Open to opportunities
IT Infrastructure Analyst
Linux, networking and automation. Infrastructure deployed with one command and documented as code.
01 — Terminal
Every command is resolved server-side: Django queries the same models that render this page.
02 — Profile
IT Infrastructure technician with hands-on experience in support, networking, Linux and Python automation. I focus on shipping efficient solutions, providing effective technical support, and keeping infrastructure secure and running. Driven by innovation and continuous improvement.
03 — Experience
Thot Computación ·Montevideo, Uruguay
Aug 2026 — present 2 mos
Slantis LLC ·Montevideo
Feb 2026 — Mar 2026 1 mo
Kópel Sánchez ·Montevideo, Uruguay
Nov 2024 — Feb 2026 1 yr 3 mos
04 — Education
Graduated
Universidad ORT Uruguay
2023 — 2025
Graduated
Universidad ORT Uruguay
2023 — 2025
In progress
UDELAR
2020 — present
Completed
Taller de informática
October 2022 — December 2022
05 — Skills
Levels self-assessed against real work experience and personal projects.
Daily administration, hardening, systemd
Virtualisation, cloud-init templates, GPU passthrough
Active Directory, GPO, file services
Provisioning and maintenance scripting
Automation across Windows and Proxmox
Multi-stage images, compose, registries
HA clusters, kube-vip, Calico, RBAC
Exposing services on bare-metal LAN
Replicated distributed storage
Automation, scraping, APIs, bots
Provisioning on Proxmox and cloud
Reproducible VM templates
Server fleet configuration
CI/CD, image build and publish
Administration for 150+ users
EC2, S3, IAM, VPC
Compute Engine, IAM, storage
Internal network segmentation and tuning
Firewall, captive portal, HA
Internal network services
Site-to-site and road-warrior VPN
WPA2-Enterprise network authentication
Minimal surface, key-only SSH, scoped sudo
Digital locking and physical access
Detection and active response
CVE scanning and remediation
Branching, review, CI workflow
Management apps, ORM, admin, deployment
Modelling, queries, backups
Interfaces without heavy frameworks
06 — Projects
Infrastructure, networking and automation that actually run — not classroom exercises.
Highly available kubeadm cluster, scalable to N nodes, provisioned with Terraform and bootstrapped with a single command.
Migrated a WPA2-Enterprise (802.1X / RADIUS) WiFi to an open network with a captive portal, reusing the existing RADIUS as the user store and adding guest vouchers.
Collects job posts from several boards, de-duplicates against SQLite, scores how well each one fits the profile and pings Telegram only with what is worth reading.
Django application for appointments and patients, with its infrastructure deployed by Terraform on Proxmox and a vulnerability audit of the stack.
Integration wiring Wazuh alerts to the Cloudflare API to block attacking IPs at the edge, before they ever reach the server.
Containerised an application that ran straight on a VM and moved it to Kubernetes manifests, with persistent storage and ingress.
The site you are reading. Django + PostgreSQL in an unprivileged Proxmox LXC, supervised by systemd, with content editable from the admin and zero third-party JavaScript.
No projects in this category.
07 — Infra
The portfolio is the project too: here is what sits behind the domain.
Tap any piece of the diagram to see the detail.
A browser requesting cv.juanmonigo.com over HTTPS. It loads zero third-party bytes: no CDNs, no remote fonts, no analytics.
Terminates TLS and routes by host name to the container. It is the same proxy that already publishes the rest of the home services, so certificates and renewal are a solved problem.
A Debian container on Proxmox VE with 2 vCPU and 1 GB. Unprivileged: root inside is not root on the hypervisor. No nesting, because there are no containers inside the container.
systemd supervises gunicorn with Type=notify, so the service is not considered started until it really accepts traffic. The unit runs as a shell-less user, with the filesystem read-only except two paths and no capabilities at all.
Stores the whole CV, in a container of its own. It listens only on its private IP, with TLS and scram-sha-256; pg_hba accepts a single line and the firewall allows 5432 from one address only. Between the internet and this data there are two hops and two DROP policies.
The photo and PDF uploaded from the admin live in /var/lib, outside the application directory: a redeploy that replaces /opt/cv-web does not wipe them. Backup is the CT snapshot plus a weekly pg_dump.
/healthz answers without touching the database and /readyz checks that PostgreSQL responds. update.sh does not call a deploy good until /readyz answers; if it fails, the previous version keeps running. A probe of its own queries the database every minute and sends mail: a signal nobody watches is worth nothing.
What separates "a process that serves a web page" from "a process that can do anything". Everything the application does not need is taken away.
[Service]
Type=notify
User=cvweb
EnvironmentFile=/etc/cv-web/cv-web.env
ExecStart=/opt/cv-web/.venv/bin/gunicorn config.wsgi:application \
--config /opt/cv-web/deploy/lxc/gunicorn.conf.py
ExecReload=/bin/kill -s HUP $MAINPID
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateDevices=yes
RestrictNamespaces=yes
MemoryDenyWriteExecute=yes
SystemCallFilter=@system-service
CapabilityBoundingSet=
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
# Todo el disco en solo lectura salvo estas dos rutas.
ReadWritePaths=/var/lib/cv-web/media
ReadWritePaths=/opt/cv-web/staticfilesThe container is created from a script, not from the GUI: that way it can be rebuilt identically a year from now without remembering which boxes were ticked.
# unprivileged=1: el root del contenedor NO es el root del host.
pct create "$CTID" "$TEMPLATE" \
--hostname cv-web \
--cores 2 --memory 1024 --swap 512 \
--rootfs "NVME_STORAGE:8" \
--net0 "name=eth0,bridge=LAN,ip=10.20.30.40/25,\
gw=10.20.30.1,firewall=1" \
--nameserver 10.20.30.5 \
--unprivileged 1 \
--features nesting=0,keyctl=0 \
--onboot 1 \
--ssh-public-keys "$SSH_PUBKEY"Order matters: validate first, reload after. If the deployment check fails, gunicorn keeps serving the previous version and the site never notices.
run_manage migrate --noinput
run_manage collectstatic --noinput
# Si la configuracion quedo mal, mejor enterarse ahora que despues
# de reiniciar el servicio y quedarse sin sitio.
run_manage check --deploy --fail-level ERROR
# SIGHUP: los workers nuevos levantan antes de que bajen los viejos,
# asi que un despliegue no devuelve un solo 502.
systemctl reload cv-web
sleep 3
curl -fsS http://127.0.0.1:8000/readyz >/dev/null \
|| { journalctl -u cv-web -n 40 --no-pager; exit 1; }The terminal simulates nothing: each command queries the same models that render the page, which is why it is covered by tests.
def run(raw: str, lang: str = "es") -> Result:
"""Resuelve una linea de comando completa."""
lang = norm_lang(lang)
raw = (raw or "").strip()
if not raw:
return Result([])
parts = shlex.split(raw)
name = ALIASES.get(parts[0].lower(), parts[0].lower())
handler = COMMANDS.get(name)
if handler is None:
return _unknown(parts[0], lang) # sugiere el comando mas parecido
return handler(parts[1:], lang)08 — Contact
Looking for someone to keep the infrastructure standing? Drop me a line.