Reliable software and infrastructure for start-ups and large enterprises alike.
I'm a software and infrastructure architect in the Greater Seattle Area and the founder of Salish Sea Wolf LLC. I have 12+ years of experience shipping maintainable software and standing up virtualization stacks in compliant environments from the ground up.
- Software: system architecture, Python, Rust, and esoteric LISP, cross-platform tested and pushed through secure CI/CD workflows.
- AI: autonomous agents, agent sandboxing, RAG pipelines, and MCP tool integration wired into containerized job orchestration. Great power, but only under great control.
- Cloud & On-Prem: greenfield Kubernetes / K3s buildouts maintained as Infrastructure as Code, GitOps with Argo CD, and hybrid cloud + on-premise architecture on Hetzner, AWS, Azure, and Proxmox.
- Security & Compliance: NIST 800-171 and CMMC 2.0 programs, 1Password secret management, cluster hardening, private PKI with step-ca, and Authentik SSO with enforced MFA.
Flagship project: k3s-service-cluster
A three-node, highly available K3s cluster on Hetzner Cloud that runs Salish Sea Wolf LLC's services: source hosting and CI, single sign-on, document management, time tracking, analytics, and salishseawolf.com itself. Everything from the servers to the dashboards is code, and a merge to main is a deploy.
- GitOps end to end. OpenTofu builds the servers, network, load balancer, and DNS; Ansible bootstraps K3s once; Argo CD reconciles everything after that. There is no
kubectl applystep. - Gated rollout. Five Argo CD sync waves, with a canary that must mount a real SeaweedFS volume before any app is allowed to start.
- Secrets never in git. Only
op://references are committed. The 1Password Operator projects secrets into the cluster at runtime. - Defense in depth. Authentik forward-auth on every private route, Pod Security Admission
restricted, default-deny NetworkPolicies, and etcd encryption at rest. - Backups with blast-radius limits. Postgres and app volumes back up to Backblaze B2, each volume with its own scoped key, so one leaked key exposes one service.
| Area | Tools |
|---|---|
| Languages | Python, Rust, Bash, C, C++, TypeScript, C#, Java, Lisp, TCL |
| Containers & orchestration | Podman, Kubernetes / K3s, Helm, Traefik |
| Infrastructure as Code | OpenTofu / Terraform, Ansible, Packer, cloud-init |
| CI/CD | Argo CD, GitHub Actions, Gitea Actions, Renovate |
| Observability | Prometheus, Grafana, Grafana Alloy, Loki, Gatus, ntfy |
| Identity & security | Authentik, 1Password, step-ca, cert-manager |
| Data & storage | PostgreSQL / CloudNativePG, Redis, SeaweedFS |
| Cloud & virtualization | Hetzner Cloud, AWS, Azure, Cloudflare, Proxmox / QEMU |
| Daily drivers | Helix, mise, Claude Code, OpenCode, VS Code |
More detail on how I use each one: salishseawolf.com/tech-stack
- Email: hire.me@wolfhouse.me
- Website: salishseawolf.com
- Résumé: salishseawolf.com/resume
- LinkedIn: thomas-wolf-207773227