Infrastructure Built on First Principles. Systems Engineered for Human Sovereignty.
I design, stabilize, and document cloud infrastructure, virtualized networks, and human-aligned AI workflows. Combining 13+ years of production infrastructure operations across 100+ client environments with telecommunications engineering (CNAM France) and local Edge AI orchestration, I bridge the gap between complex machine topologies and the operators who rely on them.
OPERATOR_SPEC:
identity: "Thomas Mathieu Simon"
credentials: "AS Telecom & Computer Networks (CNAM France)"
current_location: "La Paz, Bolivia [UTC-4]"
languages: ["French (Native)", "English (Fluent)", "Spanish (Working)"]
operational_posture: "Remote Synchronous (US EST/CST/PST · LATAM · EU Overlap)"
machine_layer:
- "Cloud & Hybrid Infrastructure (Azure, M365, BCDR)"
- "Enterprise Virtualization (VMware ESXi, Hyper-V)"
- "Deterministic IaC & Config Management (Terraform, Ansible, Linux)"
- "High-Signal NOC Observability & SNMP Telemetry (3,500+ Endpoints)"
operator_layer:
- "AI Context Engineering & Multi-Agent Pipelines (RLHF Rubrics)"
- "Local Edge Compute & RAG (Raspberry Pi 5, Ollama, Qdrant, Cloudflare Zero-Trust)"
- "Model Context Protocol (MCP) Server & Tooling Integration"
- "Civic Digital Sovereignty & Pedagogical Labs (Minka Lab)"
status: "ONLINE // AVAILABLE_FOR_SELECT_CONTRACTING"Self-hosted, air-tight cognitive and telemetry node running on ARM64 hardware (Raspberry Pi 5), exposing zero inbound WAN ports via Cloudflare Zero-Trust Tunnels (cloudflared) while serving local LLM inference (Ollama), vector RAG (Qdrant), Model Context Protocol (MCP) tool endpoints, and sovereign search.
flowchart TB
subgraph WAN["UNTRUSTED WAN // REMOTE WORKSTATIONS"]
OP["Operator / Client Terminal<br/>(Desktop · CLI · IDE Agent)"]
end
subgraph CF["CLOUDFLARE GLOBAL EDGE // ZERO-TRUST PERIMETER"]
DNS["DNS & Anycast WAF<br/>(tsimon.me)"]
ZTA["Cloudflare Access (Zero-Trust)<br/>MFA · Identity & Service Tokens"]
TUN["Argo Tunnel Endpoint<br/>(Outbound-Only Encrypted QUIC)"]
end
subgraph EDGE["LOCAL SOVEREIGN EDGE NODE // RASPBERRY PI 5 (ARM64 / LINUX)"]
direction TB
CFD["cloudflared Daemon<br/>(Zero Open Inbound Firewall Ports)"]
subgraph SERVICES["CONTAINERIZED & SYSTEMD RUNTIME LAYER"]
MCP["MCP & Scout Agent Pipelines<br/>(Python Tooling & Context Router)"]
OLLAMA["Ollama Local LLM Runtime<br/>(Private Quantized Inference)"]
RAG["Edge Semantic Search & RAG<br/>(Qdrant Vector DB · search.tsimon.me)"]
PI_MON["NOC Edge Telemetry Monitor<br/>(pi.tsimon.me · SNMP / Syslog Probes)"]
end
STORAGE[("Encrypted Local NVMe<br/>& Air-Gapped Backup Sync")]
end
OP -->|"HTTPS / TLS 1.3"| DNS
DNS --> ZTA
ZTA -->|"Authenticated Policy"| TUN
TUN <==>|"Outbound Tunnel Only"| CFD
CFD --> MCP
CFD --> PI_MON
CFD --> RAG
MCP <-->|"Local IPC / REST"| OLLAMA
RAG <-->|"Embeddings / Retrieval"| OLLAMA
MCP --> STORAGE
RAG --> STORAGE
PI_MON --> STORAGE
| Domain | Operational Scope & Production Outcomes | Primary Stack |
|---|---|---|
| 01 / Enterprise NOC & Fleet Observability | Managed 100+ client tenants and 3,500+ endpoints. Tuned SNMP/Syslog baselines and codified deterministic runbooks to achieve a 40% reduction in MTTR and 99.9%+ SLA stability. | Azure VMware ESXi Hyper-V SNMP PowerShell RMM BCDR |
| 02 / Edge Compute, Local RAG & AI Agents | Engineered private local inference nodes, vector RAG hubs, and multi-agent reconnaissance pipelines eliminating third-party telemetry leakage and recurring cloud API overhead. | Raspberry Pi 5 Ollama Qdrant MCP Python Cloudflare Tunnels |
| 03 / Security, Hygiene & Zero-Trust | Pragmatic endpoint hardening, Zero-Trust perimeter segmentation, automated DNS/HTTP security auditing, and air-gapped BCDR pipelines. | Zero-Trust WireGuard iptables GPG/PGP Ansible Terraform |
| 04 / Civic Pedagogy & Sovereignty | Founder of Minka Lab in La Paz, Bolivia—delivering trilingual (EN/FR/ES) Linux, encryption, and AI literacy curricula for high-agency operators. | Linux Open-Source Tooling Trilingual Docs Digital Hygiene |
raspberry-pi-cloudflare-network-operations-monitor— Autonomous ARM64 NOC telemetry and network operations monitor poweringpi.tsimon.me. Engineered for Raspberry Pi 5 with systemd service hardening and outbound-only Cloudflare Zero-Trust Tunnels (zero open inbound firewall ports).Edge-Semantic-Search-RAG-Knowledge-Hub— Sovereign, zero-telemetry semantic search and Retrieval-Augmented Generation (RAG) knowledge base backingsearch.tsimon.me. Combines local quantized embeddings, Qdrant vector storage, and Ollama inference on edge hardware.scout-analyst-pipelines-agents— Multi-stage agentic reconnaissance, data extraction, and structured analytical synthesis pipelines in Python. Designed for deterministic context routing, automated triage, and high-signal reporting.
MinkaLab(minkalab.net) — Open-source educational platform and digital sovereignty curriculum engineered for Latin American learners.Wiki(Operator Runbooks & Hardening Matrices) — Field-tested Linux server administration,iptablesfirewall architectures, Docker containerization, and system hardening notes.- Legacy Infrastructure Archive (2018–2019) — Foundational configuration management and container builds retained for historical continuity, including
Ansiblemulti-tier playbooks, hardenednginx-vhostsSSL/HSTS reverse-proxy templates, anddocker-image-builds(10,000+ pulls on Docker Hub).
- Technical Portfolio & Dossiers: https://tsimon.me (Senior NOC Engineer & AI/Cloud Architect PDFs available on-site)
- Direct Electronic Mail: contact@tsimon.me // hello@tsimon.me
- PGP Public Key (
0xA1048A81B9AEA757):BDFC AB33 0606 4875 55F0 C3C6 A104 8A81 B9AE A757