Plate I — bare metal · 47.3769° N · 8.5417° E · surveyed 2026-07-24

Hadi Cherkaoui — platform developer, Zürich

The cluster is the runtime, not an afterthought.

I mostly write Rust and Go, and run Kubernetes on bare metal I operate myself. Most of what I build treats the cluster as the state store — typed APIs, no glue.

GitHub GitLab LinkedIn docs.cherkaoui.ch contact@hide.cherkaoui.ch

3’200 m

What I build — two systems, both AGPL

Anvil

Kubernetes-native game-server panel, in Rust

Existing panels (Crafty, Pterodactyl) assume Docker on a single host. Anvil flips it: a Minecraft server is just a shape of StatefulSet + PVC + Service, and scale-to-zero is replicas: 0. One Axum binary drives the cluster through kube-rs typed APIs — no CRDs, no controller, no reconcile loop.

The frontend ships as a static export embedded with rust-embed: one distroless image, ~30 MB, no Node runtime in production.

gitlab.cherkaoui.ch/HadiCherkaoui/anvil CNCF Switzerland — VSHN recap

runtime: k0s cluster
control: 1 × Axum binary
k8s api: kube-rs (typed)
scale-to-zero: replicas: 0
image: ~30 MB distroless
store: SQLite
license: AGPL · v1.0

Lockbox

end-to-end-encrypted secrets manager for Kubernetes

Lockbox is my first Rust project — an open-source E2EE secrets manager built for k8s and automation. Ed25519 keypair auth (no master password, SSH-style), AES-256-GCM encryption, and a delta-sync API designed for controllers.

The companion Go controller watches your cluster, pulls changed secrets from Lockbox, decrypts them, and injects them as native k8s Secrets tagged lockbox.io/managed. No secrets in git. No manual kubectl apply.

Lockbox on GitLab Controller on GitLab

language: Rust (2024)
auth: Ed25519 keypair
encryption: AES-256-GCM
controller: Go · controller-runtime
k8s api: native Secrets, no CRDs
cli: lbx
license: AGPL v3

1’800 m

Infrastructure — below the cloud line

Network

Custom OpnSense router with a 10Gig NIC between the ISP and my network. Managed switch: 10Gig uplink, 8×2.5Gig downstream. VLAN segmentation between home and lab environments. WiFi 7 via UniFi U7 Lite.

OpnSense · 10Gig · VLAN · WiFi 7 · UniFi

Cluster & GitOps

AMD Ryzen 5 7600X, 64GB DDR5 RAM, k0s on Ubuntu Server. Deployments go through FluxCD, pulling manifests from a self-hosted GitLab instance. I wrote the CI pipelines. Everything is GitOps — no manual kubectl apply in production.

k0s · FluxCD · GitOps · GitLab CI · Docker

Identity & Privacy

I don't extend trust by convention. Every self-hosted service authenticates through Authentik — my self-hosted SSO. For cloud I use Proton: Swiss jurisdiction, open-source, E2EE by default. Proton Pass for passwords. Proton Drive for offsite backups. Nothing sensitive touches a vendor I can't audit.

Authentik · SSO · Proton · E2EE · Zero-trust

Homelab Documentation ↗ GitLab ↗

1’400 m

Tools — chosen, nothing default

Operating System

I daily-drive Artix Linux — not for the aesthetic, but because I want every layer of my system to match what I mean. dinit instead of systemd, doas instead of sudo, Catppuccin Macchiato across the entire stack. Rolling releases, deliberate choices.

Artix · dinit · doas · KDE Plasma · Catppuccin

Languages & AI

I write Go when Rust is overkill: tooling, scripts, things that need to compile fast and get out of the way. I know TypeScript and React — but I reach for Leptos when the project shares a codebase with the server. I'm also exploring AI/ML tooling and building with LLM APIs.

Rust · Go · TypeScript · Leptos · LLM APIs

Dev Environment

Alacritty terminal running Zsh with Powerlevel10k, Tmux for session management, JetBrains Mono everywhere code is displayed. Every tool is chosen, nothing is default.

Alacritty · Zsh · Powerlevel10k · Tmux · JetBrains Mono

Setup Documentation ↗ GitHub ↗

— 1’100 m · field note — from the tools ledger

“I want every layer of my system to match what I mean.”

Artix · dinit · doas — chosen, nothing default.

900 m

Competition

ICT Championships

Skill 53 · Cloud Computing

I compete in the ICT Championships Switzerland — Skill 53 (Cloud Computing). I won the regional championship with a perfect score of 120/120, and next year I'm going to the nationals in cloud computing.

regional 1st · 120 / 120 · nationals next

600 m

Security

Offense, studied

I'm working through TryHackMe's ethical hacking path — hands-on labs covering penetration testing, network exploitation, and security tooling. You don't really understand how to defend a system until you've tried to break one.

TryHackMe profile ↗

408 m

Contact — valley floor, Zürich

Open to platform work — Rust, Go, Kubernetes, ideally all three at once. The descent ends at 408 m, which is where I live.

Write to contact@hide.cherkaoui.ch