sahan.sithum

IT Operations Engineer

T+0.00s

  • [ .... ]Reached target network-online.target

PersistentKeepalive = 2501 / 05 units

PersistentKeepalive = 25Colombo, Sri Lanka · --:--:--

W. Sahan Sithum

IT Operations Engineer

I keep cloud fleets, Linux servers, devices and networks alive, and build the quiet tooling that keeps them that way.

See the workOpen a tunnel

01uptime

Four years of uptime.

I'm an IT operations engineer with more than four years across cloud, Linux and network operations. I work across the whole operational stack, from server and network administration to automation and security.

Right now I run a Hetzner Cloud fleet at Atlas Labs: self-hosted Headscale and WireGuard access, monitoring and alerting, custom kiosk Linux builds for ARM boards, and update tooling that can roll back safely. Before that I worked on Oracle Cloud, Microsoft 365, Windows Server and campus networks.

I pick up unfamiliar systems quickly, and I like automation that is idempotent, audited and easy to reverse.

Now
IT Operations Engineer, Atlas Labs
Degree
BSc (Hons) Network Technology & Cyber Security
Training
CCNA v7 course
Based in
Colombo, Sri Lanka
in IT operations

4+years

workstations managed

50+

mailboxes migrated

40+

selected projects

9

02stack

From the board to the bash script.

Six layers I work across, with security running through every one of them. Pick a layer, or let it cycle.

  • Scripts and pipelines that poll, alert, sync and ship.

    BashPythoncronnode_exporterRcloneRsyncAPI → alerting pipelines

03work

Things I've built and run.

Selected projects from production: monitoring, access, embedded builds, fleet tooling, cloud automation, campus networking, endpoints and migrations. Open any of them for the full case study: the problem, how it works and what changed.
THRESHOLDALERTALERTALERT01

Atlas Labs · Monitoring

Hetzner Fleet Monitor

Problem
Dozens of cloud servers across many projects, and no single place to see their load or be told when one is struggling.
Built
Zero-dependency monitoring stack: an API poller, a SQLite store, an alert engine and a single-file HTML dashboard.
BashPythonSQLiteHetzner API
Read the case study
HEADSCALE02

Atlas Labs · Networking

Headscale Access Plane

Problem
Access to servers and devices depended on SSH keys copied host by host, which is hard to audit and harder to revoke.
Built
Self-hosted Tailscale control plane that replaced per-host SSH keys across a device fleet. It runs the live kiosk network.
HeadscaleWireGuardLinux
Read the case study
› bootloader› mount rootfs› network up · tailnet› kiosk.service ok03

Atlas Labs · Embedded

Custom Kiosk OS

Problem
The kiosk OS only ran on one board model, and the fleet was moving to new hardware that had to behave exactly the same.
Built
Purpose-built Linux image and reproducible build pipeline for Orange Pi 5 Pro kiosk hardware, validated on physical devices.
Debianorangepi-buildsystemd
Read the case study
ROLLBACKv2.3v2.4v2.3v2.4.104

Fleet ops

Device Update Orchestrator

Problem
Devices in the field were updated by opening an SSH session to each one, by hand, one at a time.
Built
Remote fleet update tool over WireGuard, with verification, rollback and an audit trail.
BashWireGuardSSH
Read the case study live demo inside
LOCALSCANOCIQUARANTINE05

S P Solutions · Cloud

Cloud Automation

Problem
Several people uploaded large batches of files to Oracle Cloud by hand, with nothing to stop malware reaching storage.
Built
Automated bulk uploads to Oracle Cloud Infrastructure with virus scanning and quarantine handling for secure large-scale transfers.
OCIRcloneClamAVVirusTotalBash
Read the case study
GODADDYMICROSOFT40+ MAILBOXES06

S P Solutions · Collaboration

Microsoft 365 / Exchange Migration

Problem
The company's email ran on a GoDaddy-managed Microsoft 365 tenant and had to move to a tenant managed directly with Microsoft.
Built
Tenant-to-tenant migration (GoDaddy to Microsoft Direct) of 40+ mailboxes, preserving mailbox integrity with minimal downtime.
Microsoft 365Exchange Online
Read the case study
~100 M · NO CABLEMAIN × 3NEWONE NETWORK07

Win-Stone Campus · Networking

Multi-Building Campus Network

Problem
A new building 100 m away needed to join the campus network, but cable couldn't cross the private land in between and there was no budget for enterprise gear.
Built
Split a campus network into subnets on basic ISP routers and unmanaged switches, then joined a building 100 m away over a wireless bridge, so all four buildings and their ~60 CCTV cameras ran on one network.
SubnettingRuijie wireless bridgeHuawei routersRuijie APs
Read the case study
CONSOLE50+ PCS · ONE CONSOLE08

Win-Stone Campus · Endpoints

Campus Endpoint Management

Problem
Over 50 PCs spread across the campus, and the only way to check on one, lock it or restart it was to walk over to it.
Built
Desktop monitoring and endpoint management with Net Monitor for Employees for 50+ PCs across the campus, run from one console: live screen view, remote control, power actions, messages, screen lock, traffic blocking, and batch actions such as sending files that open on arrival.
Net Monitor for EmployeesRemote controlBatch actionsWindows
Read the case study live demo inside
DOMAINOU-1OU-2OU-3GROUP POLICY → 30 LAB PCS09

Win-Stone Campus · Infrastructure

Windows Server 2019 Deployment

Problem
A 30-PC computer lab needed central logins, addressing, file sharing and policy, kept apart from the rest of the campus network.
Built
An isolated computer-lab domain: one Windows Server 2019 machine running AD DS, DHCP, DNS, File Server, WDS and Group Policy for 30 client PCs.
Windows ServerActive Directory
Read the case study live demo inside

04own tools

Tools I built on my own.

Problems I solved in production, rebuilt as standalone tools. Plus an offline Android app for personal finance. The repositories are private for now; I am happy to walk through the code.

persistentkeepalive/zeroagent

Cloud monitoring with nothing installed on the servers.

Polls Hetzner Cloud, Linode and DigitalOcean every two minutes, keeps 72 hours of metrics in local SQLite, alerts to the desktop or any webhook, and writes one self-contained HTML dashboard.

  • #stdlib-only
  • #no-agent
  • #read-only-tokens

$ zeroagent selftest

seeded 180 + 180 samples across 2 synthetic servers

opened [WARN] cpu_high CPU 94.7% on selftest-hot

escalated [CRIT] cpu_high CPU 94.7% on selftest-hot

dashboard: ~/.local/share/zeroagent/dashboard.html

PythonSQLiteHetznerDigitalOcean

persistentkeepalive/ts-coexist

Look before you join the mesh.

Joins a Linux device to Tailscale or Headscale without disturbing the networking it already has. By default it installs nothing: it checks the CGNAT range, existing WireGuard, routes and DNS, reports, and stops.

  • #check-first
  • #refuses-on-conflict
  • #single-file

$ sudo ./ts-coexist.sh --check

[ ok ] cgnat 100.64.0.0/10 is free

[ ok ] wireguard wg0 stays untouched

[warn] port UDP 41641 in use, another is picked

VERDICT No blocking conflicts. Safe to install.

BashTailscaleWireGuard

persistentkeepalive/zerobyte

Database backups that verify before they delete.

Runs PostgreSQL and MySQL/MariaDB dumps inside your containers, uploads them through rclone, verifies the stored copy, and applies retention only after a good upload. Works with Compose, Coolify or plain Docker.

  • #verify-then-prune
  • #no-control-plane
  • #bash

$ sudo zerobyte backup --dry-run

$ sudo zerobyte backup

$ sudo zerobyte check

BashDockerRclonePostgreSQLCoolify

persistentkeepalive/Ledger

Offline money, on your phone.

An offline Android expense tracker and monthly savings planner: cash, bank accounts, credit cards and loans, budget against actual spending, and whether a savings goal holds up. No cloud and no bank login.

  • #offline-first
  • #encrypted-backups
  • #CSV-import

$ git tag -n --sort=-v:refname | head -3

v4.28 installation compatibility update

v4.27 encrypted backups, CSV imports, account currencies

v4.26 clean touch feedback

AndroidCapacitorJavaScript

field notes

Things that broke, and what fixed them.

All notes

05method

Ship in waves. Keep a way back.

How I change a fleet: canary first, then waves, with health checks, automatic rollback and an audit trail. Below is a simulated run in the style of the update tooling I build.

fleet · 40 devices · 0 on v2.4

  1. Canary

  2. Wave 1

  3. Wave 2

  4. Wave 3

  5. Done

v2.3updatinghealthy v2.4failedrolled back
rollout.logpaused
  • 01

    Idempotent

  • 02

    Append-only

  • 03

    Staged

  • 04

    Reversible

  • 05

    Audited

06on call

You're on call. Fix it like I would.

Pick an alert. Each choice runs a check and shows you what came back, and the clock keeps running. These incidents are simulated, built around the kinds of systems I run.
SEV2 · headscaleT+00:00 simulated

node-12 last seen 14 min ago

One remote device stopped checking in, and the service it runs is down.

  1. Nothing run yet. Choose your first move below.

step 1/4Where do you look first?

07experience

The route so far.

$ traceroute career.sahan

4 hops · 2021 → now

  4. Nov 2025 – now

    • Manage and profile a Hetzner Cloud server fleet, with backup and server-audit tooling.
    • Administer Arch and Debian servers; deploy containerised apps with Docker and Coolify.
    • Run secure remote access: WireGuard networks, a self-hosted Headscale control plane, Cloudflare Tunnels and SSH key lifecycle management.
    • Build monitoring and alerting: metrics collection, threshold alerts and reporting dashboards.
    • Automate routine maintenance across remote Linux systems with Bash and SSH.
    • Build custom kiosk OS images for ARM single-board hardware, validated on physical devices.
    • Handle secrets hygiene and remediation, script auditing and package supply-chain vetting.

08education

Trained, and still learning.

2023 – 2024complete

BSc (Hons) Network Technology & Cyber Security (top-up)

Lincoln University College

2025complete

CCNA v7 course, institute exam passed

SLYSC

2021 – 2022complete

NVQ Level 4 — Computer Hardware & Network Technician

NVTI, Narahenpita

2026 – presentin progress

Cyber Security Bootcamp

Stem Link

09shell

Prefer a terminal?

Everything on this page, as a shell. Same facts, fewer pixels.

try

Tab
complete a command or file
↑ ↓
walk through history
Ctrl+C
interrupt
Ctrl+L
clear
Esc
leave the shell
sahan@portfolio: ~ — bashready
Last login: just now from your browser
Welcome to sahan.sithum (GNU/Linux, mostly).
Type help to see what's here. Tab completes, ↑ recalls, Ctrl+L clears.

10contact

Open a tunnel.

Have a role, a project or an infrastructure problem worth solving? Send a handshake.

Send a handshake
/etc/wireguard/sahan0.conf
1[Interface]
2# W. Sahan Sithum — IT Operations Engineer
3Address = Colombo, Sri Lanka
4LocalTime = --:--:-- (Asia/Colombo)
5
6[Peer]
7# you
8Email = ssithum422@gmail.com
9LinkedIn = in/sahan-weraduwage
10GitHub = persistentkeepalive
11AllowedIPs = roles, projects, ideas
12PersistentKeepalive = 25