Infrastructure consultant · Network engineer
Lenn
Okuro
I build infrastructure a business can own: networks, identity, delivery pipelines and content planes on hardware you control, with the practices of the large platforms and the budget of a small team. Between Zurich and Nairobi I research who owns the digital economy; here I build the answer. One person who can design the network, harden the access, ship the deploy and explain every decision.
01 //
Estate map
Four strata, top down. Every cell has one home. Numbers derive from position.L3Products
L3.01 liveredcup.chCooperative platform for a creative collective: artists, events, storefronts, dual-market rails.Next.js · TypeScript · Directus · MinIO
L3.02 gatedCommand centerThe observe step made visible: registry-driven console, bleed detectors, audit home.Next.js · Redis · PostgreSQL
L3.03 liveNRFPNakivale refugee football players. Visibility without vulnerability.Next.js · Directus · Authentik
L3.04 gatedBlogVideo-first flat newspaper on the shared CMS plane.Next.js · Directus
L3.05 liveConceptA hardened static concept page. The first pull-based deploy in the fleet.Static · Caddy
L3.06 liveAfrisolCompany presence with correspondence mail, shipped through the same pipeline.Next.js
L3.07 liveleandragraf.workA client portfolio on the ScriptC generator with presigned renditions and an on-site editor.ScriptC · Directus · MinIO
L3.08 builtRed storeStore-within-a-store abstraction, parked pending signal.Next.js · Daraja
L3.09 livel3nn.orgThis page. Static build, content from the CMS plane, engine-drawn islands.ScriptC · Clay · Directus
L2Services · engines
L2.01 gatedCMS planeContent updates for every product from one shared plane. Editors change pages; nothing redeploys.Directus
L2.02 liveIAMIdentity configuration as dry-run-first code; nested groups; least-privilege provisioner.Authentik · Python
L2.03 liveAccountOne login surface for every product; passwordless by default.Next.js · OIDC
L2.04 liveAPI gatewayGovernance of machine and partner traffic at the edge: a route registry, not a hand-edited proxy.Caddy · JSON spec
L2.05 builtGateHeadless multi-tenant ticketing and scan engine.Fastify · PostgreSQL · Redis
L2.06 builtGravityDiscussions with moderation as the interface and no stored credentials.Node · SSE
L2.07 liveMedia enginesImage conversion and HLS transcoding on queues; producers stamp the target bucket.pyvips · FFmpeg · Redis
L2.08 plannedUI engineLayout without the DOM: a C layout engine in wasm, painting to canvas. Draws the islands on this page.Clay · C · wasm
L1Planes
L1.01 liveNetMesh VPN gateway. No traffic between nodes crosses the public internet.WireGuard
L1.02 liveDataOne relational store, pooled, backed up nightly.PostgreSQL
L1.03 liveControlTLS, routing, identity-aware proxy, WAF, secrets.Caddy · Authentik · CrowdSec · Vaultwarden
L1.04 liveRunwayWhere apps run. Deploys are pulled, digest-pinned, health-gated, rolled back on failure.Docker · deployd
L1.05 liveBuildGit, runner, registry. Build-only: CI holds no server credentials.Gitea · act_runner
L1.06 liveOpsHealth, alerting, browser workspaces.Uptime Kuma · Coder
L1.07 liveComputeCPU-heavy async work, isolated from app hosting.Redis queues
L1.08 liveSecurityFindings, scans in CI, network lab, red and blue doctrine.DefectDojo · Trivy · Suricata
L0Substrate
L0.01 liveHypervisorOne bare-metal host running the planes as containers.Proxmox VE · ZFS
L0.02 liveSmall boardsSecurity node and network lab on single-board computers.Raspberry Pi
L0.03 liveEdge fleetDumb forwarders and a smart edge in front of the mesh; DNS and DDoS at the CDN.VPS · Cloudflare
public · linkedgated · seen, not linkedinternal · role only