Aleksey Zhadan · fullstack developer, DevOps · Head of TechPlatform
I design and deliver systems that keep running for years: an estate of forty hosts, eight products in production and LLM pipelines, all built and maintained by one pair of hands. Available for private contracts.
Services
Not "consulting hours", but a working system with documentation and a proven deployment.
Servers, virtualisation, Kubernetes, deployment as code. An estate that can be rebuilt from scratch with one command instead of from memory.
Pipelines where the model does the routine work and passes acceptance against written criteria. Runs on free models too.
From the data schema to deployment and a mobile client. My own products have been in production for years; yours will be built the same way.
Your own mail server instead of somebody else's cloud: domain migration without losing a single message, reputation kept, LLM-based anti-spam.
A private network spanning several countries: services reachable from any device, and a broken link never cuts off management.
One account for every service in the estate and a secret store the deployment reads passwords from by itself.
Products already in production
Not demos and not prototypes: each one handles live data every day.
Own webmail on Stalwart/JMAP: millions of messages, search, rules, meta folders for SMS and calls.
Built withStalwart, JMAP, Valkey cache, OIDC sign-in
ResultReplaced a paid Zimbra panel
An LLM pipeline: mail and SMS are grouped by contact, each item gets a model verdict and a decision.
Built withSeveral models, batches with a daily cap
ResultClean-up runs by itself, with an emergency stop
Bank statement collection and bookkeeping: automatic parsing of PDFs and APIs, balance history.
Built withPDF and bank API parsers, PostgreSQL
ResultSpending analytics without manual entry
Media library: photos and video with people recognition and shot scoring.
Built withImport from external sources, recognition models
ResultBest shots surface by themselves, people are found by face
A chronicle of movement and presence: phone, car, geodata.
Built withPhone, StarLine, geodata
ResultOne source of events instead of scattered logs
Own OIDC provider: single sign-on for every service in the estate.
Built withOIDC, with Forgejo, Nextcloud and mail connected
ResultOne account for everything, access managed in one place
Android app: contact storage, synchronisation of SMS, call log and calendar.
Built withKotlin, server synchronisation
ResultRemote administration of the phone
A multi-agent system on Kubernetes: task assignment, workers, and a verifier for answer quality.
Built withk3s, free models under acceptance, Mattermost and Telegram
ResultTasks are solved in batches without spending the paid subscription
Architecture cases
Four problems usually written off as "too hard, let's leave it as it is".
Two domains with twenty years of history lived on an external mail service. The provider would not hand over the list of mailboxes, so there was nothing to migrate "as is".
The address list was reconstructed from the mail archive: 15 thousand messages, 41 addresses. The domains moved to a self-hosted Stalwart, addresses recreated as aliases and lists. DKIM/SPF/DMARC are published automatically from the zone the server itself serves.
Migration without losing a single message, domain reputation intact. New domains are now added with one command.
Forty-seven thousand messages cannot be sorted by hand, and a wrong deletion cannot be undone. The automation had to be trustworthy enough to delete.
A pipeline: deduplication, grouping by contact, verdicts from several models, and a decision only when they agree. Work goes in batches with a daily cap and an emergency stop.
The mailbox sorts itself out. Disputed cases go to a human as one list instead of message by message.
Working with LLMs hits two walls at once: the price of paid models and the answer quality of free ones.
Tasks are split into parts and handed to free models. The result goes through an independent verifier and acceptance against criteria written down in advance.
One batch delivers 275 thousand tokens of free-model work and zero paid subscription spend, with acceptance still in place.
Access to services and external resources from three countries. Some resources are geo-restricted, others are reachable only from inside the estate.
MikroTik and WireGuard, a split proxy with per-domain routing, and a backup management channel in case the main one dies. Self-service allow lists through a Telegram bot.
Services are reachable from any of the client's devices. Losing the main link does not cut off management.
Built an executor agent that takes jobs from a queue, writes steps in chat and hands work off against written acceptance criteria. A second agent reviews the result and keeps a named log of irreversible actions.
Built Telegram bots on Bot API and MTProto clients, one process per account. They can read and export history. Also a bridge to a work chat and a self-serve allow-list bot.
Ran a k3s cluster on own machines with dozens of services. Config is code, rollout goes one host at a time so the rest stays up.
Wrote about 200 Ansible playbooks. Each rollout checks syntax, goes one host at a time, and is proven by a command, not by the word done.
Built monitoring on Grafana and VictoriaMetrics. A watcher spots silent hosts and brings a down machine back through neighbors and the hypervisor.
Built a visual-duplicates page: similar frames are grouped, tagged by origin, and can be unmarked. Backend and UI are live; a control set of hundreds of frames grouped cleanly with no key loss.
Built geo-block triage: domains are taken from the page and scripts, each is probed from two regions, and matching templates become a ready tunnel request. On a live site, block from one region and OK from the other produced the request automatically.
Built auto-warming for data missing from cache: a background loop warms the needed slices ahead of time. After a full flush, main pages are warm again in fractions of a second instead of a long cold build.
Stack
How I work
Every result is proven by a run and by logs, not by the words "it works".
What the outcome must be, what is in the way, where the data lives and who the users are. We work through your material, not through generalities.
The solution diagram, the list of work and the acceptance criteria are written down before anything starts. The quote is tied to milestones, not to hours.
Every stage closes with a run: command output, logs, screenshots. You see what is done before you have to ask.
Documentation, access, reproducible deployment. The system lives without me, and if you want, I stay on support.
FAQ
Same numbers and steps as on the page — easy to quote in search or for an assistant.
Systems engineering end to end: infrastructure and DevOps, LLM-based AI agents, web services, mail and networks. Every result is proven by a run and logs, not by claims.
20 years in engineering, 731 Ansible playbooks and 154 roles, 98 documented services, 8 in-house products in continuous production, and about 40 hosts across three countries plus a k3s cluster.
Four steps: scope the task, architecture and estimate with acceptance criteria, work with proof at every stage, then handoff with documentation and reproducible deploy.
WhatsApp, email all.zhadan@gmail.com, or Telegram @azhadan_dev. No forms; replies are usually the same day.
Contact
WhatsApp, email or Telegram, no forms and no questionnaires. I reply fast, usually the same day.