RomanChursanov

$ cat about.md

role

Team Lead

location

Nha Trang, Vietnam

timezone

UTC+7

status

employed, happily

uptime

-

About me

I'm Roman, a DevOps engineer who started out fixing other people's networks. Today I lead the DevOps team of a private VPN service and am responsible for architecture, tooling and priorities across about 150 servers in 15 countries, all managed as code and delivered through CI.

I like boring infrastructure: reproducible, observable and quiet at 3 a.m. When something breaks, I want a graph that already shows why and a runbook that says what to do next.

Before that: almost three years at a big telecom, where L2 support turned into building tools for a 200-person division, plus banking and a pile of freelance code. That's why I still write docs people actually read.

$ ls -la ~/stack

What I run

$ git log --graph --since=2019

Commit history

1. a7f3e21(HEAD → main)Mar 2026 - now (7 mo)

   DevOps Team Lead

   Private VPN service, 400-600k users, ~100k online

   • Lead the DevOps team: set priorities and make the final call on architecture and tooling.
   • ~150 servers under my management across 15 countries, 26 hosting providers and our own colocation.
   • Everything is managed as code with Ansible, OpenTofu and CI pipelines, so no server is configured by hand.

   What I built and led:

   VPN server fleetOperate the Xray VPN fleet in 15 countries: exit nodes, relays and config delivery gateways, with canary releases and full monitoring.

   Telegram proxyDeployed and operate MTProxy servers for the service's customers. Availability is monitored from multiple regions of Russia, with automatic IP rotation to keep access stable in restricted regions.

   Infrastructure as codeIntroduced infrastructure as code for cloud resources, DNS and servers, built from scratch in 3 weeks, with automatic configuration drift detection.

   Single sign-onSet up centralized authentication and single sign-on for the whole team, DevOps and support, across all internal tools, with role-based access control.

   Secrets managementMigrated all secrets to a centralized, highly available secrets store with replication and role-based access control.

   Private networkMoved all inter-server traffic to a private encrypted mesh network and closed public SSH fleet-wide, with an independent out-of-band access path.

   ObservabilityMigrated metrics and logs to a new observability stack in one day: SLO-based alerting, long-term retention and synthetic checks from real home networks.

   Threat protection & backupsFleet-wide threat intelligence: a ban reaches every server in ~25 seconds. Automated backups with regular restore testing.

   Platform & CI/CDMigrated the team to a self-hosted Git platform with 13 CI/CD pipelines: linting, secret scanning, tests and deployment, plus load testing of critical services.

   VPN control panelExtended the open-source VPN admin panel (530 commits): server and relay management with rollback, canary releases, a visual config editor. Hardened the agent running on every VPN server, cutting known vulnerabilities from 16 to zero.

   Team toolingInternal tooling for daily operations: a CLI for server management, a Telegram admin bot, on-demand diagnostics and an AI integration covering the full VPN panel API.

   PostmortemsIntroduced the team's postmortem standard: every incident gets a blameless review with root cause and follow-up actions. Many cases resolved this way, for example a sudden ~30% drop in online users traced through traffic analysis to censorship equipment rather than an attack. Maintain runbooks for recurring scenarios.

   $ ps aux | grep agent

   Agents on call

   Built for the DevOps team at my current job: our own agents, written on plain APIs behind a self-hosted LiteLLM gateway. They work shifts next to the team, and a human approves anything risky.

   pid	agent	what it does
   1207	watcher	Continuously checks config delivery, error rates and response times, and opens an incident the moment something goes wrong.
   1213	analyst	Investigates: metrics, logs, hosting provider status, whether the service is reachable from inside the country, what recently changed in the code.
   1220	remediator	Applies the fix and verifies it against the metric. When confidence is low, it escalates to an engineer for approval. Cut one outage fix from 3 minutes to 1.
   1234	log-auditor	Reads logs in the background and flags security anomalies before anyone has to look.
   1241	wiki-agent	Updates the engineering wiki after every merge, so docs never lag behind the code.

   • Claude Code
   • LiteLLM
   • MCP servers
   • skills
   • subagents
   • workflows
   • Codex CLI
   • OpenCode
   • OpenRouter
   • vLLM
   • llama.cpp
   • Ollama
   • LLM tracing

   Our own Claude Code skills and workflows turn runbooks into repeatable procedures, so routine ops run the same way every time.

   Guardrails: least-privilege access for every agent, regular audits for secret leaks, a human on every risky change.

2. 5c0de42May 2023 - Mar 2026 (2 yr 10 mo)

   L2 Support Engineer & Internal Tools Developer

   ER-Telecom

   • Closed the escalations L1 couldn't: network diagnostics and customer equipment setup.
   • Sole administrator of the server that ran every project of my department, digital channels for technical support.
   • Rebuilt the knowledge base, wrote training courses and mentored new hires to full independence.

   I went beyond L2 and designed, built and ran the tools a 200-person division worked in every day:

   STPshergithub ↗The division's main Telegram bot, used by ~200 people: shift schedules, shift swaps, colleague search, announcements. Designed, built and maintained solo, 600+ commits.Questionergithub ↗Replaced Zoom and Skype for getting help from on-duty seniors. Every question becomes a tracked thread, and time to help dropped several-fold.Helpergithub ↗Firefox extension that upgrades Genesys and internal tools with automation and new actions. Its built-in stats showed chats closing 5-7% faster on average; the company took its most popular features into in-house development.Flomastergithub ↗Shared library of ready-made chat replies, built into Helper and Genesys. Once it was searchable right inside Helper, chats closed another 2-3% faster. Later adopted as an official internal tool.

   Internal API wrapperinternalPython client for the company's internal service APIs. The foundation of later integrations, STPsher and Questioner included.

   test.exeinternalAutomated diagnostics on the customer's PC: ping, traceroute, iperf speed tests, third-party software checks, wired into internal systems. Took the project over and kept it growing.
3. 1b4nk00Jun 2021 - Oct 2022 (1 yr 4 mo)

   Regional Development Expert

   Tinkoff Bank, remote

   • Handled inbound customer calls from all regions of Russia, fully remote: card applications, delivery and identity verification, with personal data under banking-grade privacy rules.
   • Consistently among the top 10 employees on plan completion and speed-of-work bonuses.
   • Promoted to expert with wider responsibilities: moved from customers to colleagues and ran the internal line answering specialists' questions throughout the day.
   • Onboarded and trained 4 new specialists.
4. f1rst0xSep 2019 - Jan 2021 (1 yr 4 mo)

   Freelance Python Developer

   RemoteFirst Group, self-employed

   • 25-30 clients in a year and a half, from small automation scripts to full systems; found clients myself and had clients come to me directly.
   • Largest project: a CRM system for a flower shop, built in Telegram.
   • Python, aiogram, Bash and PostgreSQL. Delivered end to end, including deployment on the client's own servers.
   • Learned the core ops lesson early: if it isn't automated, it will be forgotten.