Nikita Pavelko

DevOps Engineer, Infrastructure & QA

AlaVatra (AlaCraft, AlaMine)Remote, since 2025

Web projects for the Minecraft community: a multilingual tools site and a game server portal. Hetzner Cloud and Cherry Servers, nginx and Apache, Laravel, Node.js, MySQL.

• Security: access-control audit and fixes on the PHP (DLE) site, gitleaks in CI, port and SSH tunnel audit.
• Backups: automated MySQL dumps with integrity checks and rotation, offsite to AWS S3, provider snapshots. Restore tested.
• Monitoring: healthchecks.io, UptimeRobot, Grafana Cloud (Alloy), alerts to Telegram.
• CI/CD: GitHub Actions with self-hosted runners, auto-deploy, smoke tests.
• Services: Node.js / Next.js moved from PM2 to systemd units.
• Process: maintenance windows with rollback plans, change log, runbooks.
• Edge: Cloudflare DNS, proxy, WAF.

Hardware and infrastructure

PersonalSince 2024

• 5+ bare-metal servers assembled and set up for friends and home use: hardware, OS, network, UPS.
• Home Assistant on Raspberry Pi.

Game mod developer

Freelance, remoteSince 2025

• Minecraft: custom mods on request. Ongoing.
• Hytale: custom mods in a small team, about 3 months in 2025. Git feature-branch workflow, Jira. Project closed.

Kiln

Open source, 2026source

What it is

Runs Java Fabric mods, unmodified, inside Horizon, the Rust rewrite of Minecraft 26.3. Nothing gets decompiled or patched: the jar runs as it is, and its calls into Minecraft and the Fabric API become calls into Horizon. About 65k lines of Rust and Java.

• Java runs as its own process next to the game, since Horizon doesn't allow unsafe code inside it.
• Each mod gets a client tick 20 times a second with the game state, key presses and advancements. What it draws goes onto the HUD.
• Coverage is measured, not guessed: a testbench of 139 probes over Minecraft and the Fabric API.

Behind it

• 557 commits and 127 merged PRs in two weeks. Private dev repo, public release repo, and the publish script stops a release that would leak anything. 120 decisions written down ADR-style.
• 5 GitHub Actions workflows: daily scan of the mod catalogue, nightly build, manual checks. Mod code from strangers runs in a network namespace with no network.
• Burned through the free 2,000 Actions minutes. Found the push trigger that ate them and moved CI to self-hosted runners on my own 32-core Arch server.
• The MacBook stays a work machine. Builds, tests and mod checks run on that server over SSH, and so does mutation testing (cargo-mutants plus custom Java mutants), which is far too heavy for a laptop. check.sh gives each run its own git worktree, writes step markers and picks up after a dropped connection.
• That server sleeps when idle. Wake-on-LAN to wake it, a polkit rule to suspend it over SSH, a script that won't suspend while cargo, javac or gradle are running. Checked resume with an NVIDIA GPU.
• Site on an Ubuntu VPS: nginx, Let's Encrypt, a small Python account service under systemd.

Infrastructure repo

2025 to nowThe code that deployed this page

• Two hosts in Ansible: a Debian homelab behind a Cloudflare Tunnel with zero open ports, and an Ubuntu VPS.
• Roles for SSH hardening (keys only, fail2ban, unattended upgrades), Docker, Prometheus and Grafana, static sites with Let's Encrypt. New site = one more entry in a list.
• Every push: yamllint, ansible-lint on the production profile, syntax check.

Finanager

2026

A Telegram bot for my own finances. Python (aiogram), FastAPI, PostgreSQL, React, Docker. Built in GitHub Actions, deployed with Ansible.

Lyceum with enhanced military and physical training

DniproGraduated 2026

• Picked to represent the lyceum at international events in The Hague and with NATO delegations.
• Volunteered at DrukArmy.