I'm Pavel Novotný, and under the IT2IT brand I build and operate software across the whole stack — from recovering data off broken RAID arrays, through my own server infrastructure, to AI applications and penetration tests. Everything you see here is actually running — on servers I administer myself.
§ 1
Four disciplines that meet on every project in practice. I design an application around where and how it will run — so operations, monitoring, backups and security aren't an afterthought, they're part of the brief.
Linux from GRUB to systemd. In a corporate estate I look after dozens of servers under monitoring that covers 200 hosts — plus my own VPS boxes with their own monitoring, backups and a runbook for every machine.
Docker · Traefik · Kubernetes
GitLab CI/CD · Ansible · Helm
Nagios · Grafana · SNMP
Veeam · 7/4/6 backups + offsite
E-commerce, CRM, booking and internal systems — from design to production. Tests are the standard, not an extra.
PHP · Laravel · Livewire
Python · FastAPI · Flask
TypeScript · Next.js · React · Vue
Java · Spring Boot
RAG over your own data, speech-to-text with speaker diarization, statistical models. Switchable providers and token costs kept under control.
Claude · GPT · Gemini
PostgreSQL + pgvector · Elasticsearch
Whisper + diarization
event studies · hedonic regression
Penetration testing, vulnerability management, server hardening and audit remediation — including tools I write for the job myself.
OpenVAS/GVM · nuclei · Wazuh
grey-box pentest · BOLA/IDOR
Sophos · UFW · fail2ban
PKI · PIM/PAM · DRP
§ 2
A cross-section of technologies I have worked with in production — from the network layer up to AI.
Kubernetes — cluster management and microservice deployments, Longhorn storage, PVCs, Kafka, Sentry, LDAP/GitLab integration. Docker, Helm, Traefik ingress, Elasticsearch via the ECK operator. Nexus as a central artifact proxy (Docker, Maven, PyPI, APT). GitLab CI/CD including Testcontainers and docker:dind.
Azure — Spring Apps, Redis, App Registrations, cost management and migrations back to on-premises. VMware vSphere (vCenter 8, ESXi, vCLS retreat mode), vSphere Replication 8.7 including DR failover/failback between MSA and DELL arrays. Proxmox VE cluster, Hyper-V and P2V migrations. Ansible and Terraform as Infrastructure as Code.
Active Directory, GPO, WinRM, OpenSSH, RDS farms with UPD/VHDX profiles, DNS replication between domain controllers, NTLM authentication audits ahead of domain controller migrations.
MySQL, MariaDB, PostgreSQL, MS SQL Server, Redis, Elasticsearch. Replication (MySQL GTID, PostgreSQL streaming standby) and promotion during failover, database engine upgrades with data preserved, mydumper/myloader for large dumps, web and database server clusters.
A backup platform with 36 TB of capacity and 24 automated jobs: databases, repositories, cloud storage, Microsoft 365 via the Graph API and network device configurations — all encrypted, with three-tier retention. Veeam B&R including tapes, Backup Exec 25 with PowerShell DR scripts, ZFS snapshots and replication, DR planning and testing.
Nagios, Zabbix, Grafana with API integration, PRTG with custom sensors and SNMPv3. Wazuh SIEM — agent rollout, indexer management, OpenSearch heap and watermark tuning, health monitoring scripts. Escalation, dependency and alerting policy design so that only a real problem wakes anyone up.
Cisco (NAT, port forwarding, AnyConnect split-tunnel ACLs), Oxidized for configuration backups, a custom NetFlow collector for traffic analysis, WireGuard, SSH tunnels via plink/NSSM. Postfix relay with LDAP/SASL, SpamTitan with DKIM, DNS record management (MX, CNAME, DKIM).
A two-tier OpenSSL CA (Root + Intermediate) for vCenter and internal servers with distribution via GPO, PKI with hardware HSMs, Sectigo certificates on Sophos XG, Let's Encrypt/ACME automation.
Self-hosted Nextcloud with an online document editor and Active Directory sign-in, NetBird VPN with its own identity provider and enforced MFA, on-premise GitLab, n8n for workflow automation.
LiteLLM and Langfuse for model orchestration and observability, Claude Code, OpenRouter, Google AI Studio. RAG over pgvector and Elasticsearch, provider-switchable architectures, token cost tracking.
ESP32 microcontroller programming (e.g. e-ink wall displays), Shelly and Tuya Wi-Fi temperature sensors and their integration into Home Assistant.
§ 3
A green LED means the project is live in production right now.
live at 3 clients
Deployment and operation of a SIEM at three clients: automated agent rollout, custom e-mail alerting and, above all, an AI layer on top of it — for every serious alert it pulls the history from OpenSearch and writes what is going on and what to do about it. The models are chained (an on-premise model first, then cloud ones), so one outage doesn't stop the analysis.
Python · Wazuh + OpenSearch · systemd · AI chain
live
An extension of the same SIEM: a weekly report picks the worst server and writes out the patch commands, a monthly one goes through every machine and explains how each vulnerability could be exploited. Plus a health check of the SIEM server every minute — services, cluster, ports, queues and disconnected agents — wired into Nagios.
Python · CVSS · OpenSearch · cron + Nagios
live
Ordering, renewal and reissue of certificates through a certificate authority's API — a custom Python client replacing the outdated official example, expiry tracking and automated domain validation by e-mail, including reading the mailbox through Microsoft Graph.
Python · REST API · Microsoft Graph
live
A portal on top of OpenVAS/GVM: scan history, delta detection, KEV enrichment, AI analysis of findings, a REST API and a custom broken access control detector in the spirit of Burp Autorize.
Flask · SQLite · APScheduler · 199 tests
live · nemovitosti.x86.cz
A real-estate listings aggregator with a fair-price estimate from three independent methods — self-calibrating against the prices properties actually sold for.
Python · PostgreSQL · ~1.5 M photos in WebP
live · for a client
A RAG chatbot for an industrial e-shop: hybrid search (vectors + fulltext), hard dimension filters, an embeddable widget with signed identity and an admin with versioned configuration. It never makes up numbers.
FastAPI · pgvector · Gemini/Claude/GPT
live · rezervace.x86.cz
A booking system for sports activities: recurring and one-off slots, Google Calendar sync, e-mail invitations with one-click responses and push notifications as a PWA.
Laravel 12 · Livewire · FullCalendar
live · turnaj.x86.cz
Darts tournaments: brackets up to 128 players (single and double elimination), round-robin groups, a player database and a live public tournament page.
Next.js · tested game engine (vitest)
live · led-loga.cz
A signage-industry e-shop in seven languages, a 3D print-design studio right in the browser, and a family of AI microsites that generate a design from the customer's photo.
Next.js 15 · PostgreSQL · three.js · Replicate
tools
Data recovery: virtual reassembly of RAID arrays from disk images including brute-force geometry autodetection (RAID 0/1/5/6, degraded too), and photo/video recovery by file carving for ~30 formats.
Python · numpy · parity over GF(2⁸)
§ 4
Internal automation running in production, saving time for me and for the teams I work with. Most of it exists because nothing off the shelf did exactly what was needed.
runs daily
One tool scans backups, Kubernetes, VMware, the monitoring system, the network and vulnerability scan results, has the findings assessed by a language model and sends a single daily digest. It recognizes a recurring chronic problem rather than a new finding — and one failed collector doesn't bring the run down.
Python · plugins for 6 domains · AI provider fallback
runs every 10 min
An automatic reviewer covering three repositories and the DEV/TEST/PROD branches. It sorts findings into bugs, security, performance and risk, runs a second deeper pass with full repository context on the critical ones, and mails an HTML report routed by verdict.
Python · GitLab API · two-pass analysis
live
Traffic collection from the backbone routers, built from scratch: a web UI with drill-down, a read-only JSON API with tokens and metrics pushed into monitoring. It answers "who is saturating our internet link" — and tells internal backups apart from real perimeter traffic.
nfdump · PHP · Ansible + Terraform
live
Refreshing development environments with production data in one command: it fetches the encrypted backups, decrypts, decompresses and imports tens of gigabytes in the right order because of cross-database dependencies. Lock against concurrent runs, notifications at start and finish.
Python · AES-256 · MySQL
runs twice a day
A read-only snapshot of every virtual server from vCenter — state, host, datastore, IP, resources, tools version and detection of which machines replicate to the standby array. The 90-day archive doubles as disaster recovery reference material.
Python · pyvmomi · 90-day archive
runs weekly
Reads the backup system's configuration database and mails a weekly list of which physical tapes to take offsite and which to bring back — based on GFS retention and the autoloader's capacity.
PowerShell · WinRM · SQL (read-only)
§ 5
A selection of commercial engagements. I don't name clients here — I'm happy to provide references personally.
Designed and ran a full destructive test three times — a simulated failure of the primary storage array with 39 virtual servers and an entire Kubernetes cluster failing over to the standby array. RTO for critical services under 30 minutes, RPO under 15, and a verification script passing all 85 checks.
Design and delivery of a company CRM's move from the cloud to on-premises: nine database servers, nine Java microservices into Kubernetes and the web tier from an auto-scale group onto a pair of servers behind a reverse proxy. Documented saving of about EUR 37,000 a year.
Support, deployment and operation of a production CRM for an international group: Laravel + Vue + Elasticsearch, Java microservices and AI services, CI/CD into on-premise Kubernetes, environment preparation and incident handling.
Building and managing clusters from the kubeadm HA control plane up to the applications: Elasticsearch/ECK, Grafana, Sentry, n8n, GitLab CI/CD with an environment per branch, Ansible for the whole estate. Replacing the end-of-life ingress controller caused no downtime — the new one ran in parallel, took over 42 existing configurations, and traffic moved one hostname at a time.
A gap analysis of 186 devices and 987 sensors against the new system, migration of network and Linux devices onto 155 hosts, four NOC dashboards and topology maps — and, above all, a policy for what may actually send an SMS at three in the morning.
Deployed custom NetFlow collection on the backbone routers after repeated saturation of the internet link. The result: a single flow was eating the line — 37 GB of backups uploaded to cloud storage over four hours.
An authorized grey-box test of a tax application as input for acquisition due diligence — rules of engagement, findings register, management report. The findings led to a custom automated BOLA/IDOR detector.
Design and delivery of corrective measures: PIM/PAM and privileged account cleanup, a two-tier PKI with hardware HSMs, authenticated vulnerability scanning, disaster recovery with tested failover.
An inventory of everything visible from the internet — 28 DNS zones and 151 web targets sorted into our own and third-party. Weak TLS settings were traced back to specific servers through address translation rules in the router backups, and internal services published behind a shared IP address came to light.
Upgrading production servers from long-unsupported releases to current ones — including a database engine upgrade with 19 databases preserved, and an audit of legacy authentication protocols from the SIEM ahead of a domain controller migration.
Running a backup platform with 36 TB of capacity and 24 automated jobs — databases, repositories, cloud storage and network device configurations, all encrypted with three-tier retention. Backup concepts on Veeam (tapes, GFS, encryption) and Backup Exec, plus a server consolidation proposal with seasonal capacity scaling.
Analysis and cleanup of storage accounts (hundreds of thousands of blobs) with safe deletion manifests, Azure Monitor metrics wired into Nagios, and ongoing cost tracking.
§ 6
I don't just deliver code — I run it. Every server has a runbook, monitoring and verified backups, because a backup nobody has tried to restore is not a backup.
§ 7
Need something from the list above built, secured, or operated? Drop me a line.
pavel.novotny@it2it.cz