Devin Mitchell — DevOps Engineer | AWS | Terraform

Who is this guy

About Me

I’m a DevOps engineer based in North Yorkshire, working mostly with Terraform, AWS, and Infrastructure as Code. My day job involves a reasonably large multi-account AWS environment across several regions — keeping things running, automating the bits that would otherwise require a human to do something repetitive, and trying not to break anything that matters.

Before the cloud there was a fair bit of Unix: Solaris at various government facilities, some Oracle IAM work at Hewlett-Packard, and systems administration at Lockheed Martin in Virginia and North Yorkshire. It was the sort of work that discourages carelessness.

Before that, I ran a WWIV BBS in Washington DC in the early ‘90s — which is where the habit of tinkering with networked systems started and, frankly, never stopped.

Outside work: a Proxmox homelab that has gotten slightly out of hand, Home Assistant running most of the house, and a live chicken camera with more monitoring than it strictly needs. I use AI tooling heavily — mostly because it means less typing. Dual US/UK citizen.

Born in Germany, raised in the United States, and long settled in North Yorkshire — which accounts for a certain amount of travel before the deliberate kind even started. Most of Western Europe has been covered at some point, along with the Baltics, Scandinavia, North Africa, and a few further afield; also driven the United States coast to coast four times on both the northern and southern routes, which puts some distances in perspective. Currently practising German to around B1, working towards B2 — conversational rather than professional, mostly useful when we’re in Austria or Bavaria and defaulting to pointing just seems rude. York is fifteen minutes away and still gives back after two thousand years; it was one of several reasons we ended up where we did. The loose plan involves more of the same: different places, unfamiliar food, and making reasonable use of being half an hour from an international airport.

Top Secret / SCI Security Clearance with Counterintelligence Polygraph — U.S. Government

Active 2003–2013 · Lockheed Martin, Hewlett-Packard, and Sotera Defense Solutions · Inactive

devin@devinmitchell ~

❯ whoami --verbose

role: DevOps Engineer

also: AI-Augmented Engineering

location: North Yorkshire, England 🇬🇧

citizen: Dual US 🇺🇸 / UK 🇬🇧

languages:English (native) · German (B1→B2)

spec: Terraform, IaC, Platform Eng.

clearance:TS/SCI + CI Poly (2003–2013)

unix: 1999–present (still going)

bbs_sysop:WWIV, DC area (1991)

ai_usage: 90%+ daily (measurable gains)

status: ● online

❯ cat /etc/motd

// If it can be automated, it will be.

// If it can be self-hosted, it is.

// If it can break at 3am, it already has.

❯

Expertise

What I Do

☁️

AWS Architecture

Multi-account AWS across a reasonably large environment. VPC design, Transit Gateway, Direct Connect, BGP, IAM — the usual collection of things that seemed straightforward until they weren’t. Enough time in it to know which questions to ask before touching anything.

EC2VPCTGWLambdaIAMKMSS3EKS

🏗️

Terraform & IaC

Terraform is the thing I spend most of my time in. Module architecture, semantic versioning, workspace management, CI/CD pipelines for IaC — mostly because clicking through consoles manually seemed like an unreasonable use of a human’s time.

TerraformHCLPackerAnsibleCloudFormation

🖼️

Golden Image Pipelines

AMI lifecycle across the usual suspects: RHEL, Ubuntu, Amazon Linux, Windows Server. CIS hardening, cross-region distribution, automated validation pipelines. The sort of thing that benefits from not being done manually.

PackerRHELUbuntuAL2023CISWiz

⚙️

CI/CD & Automation

Jenkins, GitHub Actions, shared library patterns, Docker build agents, credential rotation. Pipelines that run unattended are generally preferable to pipelines that require someone to watch them.

JenkinsGitHub ActionsGroovyPythonBash

🐧

Linux / Unix Systems

A good while on production Unix across various operating systems. RHEL, Ubuntu, Amazon Linux, Solaris, Windows Server when necessary. Long enough that most of the failure modes are familiar, which is either reassuring or faintly depressing depending on your perspective.

RHELUbuntuSolarisAL2023Windows Server

🌐

Network Architecture

Transit Gateway, site-to-site VPN, Direct Connect, BGP, Squid forward proxy for a fleet of AWS accounts. Networking in AWS: technically straightforward, expensive to get wrong, therefore worth automating carefully.

TGWVPNDirect ConnectBGPSquidIKEv2

🔒

Security & Compliance

CIS hardening, Cloud Custodian for automated compliance, Wiz, Security Hub, ADFS/SAML federation, KMS. Security work that is largely automated, because manual compliance checking tends to have a spotty track record.

Cloud CustodianWizCISSecurity HubKMS

🐳

Containers & Orchestration

Docker, Kubernetes, EKS, Helm — enough to be useful. Plus a Proxmox homelab that has accumulated rather more services than was originally planned.

DockerKubernetesEKSHelmProxmoxLXC

🤖

AI-Augmented Engineering

Using AI tooling daily for infrastructure work — agentic workflows, LLM-assisted IaC, structured prompting for specific engineering tasks. Primarily because it is faster than doing things the slow way, and the slow way was never that enjoyable to begin with.

Claude Sonnet 4.6Agentic AIPrompt EngineeringGitHub CopilotTool Use

📚

Documentation as Code

Documentation that updates itself from source repositories is considerably more accurate than documentation that doesn’t. Built a platform to do that. Also wrote the usual guides, runbooks, and onboarding docs that every platform team eventually needs.

MkDocsDocOpsMarkdownGitHub API

💻

Programming & Scripting

Python for automation that needs to be maintainable, Perl since the ‘90s through force of habit, Groovy for Jenkins, Bash for everything else. PowerShell when Windows leaves no other option. The language is usually less important than just automating the thing.

PythonBashPerlGroovyPowerShell

🔭

Observability & Governance

Steampipe for cross-account querying, Splunk, CloudWatch, Prometheus, Grafana. Governance, cost optimisation, orphaned resource identification — the unglamorous end of cloud work that is nonetheless worth doing, preferably by a script.

SteampipeSplunkCloudWatchPrometheusGrafana

Career Arc

How We Got Here

1991 – 1997

WWIV BBS Sysop

Information Society BBS · Washington DC Area (703/202)

Multi-node WWIV BBS on 703 and 202 area codes — networked, multi-user, 24/7. Building and operating networked systems before the internet was a household concept. Continued through university (1995–97). Currently exploring a Proxmox-hosted revival.

2003 – 2013

Top Secret / SCI · CI Polygraph

U.S. Government Security Clearance · Inactive

Held Top Secret/SCI clearance with Counterintelligence Polygraph throughout tenures at Lockheed Martin and Sotera Defense Solutions, supporting classified U.S. Government programmes in Virginia and England.

2003 – 2005

Unix Systems Administrator

Lockheed Martin Space Systems / Program 431 · Springfield, VA

Unix systems administration. Also built INFORManagement, an internal application for technical statistics reporting, which was apparently useful enough to warrant a Lockheed Martin Spot Award — a pleasant surprise.

SolarisUnixTS/SCI

2005 – 2010

Senior Unix Systems Administrator

Lockheed Martin · RAF Menwith Hill, North Yorkshire

Solaris administration across a large estate. Hardened baselines, directory services rationalisation, DNS, LDAP/AD integration, NTP, patch management. Most of it scripted in Perl and CSH because doing it manually at scale seemed inadvisable.

SolarisLDAPCentrifyBIND 9CitrixNTPTS/SCI

2010 – 2011

System Administrator Team Lead

Sotera Defense Solutions / Aerospace Data Facility–East · Fort Belvoir, VA

Managed a team of 14 Unix and Windows administrators. C&A testing for a major government system re-accreditation, Sun E15k domain management, multi-network authentication environments. The sort of role where things going wrong had noticeable consequences.

SolarisE15kLDAPC&ATS/SCI

2011 – 2013

Technology Consultant Level 4

Hewlett-Packard · Chantilly, VA

Oracle IAM deployment for a U.S. Government customer — Access Manager, WebLogic, Identity Federation, and related components. Perl automation for build and PKI processes. Final role before relocating to the United Kingdom.

Oracle IAMVMwarePKIPerlSubversionHudson

Moved from Virginia to Yorkshire. Unix administration turned out to be much the same on either side of the Atlantic, which was convenient.

2013 – 2014

Infrastructure Operations Analyst

William Hill · Leeds, UK

First role after relocating to the UK. Unix-based project engineering, PCI DSS compliance work. A straightforward transition into commercial infrastructure.

UnixLinuxPCI DSSUK Career Reset

2014 – 2017

Middleware Systems Administrator Lead

Enterprise Financial Services · Knaresborough, UK

Third-line engineering for IBM Sterling Integrator. TLS 1.2 upgrades, Secure+ configuration across Connect:Direct links, EBICS protocol implementation with Deutsche Bank. Middleware work: not glamorous, but the banks seemed to appreciate it.

IBM SterlingConnect:DirectEBICSTLS 1.2

2017 – Present

Senior Cloud Platform Engineer → Cloud DevOps Consultant

Enterprise Financial Services · Knaresborough, UK

Platform engineering in a small team: AWS infrastructure automation, golden image lifecycle, IaC tooling, Transit Gateway networking, Squid proxy fleet, compliance automation across a large multi-account environment. Also built a DocOps platform that generates documentation from internal repositories automatically — the sort of thing that pays for itself fairly quickly. Wrote M3 (Module Migration Monster), a Python tool for migrating Terraform modules from a monorepo to independently versioned repositories; it was quicker than doing it by hand. More recently: integrating AI tooling into day-to-day infrastructure delivery, which is mostly an exercise in working out what it’s actually good at versus what sounds impressive in a blog post.

AWSTerraformPythonJenkinsGitHub ActionsPackerAnsibleCloud CustodianSteampipeWizClaude Sonnet 4.6

Paper Trail

Training & Certifications

A chronology that starts with Solaris and ends with cloud security — neatly summarising two decades of infrastructure evolution. Expired AWS certs are shown for completeness; they represent real delivered work, not wishful thinking.

2019–2022

AWS Security Specialty

Amazon Web Services · Expired

2017–2019

AWS Certified Solutions Architect Associate

Amazon Web Services · Expired

2014

InfoBlox DNS Advanced Administration

InfoBlox

2009

Red Hat Certified Engineer (RHCE)

Red Hat · Rapid Track Course · Expired

2007

Red Hat Network Services & Security

Red Hat

2001

Sun Microsystems Solaris 8 System Administration I & II

Sun Microsystems · The beginning of a beautiful, painful relationship with Unix

Side Quests

Projects

Homelab · Running

The Lab

Proxmox HA cluster with rack-mounted UDM Pro Max, USW-Aggregation switch, LACP 802.3ad LAG, 2U UPS, and Synology NAS. Runs an offline GB mapping stack (Protomaps + MapLibre GL, Valhalla routing, custom SQLite geocoder), self-hosted Plex, Home Assistant, Docker services, NUT UPS monitoring with automated shutdown scripting. Built to stay up.

Explore the Home Lab ↗

Live · Chicken Cam

clucks.net

A live dual-camera stream from a backyard chicken coop, available 24/7. Containerised FFmpeg, UniFi Protect, RTMP to YouTube Live, Home Assistant for day/night switching, Cloudflare for delivery. A slightly overengineered solution to a problem that did not strictly require solving.

Visit clucks.net

Live · ADS-B · Aviation

York ADS-B

A dedicated 1090 MHz outdoor antenna over North Yorkshire — RadarBox FlightStick receiver with integrated bandpass filter, 20.5 dB amplifier, and ESD protection — decoding ADS-B transponder signals and feeding real-time position data to 11 flight tracking platforms simultaneously across 6 MLAT networks. Deployed via Docker on a dedicated VM running ultrafeeder, FR24, FlightAware, RadarBox, PlaneFinder, OpenSky, ADS-B Exchange, airplanes.live, adsb.fi, ADSB One, adsb.lol, and Plane.watch. Every frame decoded is shared with millions of users worldwide — filling coverage gaps over rural North Yorkshire. Passive receive only; no transmissions, no interaction with aircraft.

RadarBox EXTRPI709473
Flightradar24 T-EGXU127
FlightAware site 274543
PlaneFinder UNPUBLISHED
OpenSky Network
ADS-B Exchange
airplanes.live
adsb.fi
ADSB One
adsb.lol
Plane.watch

Home Automation · Live

OpenHASP Display Network

16 Lanbon L8 touchscreen switches running OpenHASP, driven by Home Assistant via MQTT. Sensor data, energy stats, lighting, EV charging, doors, motion — 12 pages per device. Some are light switches with screens; others are just information panels. Built entirely in YAML, which is either elegant or a poor life decision depending on how the mood strikes.

Live Display Preview ↗

Community · Pro Bono · Live

The United Benefice

Website for five Church of England village churches in the Vale of York, including a Grade I listed building sketched by Anne Brontë in the 1840s and a chapel designed by Sir George Gilbert Scott. Built, hosted and maintained pro bono. Modernised typography, accessible layout, safeguarding information. Self-hosted on Ubuntu with NFS storage — same stack as everything else.

Visit theunitedbenefice.co.uk

Retro · In Progress

WWIV BBS Revival

Reviving the Information Society BBS on Proxmox — telnet, SSH, web terminal via ttyd/Xterm.js, and potentially dialup via USB modem passthrough. Domain: wwiv.uk. The goal is to restore a functioning WWIVnet node for the UK. Some things deserve to exist again, and the BBS community never really went away — it just got very quiet.

Visit wwiv.uk

Amateur Radio · In Progress

UK Foundation Licence

Studying for the RSGB Foundation licence, exam expected June 2026. The practical motivation is packet radio: a 2m node running Direwolf and LinBPQ, 9600 baud where possible — the kind of thing that makes more sense once you’re licensed to transmit. The ADS-B station started this particular side-quest; a transceiver seems like the next logical step, examiner permitting.

Energy · Home Automation

Off-Grid-ish

Solar panels, battery storage, and a heat pump — integrated into Home Assistant with Octopus tariff optimisation. Still waiting on the DNO. Patience is a virtue, apparently.

Music · Taste Questionable, Volume Appropriate

Industrial / EBM

Industrial, EBM, and whatever genre Rammstein technically belongs to: Skinny Puppy, Front 242, KMFDM, Funker Vogt, Eisenfunk, Lindemann, FGFC820, CortexUS. Falco before bed. Everyone has their quirks and these happen to be mine.

THE LAB — 9U RACK — YORK, NORTH YORKSHIRE

SELF-HEALING · AUTOMATED · ZERO UNPLANNED OUTAGES

Compute

ClusterProxmox VE — 2-node HA

Node 1 (pve1)Minisforum MS-01

Node 2 (pve2)Minisforum MS-01

KVMJetKVM × 2 (rack-top)

BondingLACP 802.3ad LAG · layer3+4

Storage

NASSynology RS1221+

Primary4 × 16TB HDD · SHR · 42TB usable

Secondary4 × SSD scratch & dev bays

Raw capacity64TB · ~42TB available

Ollama models~27 LLMs on NAS volume

MediaPlex lifetime · full arr stack

Networking

RouterUniFi UDM Pro Max

Core switchUSW-Aggregation (SFP+)

Access switchUSW-Pro-Max-16-PoE

CamerasUniFi Protect · G5 series

Switches16 × Lanbon L8 OpenHASP

Power & Resilience

UPSUniFi UPS 2U

MonitoringNUT · HA automation

ShutdownGraceful after 15 min on battery

Solar backup6.8kWp + Powerwall 3 (27kWh)

Self-Hosted Services

AutomationHome Assistant · 6+ years

MeshZigbee2MQTT · full mesh

ADS-BRadarBox FlightStick · 1090 MHz Dedicated Antenna → 11 trackers

RadiationGMC-800 Geiger counter

Chicken camclucks.net · 24/7 live

Offline Stack

MapsProtomaps + MapLibre GL (GB)

RoutingValhalla · GB-only

GeocodingOS Code-Point + 4.2M places

AI (local)Ollama · deepseek-r1, gemma3…

#	DIST (NM)	AIRLINECALLSIGN	ALT (ft)	SPEED (kt)	HDG	SIGNAL	RECORDED	SQUAWK	CAT
Loading...

AIRLINECALLSIGN	LAST HEARD	ALT (ft)	SPEED (kt)	HDG	DIST (NM)	MSGS	SIGNAL	SQUAWK	CAT
Loading...

AIRLINECALLSIGN	ALT (ft)	SPEED (kt)	HDG	DIST (NM)	SIGNAL	SQUAWK	CAT
Loading...

OPENHASP DISPLAY NETWORK — DESK UNIT LIVE FEED

16 × LANBON L8 · OPENHASP FIRMWARE · HOME ASSISTANT MQTT · YORK, NORTH YORKSHIRE

AUTO-REFRESHES EVERY 10s

Hardware

DeviceLanbon L8 Smart Switch

Display240 × 320px IPS touchscreen

FirmwareOpenHASP (open-source)

Quantity16 devices

Form factorsUK wall switch + tabletop

ConnectivityWi-Fi · MQTT

IntegrationHome Assistant via hasp-lvgl

ConfigYAML automations, no custom apps

Display Pages (12 per device)

P0Status bar — temp, time, weather, energy, radiation

P1Room lights — 24 toggle buttons, all rooms

P2Scenes — room selector + 12 Hue scenes + dimmer

P3Security — 8 doors & 8 windows live state

P4Motion — 20 internal & external PIR sensors

P5Outdoor lights — 6 zones

P6Ceiling fans — 7 fans individually controlled

P7Energy — grid/solar/battery + 40 circuit breakdown

P8EV charging — 2 Zappi chargers, mode control

P9Velux — 4 motorised skylights open/close

P10Radiation — GMC-800 gauge + CPM + status

P11Alarm — keypad PIN entry

Status Bar Key (top of every page)

19.6°C (left)Indoor temperature

🌡 iconHeating active indicator — orange = heating

23:36 (cyan)Current time

Weather iconCurrent conditions (colour-coded)

6.0°C (right)Outdoor temperature

£X.XX (cyan)Today’s energy cost (Octopus API)

CPM (green)Radiation count — GMC-800 Geiger counter

💧 XX% (blue)Rainwater butt fill level

XXkW (orange)Current grid power draw (negative = export)

Devin
Mitchell

About Me

What I Do

How We Got Here

Training & Certifications

Conferences & Events

Projects

Get In Touch