Skip to main content
Mahin Raza
~/portfolio projects

Projects & Infrastructure Blueprints

Production systems, GitOps automation pipelines, OpenTelemetry labs, and SRE alerting architectures I’ve built and documented.

Platform & Automation Production

Zero-Database Engineering Blog & GitOps Syndication Pipeline

Architected a Git-driven engineering publication platform (blog.mahinraza.online) with zero runtime database dependencies. Markdown commits trigger CI validation, automated OpenGraph social card generation, client-side search indexing, and opt-in cross-posting to DEV and Hashnode with canonical SEO protection.

// Key Engineering Details
  • Automated Markdown & frontmatter linter (validate-blogs.ts) enforcing metadata, code fence languages, and asset integrity in GitHub Actions
  • Idempotent DEV.to and Hashnode API publishers that rewrite relative asset paths to canonical edge URLs
  • Sub-50ms edge delivery on Cloudflare Pages with immutable asset caching and strict security headers
Astro TypeScript GitHub Actions Cloudflare Pages Tailwind CSS REST / GraphQL APIs
Live Platform
Source
Observability & SRE Blueprint

Multi-Region SLO, Seasonal Baseline & Queue-Age Alerting Suite

Designed practical Prometheus recording rules and alerting contracts for distributed queues and multi-region services—replacing naive depth or global-average thresholds with deadline-age budgets, regional failure-domain SLIs, and explicit missing-telemetry detection.

// Key Engineering Details
  • Queue backlog alerting tied to oldest-eligible message age, consumer readiness, and stalled-progress detection
  • Per-region SLI ratios with absent-metric heartbeats so regional blackholes never hide behind healthy global traffic
  • Seasonal traffic anomaly diagnostics decoupled from customer-facing SLO burn-rate pages
Prometheus PromQL Alertmanager Grafana Amazon SQS SRE
Architecture Deep Dive
Observability & SRE Blueprint

OpenTelemetry Distributed Tracing & Context Propagation Lab

Built hands-on Python and microservice tracing experiments demonstrating how W3C traceparent headers propagate across service boundaries, why extracted remote contexts report isRecording=false, and how ParentBased samplers govern downstream span recording.

// Key Engineering Details
  • End-to-end W3C TraceContext extraction and injection across HTTP service boundaries
  • Deterministic verification of ParentBased(root=TraceIdRatioBased) sampling behavior
  • Clear separation of context propagation diagnostics from local span recording overhead
OpenTelemetry Python Distributed Tracing W3C TraceContext Docker
Architecture Deep Dive
Kubernetes & Cloud Blueprint

Cloud-Native Kubernetes & GitOps Delivery Environment

Reference Kubernetes deployment workflow combining hardened multi-stage container builds, GitHub Actions CI verification, Helm chart templating, health probes, and declarative rollouts with resource requests/limits and horizontal pod autoscaling.

// Key Engineering Details
  • Non-root multi-stage Dockerfiles with minimal attack surface and deterministic layer caching
  • Startup, readiness, and liveness probe separation to prevent premature pod restarts under cold start
  • Declarative namespaces, network policies, and HPA scaling policies managed entirely through Git
Kubernetes Docker Helm GitHub Actions Linux YAML
Source
IaC & Security Blueprint

Modular Cloud VPC & Linux Bastion Infrastructure Stack

Modular cloud infrastructure setup provisioning segmented public/private subnets, routing tables, least-privilege IAM roles, and cloud-init bootstrapped Linux instances with automated Vagrant local parity for rapid testing.

// Key Engineering Details
  • Reusable Terraform modules separating network topology, IAM policies, and compute lifecycles
  • Automated Linux host bootstrapping with SSH key-only auth, firewall rules, and systemd unit templates
  • Local multi-VM testing parity using Vagrant before applying changes to cloud environments
Terraform AWS Linux Vagrant Bash Networking
Source
Observability & SRE Blueprint

Small-Team Incident Command & On-Call Escalation Playbook

Codified an actionable incident command protocol tailored for lean engineering teams—making Incident Command, Operations, Communications, and Scribe responsibilities explicit even when combined on a two-person rotation, with clear triggers to split roles as severity grows.

// Key Engineering Details
  • Explicit role-handoff protocol preventing unnamed coordination gaps during high-stress incidents
  • Dedicated operational attention guardrails separating live production changes from stakeholder updates
  • Structured timeline capture for blameless post-incident reviews and action-item tracking
Incident Response SRE On-Call Runbooks Operations
Architecture Deep Dive