Anjan Nandy
builds platforms that run like products.
Platform engineer working across the full depth of the stack — bare metal, virtualization, Kubernetes, GitOps, security, and the applications on top. Everything on this domain runs on a private cloud I designed, automated, and operate end to end. This site is served by it.
The platform behind this page
Not a diagram of something I once worked near — the live system serving you this profile. Three physical nodes, a hyper-converged Ceph storage layer, an HA Kubernetes cluster delivered by GitOps, and a deliberately independent “floor” of core services that can repair the cluster if it dies.
What I do, with proof attached
Each capability below is demonstrated by something running in production on this platform — not a keyword list.
Infrastructure & virtualization
Design and operation of clustered compute and storage from the metal up: hypervisors, distributed storage, guest lifecycle, capacity planning.
Kubernetes & GitOps
HA clusters built from kubeadm up, delivered entirely by GitOps: Argo CD owns every namespace, CI builds and syncs, humans never kubectl-apply.
Security & identity
Secrets management, PKI, and single sign-on as platform primitives: every service gets TLS and OIDC by default, secrets never live in git.
Automation
Everything as code, everything idempotent: twenty-plus Ansible subsystems where re-running any playbook converges to changed=0.
Observability
Metrics, logs, and traces treated as one correlated system — if it can't be observed, it isn't done.
Data & messaging
Relational stores, object storage, and event backbones provisioned with least-privilege consumers and tested backup/restore paths.
Full-stack development
Production application development on the JVM and in the browser — the software layer that makes the platform usable.
Networking & edge
DNS, routing, VPNs, and TLS termination designed as a coherent edge: one front door, split-horizon internal resolution, protocol-aware multiplexing.
Applications I've built on it
Full products — backend, frontend, schema, CI, and deployment — running as first-class tenants of the platform.
Infrastructure control plane: server registry, certificate distribution engine, access-role management for the whole fleet.
Personal-finance manager: accounts, multi-currency FX, deposits and projections, document storage.
Password manager with AES-256-GCM encryption at rest, scoped sharing with revoke, and an integration API for sibling apps.
Visual goal/workflow editor and execution platform with its own runner fleet.
Event-driven offsite backup: file events over NATS JetStream, debounced sync to an encrypted cloud remote, weekly reconcile.
Self-service credential portal: deposits secrets into Vault and objects into S3 with per-app path guards, fully SSO-gated.
“If you would need it in order to fix a dead cluster, it does not live in the cluster.”