I make servers behave and agents do the work
Muhammad Ammar — DevOps & Linux System Administrator
I build and run Linux infrastructure that has to stay up, and I host AI agents and automation on top of it. Virtualization, storage, cloud, containers, web hosting and self-hosted AI systems, owned end to end from the bare metal to the running app.
Six things I do really well
Linux System Administration
AlmaLinux, CentOS, Ubuntu and Debian. Provisioning, hardening, kernel tuning, patching and keeping servers healthy.
DevOps & CI/CD
GitHub Actions, Jenkins and Drone. Automated build, test and deploy pipelines with zero-downtime releases.
Docker & Containers
Containerized apps behind NGINX with SSL. 30+ microservices across 10 to 15 servers, Compose and registries.
Kubernetes & Orchestration
Production clusters with rolling updates and rollbacks, health checks, and a repeatable deploy pattern across services.
Cloud & Infrastructure
AWS and GCP with Terraform, plus VMware vSphere, ESXi and vSAN. Infrastructure as repeatable code.
Security & Hardening
Server hardening, fail2ban, firewalls, Wazuh log monitoring, VPN and SPF/DKIM/DMARC email security.
Some proof
Where I have worked
DevOps & Linux System Administrator, CyberX Studio
2024 to present · Islamabad
- Rebuilt the performance stack of a busy WHMCS site with PHP 8.2, MariaDB tuning, LiteSpeed and Redis. Time to first byte came down from about 4 seconds to 54 ms, grade F to B.
- Managed more than 20 WordPress sites on cPanel/WHM and raised Google PageSpeed scores from 45 to 90 and above.
- Deployed Next.js, Node.js and other apps with Docker behind NGINX, handling SSL and production traffic.
- Hardened AlmaLinux and CentOS servers and set up Wazuh for central logs, alert rules and threat detection.
- Ran OpenVPN for over 20 users with certificate login, and managed DNS and email records.
DevOps Engineer, FullDuplex
2022 to 2024 · Lahore
- Designed and ran the VMware environment: 4 ESXi hosts under vCenter, a 6 TB vSAN pool and 30 VMs, dual 10 GbE for vSAN and vMotion, plus backup and disaster recovery.
- Built two MinIO clusters with three nodes each, using erasure coding and cross-site replication for highly available object storage.
- Operated a Docker microservices platform: 30+ services across 10 to 15 servers, with reverse proxies, API gateways, Redis queues and background workers.
- Managed production Kubernetes clusters and wrote Terraform for AWS and GCP.
- Deployed a VoIP platform for over 300 users on Docker, Asterisk and Redis with zero-downtime delivery, and set up Grafana dashboards.
Cloud & Linux System Administrator, Pinha Limited
2021 · Remote · Cyprus-based company
- Managed AWS and GCP: EC2 and Compute Engine, VPC, IAM, backups and cost monitoring.
- Wrote Terraform modules for both clouds and deployed Node.js and PHP/Laravel apps with Docker behind NGINX and Apache.
- Built GitHub Actions pipelines for testing, building and deploying.
Things I have built
The infrastructure code, hardening playbooks and ops scripts behind this work, with tfsec, checkov and shellcheck running in CI, are open to read on GitHub.
AWS Cost & Security Audit
Read-only audit of two AWS accounts across 14 regions. Half the S3 bill turned out to be request charges, not storage: a sync job was firing about 370,000 list calls a day to copy 7 new files. Fixed for roughly $660 a year. The same pass found 7 buckets open to the internet across 2.6 TB and a production database reachable on its public port.
Virtualization & Storage
A vCenter cluster of 4 ESXi hosts, 6 disks per host plus an SSD for cache. vSAN over dual 10 GbE gave a 6 TB pool running 30 production VMs, with backup and DR.
MinIO Object Storage
Two MinIO clusters, three nodes each, with erasure coding, an NGINX load balancer for a single URL, and site replication between the clusters for high availability.
WHMCS Performance Rebuild
Rebuilt the full performance stack on a busy WHMCS install. Time to first byte dropped from about 4 seconds to 54 ms, with no disruption to the live site.
VoIP Platform
A voice platform for more than 300 users on Docker, Asterisk and Redis, with zero-downtime continuous delivery.
AWS Serverless & CDN
Built serverless automation with AWS Lambda, and set up a CloudFront CDN with caching and IAM-scoped access for fast, secure content delivery.
Production Email on Amazon SES
Took a cold domain to verified inbox delivery. DKIM, a custom MAIL FROM subdomain so SPF aligns to the sending domain, DMARC, and a configuration set logging all nine event types to CloudWatch. The sending key is scoped to two actions and locked to three From addresses, so a leak cannot send as anything else.
CI/CD Pipelines
Automated build and deploy pipelines with GitHub Actions, Jenkins and Drone CI for PHP, Node.js and containerized apps. Multi-stage builds, parallel deploys, zero-downtime releases.
Next.js & Strapi Platform with CI/CD
Run a production Next.js and Strapi platform on a Linux VPS, with GitHub Actions building and deploying on every push, PM2 keeping the app up, and NGINX and SSL in front.
Production App Migration, Zero Data Loss
Moved a live app's PHP/MySQL backend to new hosting with no app changes. Built in parallel, kept API endpoints identical, cut over at 3 AM with a write-freeze. 12,000+ records, zero loss, email continuity, instant rollback.
Self-hosted agents & automation
I host AI agent systems and automation on servers I set up and secure. The agents do the work, I make sure the server stays solid and safe.
RAG Document Q&A System
A FastAPI service that answers plain-language questions about your own documents. Ingests PDFs, Word files and Notion pages, embeds locally, answers with sources cited and a confidence score.
MLS Data Connector for Claude (MCP)
An MCP server that lets a brokerage's agents pull live MLS data straight from a Claude chat. Connects Claude to the Spark (FlexMLS) API with tools for search, comps, market stats and more.
Automated Lead-Generation Pipeline
A nightly pipeline that generates search queries with Claude, runs web search, scores each company for fit, verifies the decision-maker's email, dedupes, and delivers a clean list every morning. Runs unattended on the client's own server.
Multi-Agent Outreach System
A 5-agent system that runs cold outreach and Reddit automation on its own. I set up the VPS, hardened it, added SSL and login, and set the limits that keep it safe.
AI SDR Pipeline
A 3-agent pipeline that pulls leads, adds detail to each one, and writes a tailored message. It runs unattended on a single VPS.
OpenClaw & Hermes Deployments
Set up and configured OpenClaw and Hermes agent platforms on client servers, including headless Linux with browser automation, gateway, SSL and OAuth in place.
AI Voice Agent
Built and deployed AI voice agents on Twilio that answer calls, route them, record and log to a CRM, including a Retell-based phone agent that books appointments.
ECW to GoHighLevel Sync
Built a sync that pulls patient records from eClinicalWorks over its FHIR API and pushes them into GoHighLevel through webhooks, hosted in the region the access requires.
AI Website Chatbot with Lead Capture
A custom AI assistant on a live company site that answers questions and captures leads to the sales inbox. PHP backend, model provider swappable in one line, keys server-side, rate limited.
Email Your MP Campaign Tool
A Cloudflare Worker that writes a personalized campaign email to a constituent's local representatives with an LLM, served through an embeddable widget with an admin page.
n8n Automation Platform
Self-hosted n8n in Docker with SSL, used to connect services and run automated workflows and webhooks.
n8n Workflows
SSL and domain expiry monitoring, RAG support triage, AI lead enrichment and scoring, an SEO blog engine and a multi-platform social publisher. Each with retries, routing, dedup and approval steps.
Client work on Upwork
A few of the jobs I have finished for clients, each closed five stars. Top Rated · 100% Job Success.
Cloud Cost Reduction, Full Server Move
A client's app was running on a server ten times bigger than it needed. I measured the actual peak load, sized the replacement, then moved the filesystem, database and SSL across to it with no data loss and no app changes. Hosting went from about $96 a month to $7.
OpenLiteSpeed SSL Fix
Several domains on one OpenLiteSpeed server were serving the wrong SSL certificate. I traced it to SNI and vhost mapping, rebuilt the per-domain bindings, cleared cache. All sites back on the right cert, no downtime.
ClickHouse Setup & Tuning
Set up and tuned a ClickHouse database holding 5.3 billion rows (83 GB) so analytical queries run fast at production scale.
Server Recovery After Data Loss
Recovered and fully rebuilt a Magento store after data loss, and brought the site back online.
Self-Hosted Supabase
Deployed a self-hosted Supabase platform with Docker, PostgreSQL and NGINX, with SSL and a clean setup the client could maintain.
Email Deliverability with SendGrid
Set up SendGrid with a subaccount, domain authentication and DMARC so a client's mail landed in the inbox instead of spam. Delivered the same day.
WordPress Hosting & Email
Pointed a GoDaddy domain to AWS Lightsail, set up a WordPress instance with SSL, and configured professional email accounts.
VPS Migration Between Providers
Moved a trading VPS from one provider to another with the full setup intact and no data loss, running the same on the new host.
Tailscale Mesh VPN
Set up a Tailscale network so a client could reach a laptop, NAS and tablet securely from anywhere, no ports opened. Configured an exit node to route traffic through one trusted machine.
What clients say
Real feedback from Upwork clients, every one of them five stars.
"So fast, perfect deliverable. Delivered exactly what we needed, faster than expected. I would definitely work with Muhammad again. Great job."
"Muhammad is genuinely great at what he does, he was given a brief and executed it perfectly. Always there when I needed to ask a question. I would 100% recommend and will be doing further work with him."
"Muhammad is very zen, which is what you need in the delivery of mission-critical dev-ops analyses and resolves. A solid professional."
"Reasonable price, quick communication, great job. What's not to like? Thank you Muhammad."
"Great working with Ammar. He completed our website hosting and server migration successfully on-time and we got the website live with no issues."
"Exceptional service and knowledge. He has provided ongoing support for months, worked through all my special requests and always delivered great work. Highly recommended!"
Featured by MinIO
My storage work in the official MinIO newsletter
My MinIO project was featured in the MinIO newsletter (September 2024): two clusters with three nodes each, erasure coding so data survives a node failure, an NGINX load balancer for a single access URL, and site replication so data stays available even if one cluster goes down.
Tools I work with
Infrastructure
Cloud & Containers
Web & Hosting
Data & Cache
Security & Networking
CI/CD & Scripting
AI & Automation
Security & SOC
I treat security as part of building a system, not something added at the end. I am trained as a SOC analyst and keep building on the blue team side.
What I do on the security side
Deployed Wazuh as a SIEM for central log collection, custom alert rules, agent management and active threat detection across servers. I harden Linux with kernel tuning, fail2ban, firewalls and patching, set up VPN and certificate-based access, and handle email security with SPF, DKIM and DMARC. Hands-on labs in log analysis, malware basics and privilege escalation, mapped to MITRE ATT&CK.
Certifications
EC-Council Certified SOC Analyst (CSA v2)
EC-Council SOC for Blue Teaming
arcX Cyber Threat Intelligence 101
TCM Security Linux Privilege Escalation
Hack & Fix Certified Phishing Prevention Specialist
Hack & Fix Cybersecurity Career Starter
EC-Council Security Automation with Ansible
EC-Council Open-source Identity & Access Management
cPanel WHM System Administrator II (CWSA-2)