Test, integration and DevOps · legacy system modernization · automation and AI
- I work in test, integration and DevOps in the defense industry. Right now I focus on improving internal processes and structures in a digital transformation team.
- I work on modernizing legacy Python 2.7 / Django codebases, CI/CD and test automation, and AI-assisted automation.
- I like combining technical leadership with hands-on delivery: working with board-level stakeholders and shipping the work in the field.
- Working languages: Turkish, English (upper advanced).
Most of these are tested in CI against the real software (Asterisk, Ubuntu, systemd, nftables, Django, Wireshark) rather than mocks. The ones that involve an AI model put the deterministic part first: CI never needs an API key, and where a model writes text it is checked against the data and rejected if it breaks the facts.
| Project | Description |
|---|---|
| secure-pipeline | A small Java 21 service and a GitHub Actions pipeline that checks dependencies (OSV-Scanner), code (SonarQube Community with the quality gate kept in the repo), the container image (Trivy) and the running service (OWASP ZAP baseline), and then feeds each check something wrong on purpose and requires it to fail. Actions are pinned by commit, images by digest, downloaded tools by checksum. A GitLab CI version is included; it is checked against GitLab's schema but has not been run on GitLab. |
| fetchlist | Lists what a build downloads (images, actions, URLs, packages), says what is not pinned and what a mirror or firewall allowlist has to hold. Reads Dockerfiles, GitHub Actions and GitLab CI, Compose files, shell scripts, requirements files and pom.xml; no dependencies. Run on my other 24 repositories it found 247 unpinned downloads; 245 are now pinned. |
| Project | Description |
|---|---|
| Dev-Ops (RNVCS) | An Asterisk-based voice communication system: zero-dependency Go services, a SIP/RTP engine, PostgreSQL and CI/CD with canary deployments. Starts with one Docker Compose command; verified on GitHub Actions with end-to-end tests against a real PostgreSQL. |
| asterisk-gcp-iac | Terraform and Ansible for a hardened Asterisk PBX on Google Cloud: SSH only through IAP, nftables, fail2ban, Prometheus metrics. CI builds the Terraform plan without credentials and checks it against policy rules, then applies the Ansible roles twice on real Ubuntu 22.04 and 24.04. |
| sip-regression | SIPp scenarios and a Python runner that put a real Asterisk through 22 checks: registration, calls, audio, hostile packets, load. Ten deliberately broken PBX configurations must fail them. |
| asterisk-exporter | A Go exporter with no third-party dependencies that turns the Asterisk Manager Interface into Prometheus metrics. Comes with a Grafana dashboard and unit-tested alert rules; verified in CI against real Asterisk 18 and 20. |
| asterisk-conf-lint | A security linter for Asterisk configuration files: open AMI, endpoints without passwords, weak secrets, toll-fraud dialplans. 25 rules, no dependencies, checked against real Asterisk 18 and 20. |
| rtp-quality | Jitter, packet loss and estimated MOS from pcap and pcapng captures of RTP, as text, JSON or Prometheus metrics. No dependencies; its numbers are checked against Wireshark and a real SIPp call. |
| Project | Description |
|---|---|
| nft-assert | Loads an nftables ruleset into a lab of real network namespaces, sends real packets and asserts what is accepted, dropped or rejected. Flow matrix, ruleset diff and per-failure rule tracing; standard library only. |
| systemd-harden | Finds which systemd sandboxing directives a service survives: tries them one at a time on the running service, runs your health check and writes a drop-in with the ones that passed. Tested on real systemd 249 and 255, x86-64 and arm64. |
| k8s-rollout-lab | A small service on Kubernetes and CI on a real kind cluster: under a steady load it rolls out a new version, ships a release that never becomes ready, drains a node and probes a NetworkPolicy, and counts the failed requests. A control without a readiness probe must lose requests. |
| gcp-baseline | A Terraform module for a safe Google Cloud project start (budget alerts, audit log sink, org policies, identities) and an OPA policy that checks any plan and names the rule it breaks. CI plans it with the real Google provider, without credentials. |
| ubuntu-hardening-roles | Nine Ansible roles that harden Ubuntu 22.04 and 24.04, and a read-only audit script. CI converges real machines, checks that a second run changes nothing, then breaks things on purpose and expects the audit to notice. |
| minimal-rootfs | A bootable Ubuntu 22.04 or 24.04 root file system built with debootstrap (about 185 MB). CI boots it in QEMU and fails if it grows past a size budget. |
| Project | Description |
|---|---|
| serial-sim | Simulated serial devices on pseudo-terminals: Modbus RTU slaves, scripted consoles and line streams, with seeded fault injection and a transcript of every byte. Checked against pymodbus, mbpoll and pyserial. For testing software that talks to hardware, without the hardware. |
| test-report-kit | Merges JUnit XML from repeated test runs, finds the flaky tests, groups failures by signature and writes one Markdown, HTML or JSON report. A CI gate with an expiring allowlist. |
| ci-failure-explainer | Explains why a GitHub Actions job failed: 57 rules, the log lines as evidence, and an optional model whose answer is checked against the log. |
| django-upgrade-lab | A small Django 1.11 project upgraded to 5.2 one LTS at a time. The upgrade is the git history: every stage is a commit that CI installs and tests on the Python version it was meant for. |
| Project | Description |
|---|---|
| legacy-modernizer-mcp | An MCP server that scans legacy Python 2 / Django projects, ranks the findings and drafts a migration plan. 52 rules, read-only analysis, tested in CI. |
| linux-diag-mcp | A read-only MCP server for Linux diagnostics over stdio: load, memory, disks, processes, ports, services and the journal. Strict argument validation, capped and redacted output; tested against real systemd on Ubuntu 22.04 and 24.04. |
| llm-redact | Masks IPs, hostnames, tokens, passwords and keys in logs and configs before they go to a model, then puts them back in the answer. No dependencies. |
| plan-explainer | Explains a Terraform or OpenTofu plan: what changes, what cannot be undone, what got opened up. 15 rules first; an optional model summary is rejected if it breaks the facts. |
| incident-digest | Turns a pile of log lines into a short digest of what happened and when: templates mined with Drain, bursts, what is new, what went quiet. |
| report-pipeline | CSV in, report out: the numbers are computed deterministically, and an optional model-written summary is rejected if it contains a figure that is not in the data. |
| prompt-regression | Regression tests for prompts: deterministic checks, repeated runs and a baseline that fails the build when a pass rate drops. |
| Project | Description |
|---|---|
| D-etud | An education platform where students ask teachers questions: React front end, Node.js/MongoDB API, JWT and Socket.IO. |
- Google Cloud and cloud architecture
- Kubernetes: rollouts, disruption budgets, network policies
- AI-assisted automation and building tools with MCP