Nguyễn Trung Hoàng Hải
Infrastructure / DevSecOps Engineer
Ho Chi Minh City, Vietnam
I build and defend the layers underneath other people's applications: the firewalls and routers at the edge, the Kubernetes clusters above them, and the pipelines that ship to both.
About
I work on system architecture, network engineering and DevSecOps across on-premises and cloud-native infrastructure. The same week can involve an HA firewall pair, a Kubernetes upgrade and a CI pipeline that refuses to ship an image with a critical CVE.
I work from the physical layer up: if I deploy a platform, I also run the network it sits on and the pipeline that feeds it. Alongside this I am finishing a Cyber Security degree at FPT University, which keeps the security half of the job grounded in more than tooling.
Stack
Systems Programming & Tooling
The parts I write myself when nothing off the shelf fits
- Rust: a diskless boot server with DHCP, TFTP, iPXE and an iSCSI target in one static binary
- GitHub Actions: reusable composite actions, published as open source
DevSecOps & Application Security
Checks that run before anything reaches production
- CI/CD security pipelines: Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST
- Kubernetes hardening: Kyverno policies, Pod Security Standards, RBAC
- Web application security testing: source-code review, privilege-escalation analysis, exposed-secret discovery
- Incident response: root-cause analysis, webshell and malware removal, data recovery
- Digital forensics: FTK Imager, Autopsy
- Rust supply-chain tooling: cargo audit, cargo deny, cargo geiger
Cloud-Native & Platform Engineering
Where the applications actually run
- Kubernetes: kubeadm clusters, Calico CNI, Traefik ingress, ArgoCD GitOps, CloudNativePG
- Autoscaling: HPA and metrics-server tuning against real workload profiles
- Proxmox VE: multi-node clusters, live VM migration across independent clusters, REST API automation
- Docker: distroless image builds, deployment through Dokploy
- Self-hosted services: Odoo, Strapi, GitLab CE
- Monitoring: Zabbix with TimescaleDB, Prometheus and Grafana
Network & Security Infrastructure
The edge: routing, firewalls, wireless and identity
- CCNA-level routing and switching: OSPF, ACLs, NAT, VPN, SDN
- FortiGate: HA clustering, VLANs, IPsec and SSL VPN, IKEv2, VIP/DNAT, traffic shaping
- Config migration between FortiGate models and generations without vendor conversion tooling
- UniFi network administration across sites
- Windows Server: Active Directory, RADIUS, Group Policy
- Zimbra mail server administration
Projects
-
open source
Broom
Rust, PXE, iPXE, iSCSI
A diskless boot server for rooms of 10–30 PCs such as internet cafés, gaming rooms and school labs, released under Apache-2.0. Every machine network-boots over PXE, iPXE and iSCSI from one shared golden image; user writes land on the local SSD and are wiped at the next boot. The server is a single static Rust binary with DHCP, TFTP, the iSCSI target and a web admin built in, and Windows 11 Pro or Linux clients keep Secure Boot, TPM 2.0 and HVCI, so FACEIT Anti-Cheat still runs.
-
in production
Production Kubernetes platform
kubeadm, Calico, Traefik, ArgoCD, CloudNativePG
Built from bare kubeadm rather than a managed service: Calico for networking, Traefik for ingress, ArgoCD for GitOps delivery and CloudNativePG for Postgres. It hosts real Spring Boot and Next.js workloads, with HPA and metrics-server tuned against their traffic instead of defaults.
-
internal tool
Proxmox cross-cluster migration toolkit
Bash, Proxmox REST API
Proxmox will live-migrate a VM inside a cluster but not between independent ones. This toolkit drives the REST API to do it anyway: it reconciles storage and network definitions on both sides, moves the disks, and cuts over with the guest still running.
-
in production
CI/CD security pipeline
Semgrep, Trivy, GitHub Actions
Security gates wired into the delivery pipeline rather than bolted on afterwards: Semgrep for static analysis, Trivy for dependency and container scanning, with findings failing the build at defined severities. DAST with OWASP ZAP is being added next.
-
open source
Distroless container images
Wolfi, Trivy, GitHub Actions
Three families of minimal base images on GHCR: a jlink-trimmed Temurin JRE for Java 17, 21 and 25; an nginx build with ModSecurity v3 and the OWASP Core Rule Set compiled in statically; and builder/runtime pairs for Node.js 22 and 24. All of them sit on Chainguard Wolfi, run non-root with no shell and no package manager, and rebuild nightly behind a Trivy gate that fails the build on a CVE of any severity.
-
open source
GitHub Actions composites
GitHub Actions
A set of reusable composite actions covering the build, scan and deploy steps I would otherwise copy between repositories. Kept public so the pipelines above stay readable instead of accumulating a hundred lines of inline YAML each.
Education
- FPT University
- B.Sc. Information Security Final year, graduating December 2026
Contact
Reach me at hainthvl@gmail.com. Most of my work lives on GitHub: morningstar-sudo for tooling and infrastructure, morningstar-sudo for the published container images. I'm also on LinkedIn.