single sign-on at the edge rather than in the app. Every gate fails closed: when a control cannot tell, it stops. And the control I am proudest of is the one I audited and found fail-open, because a control nobody audits is a control nobody has.
The lab, in one picture
Five nodes, four segmented networks, a K3s cluster and everything that runs on it, the platform services that hold the truth underneath, and one way in from the outside. Click any region for what it is and why it is there. The addresses and machine names are deliberately not on it: what is worth showing is the shape.
AI
AI is part of how the lab runs: agents inside the platform that triage alerts, analyze incidents, and report on its health. A local LLM carries the bulk; the Claude API handles the hard reasoning; every call is cost-gated and audited like any other dependency, and every action is advisory - it proposes, I approve.
Skills
- Cloud & IaC
- AWS, Azure (Entra ID, Intune, O365), Terraform, Packer, Ansible
- CI/CD & GitOps
- Jenkins (shared libraries, JCasC), Argo CD, Gitea Actions, GitOps workflows, Kaniko
- Containers & Orchestration
- Kubernetes (K3s), Helm, Docker, cert-manager, External Secrets
- Languages & APIs
- Python, PowerShell, Groovy, REST APIs, Microsoft Graph API, Go (familiar)
- Identity & Security
- Active Directory, Entra ID, hybrid identity (AD Connect), SAML/OIDC SSO, MFA, Conditional Access, gMSA, HashiCorp Vault, PKI (AD CS, step-ca, Let's Encrypt)
- Observability
- Zabbix (API automation, self-healing), Prometheus, Grafana, SCOM, SolarWinds
- Virtualization & Network
- VMware vSphere/vSAN/Horizon, Proxmox VE (HA clusters), OPNsense, VLAN design, Cloudflare Zero Trust