Cloud Infrastructure & IaC — OpenTofu on GCP
Reproducible cloud environments defined entirely as code: VMs, networking and firewall policy on Google Cloud, applied and destroyed on demand.
- 100%
- of lab infrastructure reproducible from code
- 3
- cloud platforms worked with (GCP, AWS, Azure)
- min
- environment spin-up/tear-down time
Das Problem
Manually provisioned cloud environments drift, can't be reviewed and can't be reproduced. Lab and project infrastructure needed to be spun up identically, torn down cheaply and version-controlled like application code.
Die Lösung
Implemented Infrastructure as Code with OpenTofu (the open-source Terraform fork) on Google Cloud Platform: declarative definitions for compute instances, VPC networks, subnets and firewall rules, with state management and plan/apply workflows. The same approach carries into my production work — this portfolio itself ships as Docker Compose infrastructure with Nginx, SSL automation and scripted backups on a VPS.
Architektur
- Declarative VM provisioning on GCP: machine types, images, startup scripts and SSH key injection defined in HCL.
- VPC design: custom networks and subnets, least-privilege firewall rules as code.
- Plan → review → apply workflow; state as the single source of truth; idempotent re-runs.
- Complementary AWS experience: EC2 compute, S3 storage, Lambda functions (AWS Academy Cloud Foundations).
- Kubernetes and Docker for workload orchestration; container-first deployment mindset.
- Production VPS operations: Docker Compose stacks, Nginx reverse proxy, Let's Encrypt automation, cron-driven encrypted backups.
Zentrale Funktionen
Everything as code
No console clicking — compute, network and firewall live in version control.
Disposable environments
Full environments created and destroyed in minutes, keeping cloud spend near zero.
Multi-cloud literacy
GCP (primary), AWS EC2/S3/Lambda, Azure fundamentals.
Container orchestration
Docker images, Compose stacks and Kubernetes deployments.
Technologie-Stack
Erkenntnisse
- State is the hard part of IaC — understanding what OpenTofu tracks (and what it doesn't) prevents most real-world incidents.
- Firewall rules as code force you to actually think about least privilege instead of clicking 'allow all'.
- The IaC mindset transfers everywhere: my VPS deployments are now fully scripted for the same reason my labs are.