Leo Dandy

Multi-Domain Infrastructure Consolidation

Migrated a dental industry platform from eight scattered legacy domains onto a single consolidated structure. The project covered WordPress Multisite configuration across three canonical sites, fifteen-plus SSL certificates via Let's Encrypt, path-preserving 301 redirects, and hash-based SPA redirect handlers written in static HTML because hash fragments never reach the server.

Server hardening covered SSH key-only access on a non-standard port, UFW, Fail2ban, unattended security upgrades, MariaDB socket authentication, and rate-limited Nginx blocks for login and AJAX endpoints.

Restaurant Management Platform — Multi-Tenant PWA

Offline-capable restaurant operations system serving multiple merchants with three distinct interfaces: admin dashboard, handheld POS, and customer QR ordering. A single Firebase Hosting deployment serves three custom domains through runtime hostname detection and route filtering.

The offline layer runs on Raspberry Pi using SurrealDB, keeping service available when the internet goes down. Role-based access control through Firebase custom claims covers five roles across platform and merchant scope. A production-to-staging migration tooling was built for safe testing with real client data, excluding user and session collections by design.

Symfony Application — Three-Environment AWS Architecture

Production Symfony cohort-based learning platform with dev, staging, and production environments. Production runs dual instances behind an Application Load Balancer with shared Redis session storage, RDS PostgreSQL, and S3-backed file storage. The entire stack was provisioned through Terraform.

Cross-VPC networking took an eight-hour troubleshooting session covering security groups, route tables, peering non-transitivity, and NAT gateway limitations. The working solution — RDS in public subnets with strict security group restrictions — went against the standard playbook but was the right call for the constraints. GitHub webhooks drive deployment to all three environments.

Production Monitoring Rollout

Building out Prometheus and Grafana for the Symfony platform — SLIs mapped to user-facing outcomes rather than raw HTTP codes, SLOs with error budgets, and the four golden signals applied to each service. node_exporter and Prometheus run as systemd services on Ubuntu.

Deployment Pipelines Across 300+ Production Systems

GitHub Actions and GitLab CI/CD workflows covering WordPress, Laravel, Symfony, React, and Next.js applications. Build stages run on GitHub runners, rsync deployment uses SSH deploy keys with restricted scopes, and post-deploy hooks handle cache invalidation and health verification.

A reusable WordPress workflow was extracted into its own repository and adopted across client projects. Email notifications on every deploy provide a paper trail with commit diffs, author attribution, and direct links to the commit or pull request.

Compromised WordPress Recovery — Four-Hour Window

Client's WordPress site was compromised hours before a campaign launch. Malicious code was scattered across the filesystem, the database contained injected content, and the original backup was also affected.

Clean recovery required sanitising the database, rebuilding affected files from a known-good source, rotating all credentials, hardening wp-admin access, and installing an automated backup system before the site went back online.

WooCommerce Performance Recovery

Page load times at 8+ seconds, conversion rates declining, a database bloated to 400MB of transient data and orphaned revisions. The fix covered database cleanup, image optimisation (8.2MB to 1.4MB assets), strategic Redis caching, CDN integration, and Nginx FastCGI tuning specifically for the theme's response size.