Sreeram K R

Cloud & Infrastructure Automation Engineer

Architecting secure, automated infrastructure at scale. This site is a live case study of a zero-ingress cloud environment — spanning bare-metal constraints, serverless migration, and cost optimization.

Terraform GCP GitHub Actions Docker Compose Zero Trust Cloudflare Go Firestore Nginx
LinkedIn GitHub Download PDF Resume

Architectural Evolution

Five phases of infrastructure design — from bare-metal polling to zero-ingress serverless and back to a hardened VM.

Phase 1: Bootstrapping

Native Resource Polling

Constraint: GCP e2-micro with 1GB RAM. CI/CD runners risk OOM.

Architecture: Pull-based GitOps loop via systemd.timer + Bash script. Polled GitHub API every 2 min for SHA deltas — minimal memory overhead.

Phase 2: Refactored

Push-Based IAP Tunneling

Requirement: Instant push-based deploys while keeping zero-ingress security.

Architecture: Replaced polling with GitHub Actions. Used GCP IAP to tunnel SSH deploys over port 22 — no public port exposed.

Phase 3: Registry & Telemetry

GHCR & Native systemd

Optimization: Building on the VM triggered OOM. Telemetry confined inside container network boundaries.

Architecture: Unprivileged Nginx image built & pushed to GHCR in CI. Telemetry daemon runs natively on host under systemd, proxied via bridge.

Phase 4: Serverless

Cloud Run & WIF

Optimization: VM + Cloudflare tunnel + systemd daemons added operational overhead.

Architecture: Transitioned to Cloud Run (serverless). Workload Identity Federation for keyless GitHub Actions deploys via Artifact Registry.

Phase 5: Cost Optimization

Zero-Ingress Docker Compose

Constraint: Cloud Run + Artifact Registry + Firestore storage costs accumulated.

Architecture: Returned to free-tier e2-micro VM. Nginx + Cloudflared in private Docker Compose stack. Retained WIF for IAP SSH deploys.

System Architecture

Current production topology and how code reaches production.

Current Cloudflare Pages (Phase 6)

Cloudflare Pages serves the static site directly from the edge. GitHub Actions renders the resume PDF, then deploys the site/ directory via wrangler. The GCP e2-micro VM (Phase 5) is on hold for future work.

graph TD User((User)) -->|HTTPS| CF[Cloudflare Edge] CF -->|Pages| P[Cloudflare Pages] Dev[git push] --> GH[GitHub Actions] GH -->|Render HTML| PDF[Resume PDF] GH -->|wrangler pages deploy| P P -->|serves| IDX[index.html / 404.html] P -->|serves| R[resume.html] P -->|serves| PDF VM[e2-micro VM] -.->|on hold| FUT[Future: Hermes agent]

Historical Serverless Architecture (Phase 4)

Serverless configuration using Cloud Run for frontend Nginx + Go microservice connected to Firestore for visitor and session telemetry.

graph TD User((🌐 User)) -->|HTTPS| CR[Cloud Run Ingress] subgraph GCP [Google Cloud Platform] direction TB CR -->|Serve| Nginx[Unprivileged Nginx Container] Nginx -->|CORS Fetch| GoAPI[Go Visitor Tracker API] GoAPI -->|SDK Writes| Firestore[(Firestore DB)] end subgraph CI_CD [Deployment Pipeline] direction LR Dev[git push] --> GH[GitHub Actions] GH -->|Compile| PDF[Resume PDF] GH -->|OIDC Auth| WIF[Workload Identity Federation] WIF -->|Push Image| AR[Artifact Registry] GH -->|Terraform| Nginx end

The VM Reversion Rationale

Why Phase 5 exists, what it costs, and how it stays secure.

Evaluating Cloud Run Costs

While serverless (Phase 4) eliminated VM maintenance and tunnels, it introduced unexpected cost vectors. Artifact Registry storage for multiple Docker image tags plus Firestore reads/writes from the visitor tracker accumulated charges. For a low-traffic personal portfolio, this defeated our "100% Free Tier" objective.

The Phase 5 Zero-Ingress Design

We retired Cloud Run + Firestore and returned to a single GCP e2-micro VM — fully covered under the Always Free program.

Result: $0/month, zero open ports, container-isolated networking, automated keyless deployments.

Uptime: 100% · Cloudflare Pages · $0/mo
LinkedIn GitHub Resume (PDF) Resume (HTML)