Nguyễn Trung Hoàng Hải
Infrastructure / DevSecOps Engineer
Ho Chi Minh City, Vietnam
I build and defend the layers underneath other people's applications: the firewalls and routers at the edge, the Kubernetes clusters above them, and the pipelines that ship to both.
About
I work on system architecture, network engineering and DevSecOps across on-premises and cloud-native infrastructure. The same week can involve an HA firewall pair, a Kubernetes upgrade and a CI pipeline that refuses to ship an image with a critical CVE.
I work from the physical layer up: if I deploy a platform, I also run the network it sits on and the pipeline that feeds it. Alongside this I am finishing a Cyber Security degree at FPT University, which keeps the security half of the job grounded in more than tooling.
Stack
Systems Programming & Tooling
The parts I write myself when nothing off the shelf fits
- Go: DHCP, TFTP and HTTP servers, iPXE chainloading, iSCSI targets
- Rust: an internal VPN for remote access, with Windows and Linux clients
- Cloudflare Workers, D1 and React: control planes and dashboards for the above
- Custom WinPE environments built on WinRE
- GitHub Actions: reusable composite actions, published as open source
DevSecOps & Application Security
Checks that run before anything reaches production
- CI/CD security pipelines: Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST
- Kubernetes hardening: Kyverno policies, Pod Security Standards, RBAC
- Web application security testing: source-code review, privilege-escalation analysis, exposed-secret discovery
- Incident response: root-cause analysis, webshell and malware removal, data recovery
- Digital forensics: FTK Imager, Autopsy
- Rust supply-chain tooling: cargo audit, cargo deny, cargo geiger
Cloud-Native & Platform Engineering
Where the applications actually run
- Kubernetes: kubeadm clusters, Calico CNI, Traefik ingress, ArgoCD GitOps, CloudNativePG
- Autoscaling: HPA and metrics-server tuning against real workload profiles
- Proxmox VE: multi-node clusters, live VM migration across independent clusters, REST API automation
- Docker: distroless image builds, deployment through Dokploy
- Self-hosted services: Odoo, Strapi, GitLab CE
- Monitoring: Zabbix with TimescaleDB, Prometheus and Grafana
Network & Security Infrastructure
The edge: routing, firewalls, wireless and identity
- CCNA-level routing and switching: OSPF, ACLs, NAT, VPN, SDN
- FortiGate: HA clustering, VLANs, IPsec and SSL VPN, IKEv2, VIP/DNAT, traffic shaping
- Config migration between FortiGate models and generations without vendor conversion tooling
- UniFi network administration across sites
- Windows Server: Active Directory, RADIUS, Group Policy
- Zimbra mail server administration
Projects
-
in production
hPXE
Go, Cloudflare Workers, D1, React
A network boot server written in Go that speaks DHCP, TFTP and HTTP from a single binary, chainloads iPXE, and serves multiple ISOs over iSCSI sanboot so a machine can pick an installer at boot. A control plane on Cloudflare Workers and D1 keeps the boot menu and target inventory, with a React dashboard on top.
-
in development
Internal VPN
Rust, Windows, Linux
A replacement for the SSL VPN we currently use for remote access, written in Rust with clients for Windows and Linux. Still in design and implementation; the goal is a smaller trusted surface and a client we can actually debug, rather than another appliance feature.
-
in production
Production Kubernetes platform
kubeadm, Calico, Traefik, ArgoCD, CloudNativePG
Built from bare kubeadm rather than a managed service: Calico for networking, Traefik for ingress, ArgoCD for GitOps delivery and CloudNativePG for Postgres. It hosts real Spring Boot and Next.js workloads, with HPA and metrics-server tuned against their traffic instead of defaults.
-
internal tool
Proxmox cross-cluster migration toolkit
Bash, Proxmox REST API
Proxmox will live-migrate a VM inside a cluster but not between independent ones. This toolkit drives the REST API to do it anyway: it reconciles storage and network definitions on both sides, moves the disks, and cuts over with the guest still running.
-
in production
CI/CD security pipeline
Semgrep, Trivy, GitHub Actions
Security gates wired into the delivery pipeline rather than bolted on afterwards: Semgrep for static analysis, Trivy for dependency and container scanning, with findings failing the build at defined severities. DAST with OWASP ZAP is being added next.
-
internal tool
Custom WinPE deployment environment
WinRE, WinXShell
A deployment environment built on WinRE with the WiFi stack restored, a WinXShell GUI, and an immutable disk layout so technicians cannot accidentally persist changes between machines. Used for imaging and recovery work in the field.
-
open source
Distroless container images
Wolfi, Trivy, GitHub Actions
Three families of minimal base images on GHCR: a jlink-trimmed Temurin JRE for Java 17, 21 and 25; an nginx build with ModSecurity v3 and the OWASP Core Rule Set compiled in statically; and builder/runtime pairs for Node.js 22 and 24. All of them sit on Chainguard Wolfi, run non-root with no shell and no package manager, and rebuild nightly behind a Trivy gate that fails the build on a CVE of any severity.
-
open source
GitHub Actions composites
GitHub Actions
A set of reusable composite actions covering the build, scan and deploy steps I would otherwise copy between repositories. Kept public so the pipelines above stay readable instead of accumulating a hundred lines of inline YAML each.
Education
- FPT University
- B.Sc. Information Security Final year, graduating December 2026
Contact
Reach me at hainthvl@gmail.com. Most of my work lives on GitHub: morningstar-sudo for tooling and infrastructure, morningstar-sudo for the published container images. I'm also on LinkedIn.