Home on Santiago Ramis: Platform Engineer

About

Sun, 09 Aug 2026 00:00:00 +0000

About Me

I’m Santiago Ramis, a Platform Engineer based in Palma, Mallorca (Spain) with 20+ years of experience in IT. I’m currently focused on Kubernetes, GitOps, and infrastructure automation in the automotive industry.

Volkswagen Digital:Hub: Platform Engineer, OpenShift and GitOps with ArgoCD (Oct 2023–Present)
Dare Planet Technology · Adidas: Platform Engineer, CI/CD pipelines, cloud infrastructure (Nov 2021–Oct 2023)
Brújula, a CMC company: Linux Systems Administrator (Jun 2018–Nov 2021)
RIU Hotels & Resorts: IT Operator (Jul 2007–Mar 2009)

I design and operate multi-environment platforms on OpenShift, managing the full lifecycle from Helm chart development to continuous delivery with ArgoCD. My strength is turning complex infrastructure problems into simple, automated solutions: whether that’s migrating legacy deployments to GitOps, implementing observability stacks, or building CI/CD pipelines.

Architecture

Sun, 09 Aug 2026 00:00:00 +0000

Architecture

A high-level map of how the TekGarden platform connects on-prem infrastructure, the cloud edge, and remote access.

Network Overview

graph TB subgraph Internet["Internet"] USER["Users"] REMOTE["Laptops / Mobile
WireGuard road warrior"] end subgraph Cloud["Cloud Edge · Hetzner VPS"] PANGOLIN["Pangolin
Zero-trust tunnel gateway"] FORGEJO["Forgejo
Self-hosted Git + CI
private network only"] end subgraph OnPrem["On-Prem · Homelab"] PFSENSE["pfSense Router
Firewall rules + WireGuard road warrior
Only open: DNS, Traefik QNAP, Traefik k3s"] PROXMOX["Proxmox VE Cluster
2 nodes + QDevice"] K8S["Kubernetes (k3s)
2 HA clusters
prod + staging"] QNAP["QNAP NAS
Docker + Backrest backups
+ Traefik (Docker ingress)"] PBS["Proxmox PBS
Local backups → B2 sync"] SECRETS["Secrets
1Password + SOPS/age
+ Kyverno"] end subgraph External["External Services"] CF["Cloudflare
DNS + CDN"] B2["Backblaze B2
Off-site backups"] ONEPW["1Password
Secrets vault"] TG["Telegram
Alerts"] end subgraph Offline["Offline"] EXTDISK["External disk
Weekly offline copy"] end USER -->|HTTPS| CF CF -->|Tunnel| PANGOLIN PANGOLIN -->|Zero-trust| PFSENSE PFSENSE -->|DNS + Traefik only| QNAP PFSENSE -->|DNS + Traefik only| K8S PFSENSE --> PROXMOX PROXMOX --> K8S PROXMOX --> QNAP REMOTE -.->|WireGuard VPN| PFSENSE PFSENSE -.->|private network| FORGEJO PANGOLIN -.->|optional external access| FORGEJO FORGEJO -.->|GitOps pull| K8S FORGEJO -.->|CI deploy| QNAP PBS -.->|local backup| PROXMOX PBS -.->|sync| B2 QNAP -.->|Backrest local| QNAP QNAP -.->|Backrest → B2| B2 QNAP -.->|weekly| EXTDISK K8S --> SECRETS SECRETS -.->|op inject| ONEPW K8S -.->|alerts| TG

Flow Description

Public access flows through Cloudflare → Pangolin (zero-trust tunnel gateway on the Hetzner VPS) → pfSense router. pfSense only allows traffic to DNS, the QNAP Traefik (Docker ingress), and the k3s Traefik (Kubernetes ingress): all protected by CrowdSec agents.
Remote access: a WireGuard road warrior VPN on pfSense lets laptops and mobile connect from anywhere. Once connected, you have access to the entire TekGarden network and the Hetzner private network (including Forgejo), as if you were at home.
Forgejo runs on a Hetzner private network: only reachable internally from TekGarden. If external access is needed, Pangolin can expose it on demand.
GitOps runs from Forgejo: FluxCD pulls manifests into the Kubernetes clusters, and CI runners deploy Docker stacks to the QNAP and other Docker hosts.
Proxmox VE (2 nodes + QDevice for quorum) provides the virtualization layer running both Kubernetes clusters and Docker hosts.
Kubernetes runs two HA k3s clusters (production + staging, 12 nodes total).
Docker runs 30+ services across 3 standalone hosts, including the QNAP NAS.
Backups follow a 3-tier strategy:
- Proxmox PBS: local backups of Proxmox guests, then synced to Backblaze B2.
- Backrest (Docker on the QNAP): local backups of Docker data, then sent to B2.
- Offline copy: weekly backup to an external disk.
Observability (Grafana + Prometheus + Loki + Alertmanager) monitors everything and sends alerts to Telegram.
Secrets are centralized in 1Password (injected via op inject), with SOPS/age for GitOps-encrypted manifests and Kyverno for runtime policies.

Tech Stack

Layer	Technology
Edge / Tunnel	Pangolin, Cloudflare
VPN	WireGuard (road warrior on pfSense)
Git / CI	Forgejo (Hetzner private network)
Virtualization	Proxmox VE (2 nodes + QDevice)
Orchestration	k3s (2 HA clusters), Docker Compose (3 hosts)
GitOps	FluxCD
Ingress	Traefik (k3s + Docker), cert-manager, Let’s Encrypt, external-dns
Load Balancer	MetalLB
Observability	Grafana, Prometheus, Loki, Alertmanager
Secrets	1Password, SOPS/age, Kyverno
IaC	OpenTofu, Ansible (pull mode)
Network	pfSense, VLANs, Pi-hole, Cloudflare DNS
Security	CrowdSec (on all Traefik instances), Kyverno policies, NetworkPolicies
Backups	Proxmox PBS → B2, Backrest (QNAP) → B2, weekly offline disk
Storage	NVMe local, iSCSI QNAP

Contact

Sun, 09 Aug 2026 00:00:00 +0000

Get in Touch

Location: Palma, Mallorca (Spain) Availability: Remote / Hybrid

LinkedIn: linkedin.com/in/ramissan
GitHub: github.com/aygosan
Email: santi@ramisclar.cat

Feel free to reach out about platform engineering, DevOps, SRE, or homelab infrastructure.

Experience

Sun, 09 Aug 2026 00:00:00 +0000

Experience

Platform Engineer: Volkswagen Digital:Hub (Oct 2023 – Present)

Designing and operating multi-environment platforms on OpenShift. GitOps with ArgoCD, Helm chart lifecycle management, CI/CD pipelines, and observability stacks. Migrating legacy deployments to GitOps and automating infrastructure at scale.

Tech: OpenShift, Kubernetes, ArgoCD, Helm, GitHub Actions, Ansible, Terraform, Grafana, Prometheus

DevOps Engineer: Adidas / Dare Planet (Nov 2021 – Oct 2023)

Platform engineering and CI/CD pipeline development. Cloud infrastructure automation, deployment pipelines, and container orchestration at scale.

Projects

Sun, 09 Aug 2026 00:00:00 +0000

Projects

TekGarden: Self-Managed Platform

Role: Architect and sole operator

A homelab evolved into a production-grade platform running 24/7 on Proxmox with Kubernetes, GitOps, and full observability.

What it does:

2 HA Kubernetes clusters (production + staging): 12 nodes total
3 Docker hosts running 30+ services
GitOps deployments via FluxCD (6 repos, reconciles every 1m)
Full observability stack (Grafana, Prometheus, Loki, Alertmanager → Telegram)
Infrastructure as Code with Ansible (pull mode) and OpenTofu
Secrets via 1Password + SOPS/age + Kyverno policies
Backups to Proxmox PBS + Backblaze B2
Self-hosted Forgejo + CI runners on a Hetzner VPS

Tech stack: k3s, FluxCD, Proxmox VE, Traefik, cert-manager, MetalLB, Grafana, Ansible, OpenTofu, Docker, 1Password, Kyverno, CrowdSec, OPNsense, Cloudflare