CPU Usage
8 vCPU · load 0.41
0%
Available for infrastructure & hosting engagements
Mohd Irwan Mohi
Server Manager Linux Infrastructure Engineer
I keep production Linux estates online. Day to day that means Ubuntu and RHEL administration, Virtualmin hosting, tuning Apache, Nginx and HAProxy, running MariaDB, DNS and Cloudflare, deploying TLS, and hardening both the WAF and the OS. Then backup and disaster recovery on top of all that. And the part nobody puts on a job ad: working out why a site went down at 2 a.m. and having it back before the tickets start.
- 0Node HA clusters run
- 0Availability target
- 0Production on-call
ubuntu@ws01:~$ uptime
03:14:07 up 412 days, 6:22, 2 users, load average: 0.41, 0.38, 0.32
ubuntu@ws01:~$ systemctl is-active apache2 mariadb haproxy redis-server
active
active
active
active
ubuntu@ws01:~$ curl -sI https://portal.example.gov | head -1
HTTP/2 200
ubuntu@ws01:~$ grep -c "ModSecurity: Access denied" error_log
1284
ubuntu@ws01:~$ █Control plane
Infrastructure Overview
The panels below are a simulated demo of the telemetry I work with daily. It is not a feed from a live host. The shape of the data is real; the numbers are generated in the browser.
Memory Usage
32 GiB · 4.2 GiB cached
0%
Disk Usage
/dev/vda1 · 480 GB NVMe
0%
Services Running
12 active · 0 failed
- apache2 active (running)
- haproxy active (running)
- mariadb active (running)
- php8.3-fpm active (running)
- redis-server active (running)
- named reload pending
Network Traffic
eth0 · rolling 60 s window
Inbound 0 Mbps
Outbound 0 Mbps
Server Status
90-day availability history
90 days agoToday
- Requests / min0
- Avg response0 ms
- WAF blocks (24h)0
- Failed logins0
whoami
About Me
Infrastructure gets judged on one thing. Is it up when people need it?
I am a Server Manager and Linux Infrastructure Engineer working on production hosting estates for public-sector and enterprise portals. I work across the whole life of a server, from provisioning and platform build-out through hardening, migration and monitoring, to incident response and the recovery plan you hope you never have to run.
Most of my estate runs Ubuntu Server and RHEL-family distributions under Virtualmin/Webmin, fronted by HAProxy and Apache or Nginx, with PHP-FPM, MariaDB and Redis behind them. I build multi-node setups where the shared state actually holds up. Session handlers live in Redis instead of local disk, document roots sit on NFS, and health checks fail the way they should. Put a load balancer in front of two nodes that do not share state and you have not built high availability. You have built two ways to lose a session.
On the security side I run ModSecurity with the OWASP Core Rule Set, CSF or firewalld policy, SSH and TLS hardening, and CVE remediation. I have handled live compromises from start to finish. That means containment first, then a forensic timeline pieced together from access and audit logs, file-integrity checks against upstream release hashes, credential rotation with no downtime, and a written report the client can act on.
I also build the tooling I need. Virtualmin ModSecurity Manager is an open-source Webmin module I wrote in Perl to make WAF triage practical for hosting operators. It groups blocked requests by rule and domain, does one-click per-domain exclusions, installs and tunes CRS, manages IP allow and block lists, and backs up its own config with rollback.
Working languages: English and Bahasa Malaysia. Based in: Malaysia. Open to remote and on-site engagements.
What I do best
- Linux server administration & production support
- Virtualmin hosting platform design and operation
- High-availability web tiers with HAProxy
- MariaDB administration, tuning and safe credential rotation
- DNS, Cloudflare and TLS certificate lifecycle
- WAF (ModSecurity + OWASP CRS) deployment and tuning
- Server migration with minimal cutover downtime
- Backup strategy, restore drills and disaster recovery
How I work
- Verify from runtime evidence, never from assumption
- Back up before every change; keep a rollback path
- Test firewall and TLS from an external host, not the server itself
- Document the change so the next engineer is not guessing
- Prefer boring, reversible fixes over clever ones
Capability matrix
Skills
Rated on production depth. What I have actually run under load, not what I have read about.
Linux
Ubuntu Server95%
RHEL / AlmaLinux85%
Bash scripting90%
SSH & key management92%
Web Hosting
Virtualmin / Webmin95%
Apache HTTP Server93%
Nginx85%
PHP-FPM88%
Database
MariaDB90%
MySQL88%
Redis80%
Backup / restore drills92%
Network
DNS (BIND / zone management)90%
Cloudflare88%
SSL / TLS & certificates92%
Reverse proxy (HAProxy)87%
Cloud
VPS provisioning92%
Cloud infrastructure design85%
Server migration / cutover90%
Multi-node HA topologies86%
Monitoring
System monitoring & alerting88%
Log analysis & forensics93%
Troubleshooting under pressure95%
Security hardening (CIS-style)90%
Track record
Work Experience
Client environments are described generically. Names and addresses stay confidential.
Server Manager
Managed hosting & infrastructure services · Public-sector and enterprise portals
I own the production Linux estate from build through to recovery. I secure it, monitor it, migrate it, and sign off that a platform is fit to carry public traffic. When something breaks in production, escalation stops with me.
Responsibilities
- Linux server administration (Ubuntu, RHEL family)
- Production server management & 24/7 escalation
- Virtualmin administration and tenant provisioning
- Apache & Nginx configuration and tuning
- MariaDB administration, backup and optimisation
- DNS management and zone delegation
- Cloudflare management (proxy, rules, caching)
- SSL/TLS deployment and renewal automation
- Server migration and cutover planning
- Security hardening (OS, WAF, firewall, SSH)
- Infrastructure monitoring and alert triage
- Backup & disaster recovery, restore drills
- Incident response and post-incident reporting
- Vendor & developer collaboration
Selected outcomes
- Migrated a shared-session Joomla portal from local-disk sessions to Redis, ending a duplicate-content bug that had been misdiagnosed as an application fault for months.
- Rotated database and cache credentials across a five-node cluster with zero downtime using MariaDB dual-authentication and Redis 7 ACL dual passwords.
- Brought a WAF from detection-only to enforcing on a live government portal without blocking the editorial team, by scoping the admin path separately while tuning rules.
- Rebuilt a backup job that had been silently double-gzipping archives, then documented the recovery path for every archive already written.
UbuntuRHELVirtualmin
ApacheNginxHAProxy
MariaDBRedisModSecurity
CloudflareBash
Infrastructure Security Reviewer (engagement-based)
Server security reviews for hosted portals
Full-stack server reviews after an external vulnerability scan. I separate the real findings from scanner false positives, verify every claim against runtime evidence, and hand over a prioritised remediation plan the operations team can actually execute.
- Audited web, database, load-balancer and storage nodes; produced a written report per engagement.
- Identified an abandoned second CMS instance sitting inside a live document root. It was vulnerable, and only "protected" by an unrelated server error.
- Found firewall log-source misconfiguration that made intrusion detection appear active while catching nothing.
- Corrected verification methodology: firewall, DNS and TLS tested from an external host, since local checks bypass the rules being tested.
ModSecurityOWASP CRSCSF / lfd
Incident responseLog forensicsCVE remediation
Open-Source Maintainer, Virtualmin ModSecurity Manager
Perl / Webmin module · github.com/irwanmohi/modsecurity
A WAF management module built because triaging ModSecurity on a busy hosting box from raw error logs is not a workflow. Written for operators, not researchers.
- Dashboard of blocked requests grouped by rule ID and domain, with one-click host-scoped exclusions.
- OWASP CRS install, version check and paranoia-level tuning; per-domain engine mode.
- IP allow and block lists that work correctly behind a reverse proxy, with a configurable client-IP source and chained X-Forwarded-For rules that refuse to save without a trusted proxy list.
- Automatic config backups with write–test–rollback on every change.
- Cross-distro support: auto-detects Debian/Ubuntu vs RHEL-family paths and package managers.
PerlWebmin APIModSecurity
OWASP CRSApache
Field work
Featured Projects
Real engagements, described without identifying the client.
Flagship build
PentestPro
A penetration-testing and security-assessment platform I built from scratch in vanilla PHP, no framework. One dashboard runs the scanners, queues the work on a cron worker so nothing blocks a web request, and turns the results into client-ready PDF reports with a risk grade. For authorised testing only.
PHP 8.1MariaDBnmap
Niktok6NVD API
Bashcron
- Twenty-plus modules in one place: port, SSL/TLS, header, XSS, SQLi, CSRF, directory and auth scanning, plus subdomain enumeration and technology fingerprinting.
- Pre-test and post-test reports that compare against each other and show a fix rate, so a client can see what actually got closed.
- CVE Watch pulls daily advisories from NVD, Ubuntu Security Notices and CISA KEV, and alerts by email or webhook when something new lands.
- Extras I needed on real jobs: k6 load testing, a preventive-maintenance report generator, host hardening audit, webshell triage and an uptime monitor.
WireGuard
Automated VPN Access Management
A full-stack system that automates the WireGuard servers I first set up back in 2020. Users self-register and get a config file and QR code in one click. Admins manage access from a dashboard with live peer stats, connection logs and a geolocation map. Flask and Gunicorn behind Nginx, WireGuard handling the tunnels, MySQL behind the app.
WireGuardPythonFlask
MySQLNginxBootstrap 5
LeafletLet's Encrypt
- Automatic WireGuard keypair generation and peer management, with one-click config and QR download.
- Admin dashboard with live peer statistics, connection logs and an interactive geolocation map.
- Automatic access expiry with extension requests, plus HTTPS via Let's Encrypt and scheduled database backups.
Infrastructure
Enterprise Linux Infrastructure Management
Day-to-day ownership of multi-node Linux estates that carry public-facing portals. A load balancer, two web nodes, a dedicated database host and shared storage. My side of it is capacity planning, patching windows, mapping service dependencies and owning escalation.
Ubuntu 24.04HAProxyApache
PHP-FPMNFSsystemd
- Standardised five heterogeneous nodes onto one documented configuration baseline.
- Mapped every service dependency so a node can be drained without guesswork.
- Cut recurring "site is slow" tickets by removing single-node session affinity.
Hosting
Virtualmin Hosting Platform Deployment
I build and run Virtualmin hosting platforms. Virtual server templates, per-domain PHP-FPM pools, DNS zones, mail routing, SSL automation and quota policy. And the part that catches people out, the log topology that Virtualmin's per-domain layout forces on every monitoring tool downstream.
VirtualminWebminApache
PHP-FPMBINDLet's Encrypt
- Repeatable server templates replaced hand-built vhosts.
- Fixed monitoring that silently watched an empty stock log path instead of Virtualmin's per-domain logs.
- Automated certificate issuance and renewal across all hosted domains.
Migration
Production Server Migration
Moved live portals between hosts and platforms with a rehearsed cutover: full dry run on a staging copy, data sync down to a short final delta, DNS TTL lowered in advance, and a documented rollback that stays valid until the old host is decommissioned.
rsyncmysqldumpDNS TTL
VirtualminBash
- Cutovers executed inside the agreed maintenance window, every time.
- Rollback path kept live and tested, never a one-way door.
- Post-cutover verification checklist covering TLS, mail, cron and search indexing.
Database
Database Administration & Optimisation
MariaDB operations for multi-tenant portals. Schema-level backups, slow-query review, connection and buffer tuning, locking down network exposure, and rotating credentials on live systems without dropping a single request.
MariaDB 10.11MySQLRedis
ufwBash
- Zero-downtime password rotation using MariaDB dual-authentication (
IDENTIFIED VIA … OR …). - Closed a database bound to all interfaces down to the two application nodes only.
- Per-database logical backups with verified restores and enforced retention.
Network
Cloudflare & DNS Management
Authoritative DNS and Cloudflare edge work. Zone design, record hygiene, proxy modes, cache and page rules, origin protection, and making sure the real visitor IP survives every hop from edge to load balancer to application.
CloudflareBINDHAProxy
mod_remoteipSSL/TLS
- Aligned proxy trust lists across edge, balancer and web tier so client IPs stop silently disappearing.
- Blocked spoofed
X-Forwarded-Forheaders from untrusted sources at the balancer. - Cleaned stale records and closed an unintended path that bypassed the edge WAF entirely.
Security
Linux Security Hardening
Layered hardening across the stack. ModSecurity with OWASP CRS taken from detection to enforcement, host firewall policy, SSH lockdown, TLS protocol allow-lists, security headers, unattended security updates, and clearing out exposed default files.
ModSecurityOWASP CRSCSF / ufw
OpenSSHTLS 1.2/1.3CSP
- WAF taken to enforcing on a live portal with no editorial disruption, by scoping the admin path while rules were tuned.
- Management interfaces removed from public exposure and reached over SSH tunnels instead.
- Content-Security-Policy rolled out in report-only first, so nothing broke before it was measured.
Monitoring
Infrastructure Monitoring
Monitoring that reflects reality. Health checks that match how traffic actually arrives, log sources pointed at the files the platform really writes, real-time malware detection proven with a live test, and alert thresholds tuned so on-call trusts the pager.
systemdHAProxy checksinotify
maldetLog analysis
- Caught a maintenance-mode rule that returned 503 to health checks and took both nodes out of the pool.
- Verified real-time AV with a controlled EICAR test rather than trusting the dashboard.
- Fixed file-change monitoring that had been dead because its watcher dependency was never installed.
Recovery
Backup & Disaster Recovery
Backups built to be restored, not just taken. Physical dumps alongside per-database logical ones, integrity checks that actually open the archive instead of trusting the exit code, rotation that will not delete a good set after a failed run, and a written recovery procedure kept with the backups.
tar / pigzmariabackupcron
NFSRetention policy
- Found and fixed a job double-compressing every archive, then documented how to recover the ones already written.
- Rotation now skipped on failure, so a bad night can never delete the last good copy.
- Restore steps written in plain language and kept beside the backups.
Incident
Live Compromise: Response & Recovery
Handled an active compromise on a public portal where the payload lived in a database row, not on disk, so file-based antivirus had nothing to find. Contained, traced, cleaned and closed the entry path, then rotated every credential that could have been exposed.
Incident responseFile integrityMariaDB
Log forensicsCredential rotation
- Verified thousands of application core files against the vendor's published release hashes. They came back clean, which proved the injection was database-side.
- Removed the injected content and purged the caches replaying it.
- Locked down the exposed database service and rotated all affected credentials without downtime.
HA
High-Availability Web Tier with HAProxy
Designed and hardened the load-balancing layer. Health checks that fail correctly, secure session cookies, anti-spoofing on forwarded headers, two-tier rate limiting, and shared session state so either node can serve any visitor.
HAProxy 2.8Redis sessionshttpchk
Rate limitingSecurity headers
- Diagnosed duplicate content caused by sessions pinned to local disk during backend flaps.
- Config validated against the exact target binary before handover, because version differences are real.
- Rate limiting applied at two tiers without tripping legitimate bursts.
Open source
Virtualmin ModSecurity Manager
An open-source Webmin module in Perl that turns ModSecurity from a wall of log lines into a workflow. See what was blocked, decide, click. Built for hosting operators running dozens of domains behind one WAF.
PerlWebminModSecurity
OWASP CRSApache
- Per-domain rule exclusions applied as runtime
ctl:actions, not config-time removals. - Reverse-proxy-aware IP rules that refuse an unsafe configuration instead of failing silently.
- Every write backed up, tested and rolled back automatically on error.
Automation
Operational Tooling & Automation
Small tools that take out repeat work. Scheduled content mirroring so a critical directory stays reachable when its source is not, backup and rotation scripts with real error handling, and deployment runbooks written so someone else can run them.
PythonBashcron
systemd timersRunbooks
- Generated a fully searchable offline mirror of a 9,000-record staff directory for continuity.
- Scripts fail loudly and stop, rather than silently producing an unusable output.
- Every deployment documented step by step for handover.
Toolchain
Technology Stack
The software I run in production, day in and day out.
Ubuntu
RHEL
Linux
Virtualmin
Apache
Nginx
MariaDB
MySQL
Cloudflare
DNS
SSL
PHP
Bash
Git
ModSecurity
HAProxy
Redis
Python
Edge & origin
Global Node Map
Origin infrastructure in Malaysia, served worldwide through CDN edge locations. Illustrative topology.
- Origin cluster
- CDN edge / PoP
- Anycast route
Credentials
Certifications
Targets I am working toward. Each card gets swapped for the real credential as it is earned.
RHCSA
Red Hat Certified System Administrator
PlannedLFCS
Linux Foundation Certified SysAdmin
PlannedCloudflare
Certified Associate / Network Engineer
PlannedSecurity+
CompTIA Security+ (SY0-701)
PlannedGet in touch
Contact
Server down, a migration to plan, or a platform to harden? Get in touch.