Sébastien Angérard
Operations engineer
I keep production standing.
Now at Cyberwatch, after nearly four years running production at Crédit Agricole. And three platforms built at home.
- machines in my homelab
- 31
- between two copies of the proxy state
- 5 min
- platforms built and operated
- 3
I monitor, fix and document. When a tool is missing, I build it, then I run it myself.
Career
Operations engineer
Cyberwatch
French vendor of vulnerability management and compliance software.
- Operations team: deploying the products at customer sites, technical support and user training.
IT production engineer
Cloud Temple, on assignment at Crédit Agricole
Production of Crédit Agricole’s internet-facing web applications, within a DevOps team.
- On-call duty and monitoring of the internet-facing sites
- Level 2 operations support for a fleet of web servers
- Obsolescence management and server compliance
- Threat and attack detection, including DDoS
- Patch management across the fleet
System and network administrator
École Autograf
The IT system of an applied arts school, from audit to operations.
- Audit of the existing setup, then a recommended system and network design
- Renewal of the machines and the network
- Day-to-day user support
Patch management technician
Neurones IT
My first job, held during my studies.
- Web monitoring interface (PHP, Docker, Composer)
- Landesk and SCCM labs on a Linux server, on a private network
- Ticketing on the clients’ internal platforms
- PowerShell and Bash scripting
Education
2018 - 2022
Bachelor in systems, networks and cloud computing ESGI
Software and network project manager. Bachelor project: renewing and deploying a resilient virtualised infrastructure.
2018
French baccalaureate STI2D, information systems and digital option Lycée Les Pierres Vives
Music and computing options.
What I can do
Production
- Monitoring and on-call
- Patch management
- Obsolescence and compliance
- Attack detection
- High availability
Systems
- Debian, Ubuntu
- RHEL (basics)
- Proxmox VE
- Windows Server
- Active Directory, SCCM
Automation
- Docker and Compose
- GitLab CI
- Ansible
- Bash, PowerShell
- Portainer
Network and security
- WireGuard
- Reverse proxy
- SSH bastion
- Wazuh, CrowdSec
- Corosync, DRBD
Development
- PHP, SQL
- HTML, CSS
- JavaScript, Python (basics)
- Self-hosted LLMs
- AI coding agents
What I built
Three platforms I designed and run on my own infrastructure.
Libris
Translate whole books with the language model of your choice, on your own server.
- Characters, glossaries and style kept consistent across the volumes of a series
- Autopilot: from the imported file to the translated EPUB, every decision logged
- Side-by-side review, human validation, bilingual export
Tandem
A team of AI agents that debates, splits the work and reviews itself.
- Claude Code, Codex or Cursor agents, each with its own role, model and reasoning level
- Unanimous decisions, tasks in columns, cross review
- Every turn counted: tokens, estimated cost, duration, tools
- Work is pushed to GitLab or GitHub after each task, with the log of the discussion
Encodium
Re-encode a video library to H.265 or AV1 without ever damaging it.
- Every encode checked before it replaces anything: tracks, chapters, HDR, Dolby Vision, SSIM
- Shared GPUs: a job starts only when the RAM, VRAM and disk it needs are free
- Originals kept for seven days in a recycle bin
- In the screenshot: 2,884 files re-encoded, 1.4 TB down to 663 GB
Also: FluxGate, an encrypted file sharing service, and PXL, an image host. Both self-hosted.
Interview: my homelab
The questions I get asked most, with the real answers.
What is in it?
A Proxmox server at home with 18 containers and 7 virtual machines, a NAS, two AMD graphics cards to run language models locally, and five virtual private servers across three hosting providers. Thirty-one machines, all inventoried.
How does it all talk?
The five VPS form a full WireGuard mesh: each one has a direct tunnel to the other four, with no central point. The home opens no admin port, its outbound tunnels reach the VPS. Every admin command goes through a bastion that logs it.
What if the front server goes down?
The reverse proxy runs active/passive on two VPS. Every 5 minutes its full state is copied, checked table by table, then sent to the passive node and, encrypted, to a third provider. Twelve generations are kept. The failover was run for real: old active stopped at 15:51:19, new one started 33 seconds later.
Why no automatic failover?
Two servers each writing to their own database is worse than an outage: you lose the truth. Promotion requires proof that the old active node is stopped, then takes one last copy after the stop. One writer, always.
Home
Proxmox, 18 containers, 7 VMs, NAS, 2 GPUs
Active proxy
Entry point for every service
Former active, stoppedStopped, no longer receives trafficPassive proxy
Stopped, receives a copy every 5 min
Vault
Encrypted copy, third provider
Libris 1
Website and licences
Libris 2
Standby copy
- All goodState copied every 5 minutes to the passive node and the vault.
- OutageThe active proxy stops answering. An alert fires if the last copy is older than 15 minutes.
- Proof of stopWe prove the old active node is stopped. Without that proof, nothing moves.
- Last copyThe most recent copy is restored on the passive node.
- PromotionThe passive node becomes the only writer. DNS switches to it.
- ChecksTunnels reconnect, dashboard, bastion and GitLab answer. The old node becomes the passive one.
All good. State copied every 5 minutes to the passive node and the vault.
The nastiest outage?
An MTU story. At 1,380 bytes, packets did not get through on one path and the SSH key exchange hung with no clear error. The whole mesh now runs at 1,280 and is tested on all 20 links.
Who watches it?
A Wazuh SIEM, CrowdSec in front of the entry points, one health check per service, a Proxmox backup every night with a weekly off-site copy, and a self-hosted GitLab whose CI tests everything before delivery.
Off duty
Music
Some drums, and computer music.
Fan translation
Volunteer proofreader and translator. I watch spelling and syntax like system logs.
Hardware
Build, test, measure. That is where my homelab started.
AI
Language models running locally on my own cards, and coding agents every day.
Blockchain
Blockchain and cryptocurrencies, out of technical curiosity.
Kuro and Haï
Two cats, self-appointed supervisors of the office.
A production to keep standing?
Infrastructure, operations or high availability assignment: describe your context in a few lines.