// eddie velez — infrastructure engineer
e661e.io is my private cloud: single sign-on in front of every service, metrics and alerting on everything that moves, infrastructure declared in git and deployed by pipeline, and AI agents doing real operational work behind human gates. This page is the public tour.
Everything below runs on hardware I own, is described in code I can diff, and authenticates against one identity provider. Details that would help an attacker — names, addresses, ports, versions, topology — are deliberately absent.
Authentik fronts every service: OIDC and OAuth2 where the app speaks it, forward-auth at the reverse proxy where it doesn't. Enrollment is invitation-only and lands on WebAuthn plus TOTP — the direction is passwordless. Machine access follows the same philosophy: fleet SSH runs on short-lived certificates signed by HashiCorp Vault, with TTLs measured in minutes, not static keys scattered across hosts.
Grafana dashboards over a full metrics pipeline, centralized log aggregation, and alert routing straight to my phone. External black-box probes watch service health and TLS certificate lifetimes from outside the services themselves, because a service reporting on its own health is a conflict of interest. AI agent sessions emit traces and cost telemetry into the same stack — LLM usage is production telemetry here, not a mystery line item.
Hosts are provisioned and configured with Ansible from a dedicated control node; nothing is hand-configured twice. Changes land through pull requests with CI on self-hosted runners, a central scheduler owns recurring maintenance, and an autonomous coding agent picks up tagged issues and opens draft PRs overnight. Every merge still passes automated review and a human gate — autonomy with a leash.
Years of decision records, runbooks, and hard-won gotchas live in a versioned knowledge base with retrieval-augmented search on top, exposed to my agents over MCP — so the AI that operates the lab cites the lab's own history. Privacy-sensitive workloads run on locally served models rather than leaving the network.
A fully automated media stack routes its traffic through a dedicated VPN egress. PostgreSQL is the deliberately boring default datastore. Nightly encrypted backups ship off-site to delete-protected object storage, and restore paths are exercised on a schedule — a backup that has never been restored is a rumor.
A private Smallstep certificate authority issues TLS for everything internal. Vault holds the secrets, signs the SSH certificates, and brokers short-lived credentials; secret scanners in CI and pre-commit keep credentials out of git. Split-horizon DNS keeps internal names internal, and scheduled verification jobs prove that backups, certificates, and access controls still work — trust is re-earned nightly.
Four tiers. Traffic enters at the edge, proves who it is at the identity tier, reaches a service, and every service leans on the data tier. Real names withheld on purpose.
Access is invitation-based. If you have an account, sign in; if not, tell me why you'd like one.
Signed in as
Open your portal →