Project Meridian
CloudOps Platform
A production-grade Azure cloud infrastructure platform built entirely with Infrastructure as Code, designed to mirror real-world enterprise environments. The project spans four engineering domains: multi-tenant networking, security automation, CI/CD pipelines, and hybrid cloud connectivity — bridging a physical homelab to Azure.
[What I built]
- A hub-spoke network topology across three Azure VNets with tiered subnet segmentation, NSG rule chains, and forced egress routing through a centralized firewall — the same pattern used by Fortune 500 Azure deployments.
- A security automation layer with Microsoft Defender for Cloud, Azure Sentinel SIEM with custom analytics rules and automated incident response playbooks, Azure Policy enforcement, and a custom RBAC role model following least-privilege principles.
- A multi-stage CI/CD pipeline in Azure DevOps (with a parallel GitHub Actions workflow) featuring Terraform validation, Checkov/tfsec security scanning, approval gates, and automated integration testing — no portal clicks, every change goes through code review.
- A hybrid cloud connection from my on-premises Proxmox/OPNsense homelab to Azure via VPN, with Azure Arc enrollment, unified cross-environment monitoring, and a disaster recovery simulation with measured RTO/RPO.
[Tech stack]
Terraform · Azure DevOps · GitHub Actions · Azure VNets · NSGs · Azure Firewall · Azure Bastion · Key Vault · Defender for Cloud · Azure Sentinel · Azure Policy · Azure Arc · Container Registry · Docker · WireGuard VPN · OPNsense · Proxmox
[Key engineering decisions]
Every architectural choice is documented with Architecture Decision Records — not just what was built, but why, what alternatives were considered, and what trade-offs were accepted. The entire platform can be destroyed and redeployed from code in under 15 minutes.