Support and maintenance

Deployment isn't the end of the collaboration. I offer ongoing maintenance, monitoring, and fast incident response — so you can focus on the business, not on whether the server is still up.

Need a website, a store, or an app? Let's build it.

One point of contact, and you walk away with a finished, working product — design, code, deployment, and upkeep all handled by the same person, no hand-offs between subcontractors.

Experience

Full career timeline — from fintech backend work to 8 years as founder of a 3D-printer company.

1. Senior Backend Engineer / DevOps — Fenige S.A.

   Feb 2022 — present
   FintechPayments
   • Two microservices handling Visa and Mastercard payment flows, integrated directly with Visa Limited UK and Mastercard.
     Stack: Java 17-21Spring BootPostgreSQLHibernateFlywayRabbitMQRedisQuartzPCI-DSSDORAGDPR

     Payout transaction processing backend in a regulated fintech environment, integrated directly with Visa Limited UK and Mastercard (not through a PSP intermediary), run in a multi-instance environment with concurrency issues taken into account.

     • Asynchronous bank settlement file parser (SWIFT, MT940/MT942)
     • Integrating new services into the existing payment hub
     • Ensuring solution-wide asynchronicity and idempotency of API requests
     • Webhook integration for events coming from external systems
     • Built functionality logging the full communication with external APIs (request/response bodies etc.), useful for incident diagnosis

     Outcome: Two production card integrations owned end-to-end since launch, with zero settlement downtime.

   • Contributed to a team project building a CRM panel for merchant onboarding — KYC/KYB integrations and a CDC-based event-logging mechanism.
     Stack: Angular 21JavaSpring BootPostgreSQLRabbitMQRedisQuartzFlywayConfig serviceOAuth2JWTSMSDebeziumKafkaOutbox patternDatabase triggers

     Contributed to a project building a CRM panel streamlining the merchant onboarding process and speeding up the ability to bring new clients onto the payment system — accessible both for internal company use and externally by merchants themselves. The project was delivered by a team of ~10 developers.

     • Integrations with external verification APIs: KYC, KYB, and various sanctions/political-exposure (PEP) lists
     • Authentication and authorisation: OAuth2, JWT, additional SMS verification

     Designed a mechanism for logging every event to the database using the outbox pattern, guaranteeing consistency between state writes and event publication.

     • PoC: using Debezium CDC reading directly from PostgreSQL's WAL, publishing events to a Kafka broker
     • Final production solution built on database triggers instead — operationally simpler than maintaining a separate CDC/Kafka infrastructure at this project's scale

     Outcome: Shorter merchant onboarding time onto the payment system thanks to a self-service CRM panel, and consistent, reliable business-event logging thanks to the outbox pattern.

   • PoC of a High Availability PostgreSQL cluster with Patroni, in response to single-database performance issues.
     Stack: PostgreSQLPatronietcdHAProxyTerraformProxmox VE

     Identified performance issues with a single database, particularly during large report generation — at a transaction volume of up to around 20 transactions/s. Decided to build a PoC of a High Availability PostgreSQL cluster using Patroni.

     • Provisioning virtual machines for the cluster
     • Setting up etcd as the cluster's distributed consensus/state store
     • Configuring 1 master + 2 replicas with automatic failover via Patroni
     • Testing and verifying both slave node detachment and master failover
     • Performance testing of the cluster
     • Tackling read/write consistency issues with replicas under replication lag

     Tests passed successfully — no production rollout, given the risk of destabilising the existing, stable platform.

     Outcome: A verified, deployment-ready HA solution for PostgreSQL — a deliberate decision not to roll it out to production, to avoid risking the stability of the running system.

   • Built a full K3s cluster from scratch (sole implementer): VIP, LoadBalancer, GHCR auth, probes, Prometheus metrics.
     Stack: Kubernetes (K3s)kube-vipHAProxyGHCRPrometheusGitHub ActionsTerraformAnsibleProxmox VE

     Designed and stood up the K3s cluster from bare infrastructure as the sole DevOps owner — fully Infrastructure as Code.

     • Terraform (Proxmox provider) — provisioning control-plane and worker VMs with full resource definitions (CPU, RAM, disks, networking) as code
     • Custom Ubuntu template (cloud-init) on Proxmox — a customised image with qemu-guest-agent pre-installed, SSH host keys and machine-id wiped before conversion to a template, so every clone starts clean
     • Ansible — full automation of OS-level provisioning (disabling swap, system dependencies) and cluster bootstrapping: first master with kube-vip, joining further masters (serial, with retry logic for etcd stability), joining workers, Portainer agent

     Deliberate architectural decisions at cluster bootstrap: disabling the default `servicelb`/Traefik in favour of a custom kube-vip setup for full control over the API VIP and load balancer.

     • Namespaces, VIP + LoadBalancer via kube-vip
     • Private GHCR registry with auth
     • Liveness/readiness probes, a Prometheus metrics endpoint
     • Reusable GitHub Actions workflow with 3 deploy modes (JAR/SSH, Docker/SSH, K8s apply)
     • HAProxy as the production load balancer, with zero-downtime traffic draining on deployments

     Outcome: A self-designed and self-maintained production platform, the foundation for further CI/CD optimisation and migrating additional teams onto it.

   • PoC for distributed logging and metrics (Elasticsearch, Kibana, Filebeat, Metricbeat) covering the K3s cluster and virtual machines.
     Stack: ElasticsearchKibanaFilebeatMetricbeatAnsible

     Prepared the provisioning and setup for a centralised log and metrics collection system, covering both the K3s cluster and virtual machines outside it — previously scattered, unstandardised sources of operational data.

     • Elasticsearch as the central log/metrics store, Kibana as the visualisation and search layer
     • Filebeat collecting system and application logs from both K3s pods and VMs outside the cluster
     • Metricbeat collecting system metrics (CPU, memory, network, filesystem) from the same hosts
     • Agent provisioning automated via Ansible, consistently across the fleet regardless of whether a given host is part of the cluster or a standalone VM

     Outcome: A single, central view into logs and metrics instead of scattered per-host sources — a real reduction in incident diagnosis time.

   • CI pipeline optimisation: cut build times, test log volume, and cleaned up accumulated artefacts.
     Stack: GitHub ActionsBashFlywayCI/CD

     Analysed and optimised existing GitHub Actions workflows to eliminate redundant, unnecessary CI work.

     • Refactored tests to cut unit-test build log output from 66,000 to ~500 lines — readable logs instead of scrolling through thousands of lines of noise when diagnosing failures
     • Identified and cleaned up 250,000 silently accumulated CI artefact files before they caused disk-space issues
     • Custom pre-build Bash script detecting duplicate Flyway migrations — cut CI wait time by ~30%

     Outcome: Cut redundant CI builds by ~50% through workflow optimisation, and reduced CI wait time by ~30% through Flyway duplicate-migration detection.

   • Automated JAR backups in the workflow, enabling fast rollback without a full rebuild.
     Stack: GitHub ActionsBash

     Introduced automated, timestamped JAR artefact backups directly within the deployment workflow.

     Outcome: Fast rollback to a previous version without needing a full rebuild from a tag — real time savings during production incidents.

   • Security hardening from zero: Trivy scanning, image-by-digest pinning, distroless images.
     Stack: TrivyDistroless imagesGitHub branch protectionFine-grained tokensKeyless signingGolden image

     Organised a meeting with the security team to discuss company guidelines on image tagging and golden images, presenting distroless solutions (Google), keyless image signing, vulnerability scanning (Trivy), and general hardening in a container-based approach.

     Introduced vulnerability scanning (Trivy) into the CI pipeline, moved to distroless images (Google base images) and digest-pinning instead of tags.

     As GitHub Organisation Owner: set up branch protection and fine-grained tokens org-wide.

     Outcome: Zero known-CVE production images at rollout; the security policy now applies to every new service across the org.

   • Problem analysis, PoC, and full rollout of the containerisation/K3s migration, capped off with an internal conference for ~15 engineers (incl. CIO).
     Stack: Public speakingVMware vSphereChange managementWireGuard VPNStakeholder management

     Analysed the problem in the existing VMware vSphere environment: slow provisioning of new virtual machines, slow time-to-first-deployment for new applications/microservices, and high infrastructure/hardware overhead for running a large number of VMs on bare metal.

     Analysed possible solutions and made the case for a Kubernetes cluster as a forward-looking direction for the organisation:

     • Lower hardware, organisational, and "human" overhead of managing a large VM fleet and its provisioning
     • Faster first deployments and subsequent deployments alike
     • Ability to introduce alternative QA processes alongside the existing ones
     • Containerisation, eliminating the "works on my machine" problem
     • Ability to stand up separate dev, QA, and staging environments

     Built a PoC on personal infrastructure connected to the company network (VPN/SSH) — on the K3s cluster described in the previous point — onboarding lower-priority microservices first. Connected to the company's staging config service over a site-to-site VPN into the private infrastructure hosting the cluster, to minimise the application changes required by the new deployment method.

     Presented the plan, analyses, solutions, and PoC to key stakeholders. After getting buy-in: organised a session for key developers, fully covering the trade-offs and risks involved. Rolled out the solution to the staging environment first, then waited for the production green light.

     The process was capped off with an internal training/conference for ~15 engineers (including the CIO), explaining the architectural decisions behind the migration and how teams could apply it day to day.

     Outcome: Faster containerisation adoption across other teams thanks to a shared understanding of the architecture, and a real reduction in first-deployment and subsequent-deployment time thanks to the migration from VMware vSphere to K3s.

   • Configured TLS/mTLS and Message Level Encryption (MLE) for sensitive API payloads, with automated certificate rotation.
     Stack: TLSmTLSMLECSRCertificate rotation

     Configured TLS and mutual TLS (mTLS) connections for secure API communication between microservices and external partners.

     Implemented Message Level Encryption (MLE) on top of the mTLS layer for particularly sensitive payloads, including CSR generation and full, automated certificate rotation management.

     Outcome: Secure API communication across two encryption layers (transport + payload), with no manual intervention needed for expiring certificates thanks to automated rotation.

   • Adopted AI (LLM) tooling into daily development workflows, with awareness of the associated security risks.
     Stack: LLM toolingAI-assisted developmentSecurity awareness

     Open-minded transition of parts of the daily development workflow towards large language model (LLM)-based tools — code review, debugging, documentation, prototyping — while staying aware of the security risks of using such tools in a regulated fintech environment (e.g. sensitive data leaking to external services).

     Outcome: A faster daily development cycle through deliberate AI tooling adoption, with no compromises on data security.

2. Fullstack Developer — Softsystem Sp. z o.o.

   Jan 2021 — Feb 2022
   Medical software
   • Java 8 / Spring Boot backend (SOAP + REST), production deployments on Oracle WebLogic 12c.
     Stack: Java 8Spring BootSOAPRESTOracle WebLogic 12cOracle DBAngular

     Built and maintained backend services for a medical system, deployed to a production Oracle WebLogic 12c application server, on an Oracle database.

     • SOAP — most of the communication between services within the system
     • REST — a small number of newer services using this approach

     Ongoing support and development of the system, alongside regular attendance at in-house Angular training.

     Outcome: Stable production rollouts with no downtime in a highly regulated environment.

   • C# GUI application for medical staff, HIPAA-compliant.
     Stack: C#.NETHIPAA compliance

     Co-built a desktop C# GUI application for medical staff, required to comply with HIPAA regulations on patient data protection.

     Outcome: Deepened knowledge of regulations specific to the US healthcare industry, namely HIPAA, and first hands-on exposure to a commercial software development lifecycle.

3. Java Developer Intern — PGS Software S.A. (dziś Xebia)

   Oct — Nov 2020
   Softwarehouse
   • AWS S3/SQS integrations, REST APIs following SOLID/DRY.
     Stack: JavaAWS S3AWS SQSRESTLiquibasePostgreSQLJUnitMockitoTestcontainers

     Internship in a softwarehouse setting.

     • AWS S3 and AWS SQS integrations
     • REST API endpoints following SOLID/DRY principles
     • Database schema migrations via Liquibase
     • Unit tests with JUnit/Mockito, as well as Testcontainers for mocking SQS

     Outcome: First commercial code reviews, applying professional code-quality practices in a softwarehouse setting.

4. Founder & CAD/Embedded Engineer — Printo3D.pl

   Aug 2014 — Jul 2022 (8 years)
   Business OwnerHardware
   • Several FDM/FFF 3D printer designs (Cartesian, H-bot, CoreXY) with a custom controller and power-loss print recovery.
     Stack: C embeddedMarlin (fork)Atmega2560CoreXYCADElectronicsTouch TFT displaysComponent selectionEMCLVD DirectiveCE declaration of conformity

     Designed FDM/FFF 3D printers from mechanical/electronic concept through firmware to series production — full cycle: CAD, component selection, embedded C code.

     • Printers with a classic Cartesian XYZ layout
     • Printers with an H-bot mechanical layout
     • CoreXY — the mechanics that earned the company customer trust and recognition: an antagonistic pair of separate X and Y drive belts, enabling far higher accelerations and jerk than classic layouts. Lower print-head inertial mass and no stepper motor mounted on the head itself (the norm at the time) made it possible to raise print speed and improve quality at the same time

     Monochrome 128×64-pixel displays were the norm back then — the first person in Poland to design a custom controller with a colour touchscreen and program its integration into Marlin firmware.

     Next step: a custom power-loss print recovery system — an extra module with a larger electrolytic capacitor and an Atmega2560 interrupt detected a voltage drop, instantly cut power to motors and heaters, and used the capacitors' stored energy to save the print state and retract the head. Once power returned, the print resumed from where it stopped — unheard of at the time, even from large, well-funded competitors.

     Alongside product certification, gained hands-on experience in electromagnetic compatibility (EMC) testing and the LVD (low-voltage) directive, in cooperation with Rzeszów University of Technology, preparing devices' CE declarations of conformity.

     Outcome: More convenient touch control for users, higher speeds and better print quality thanks to the CoreXY mechanics, real print safety thanks to the custom power-loss recovery, and CE-compliant products thanks to the EMC/LVD testing carried out.

   • Prototype of the first SLA 3D printer in Poland and Europe with a UV laser, no crowdfunding backing.
     Stack: ATmega2560C embeddedMarlin (fork)±15V DACGalvanometers405nm UV laserG-codeCADAnalog electronics

     Developed in 2017–2018, without any Kickstarter-style campaign, a prototype of the first SLA 3D printer in Poland and Europe (curing light-sensitive polymer resins), with a 405nm UV laser steered by galvanometers — yet driven by classic G-code, the format most commonly used in the 3D-printing industry at the time.

     Prototype scope:

     • Device design in CAD
     • Custom control electronics driving ±15V DAC circuits built around an Atmega2560
     • Custom firmware based on the open-source Marlin project, with heavy modifications to motion control
     • From-scratch DAC control implementation, transforming digital G-code geometry into the analog motion of the galvanometers — all in embedded C

     A solo project, discontinued due to the inability to keep self-funding the technology's development, compounded by aggressive competition from Asian manufacturers pushing SLA 3D printing using DLP technology instead.

     Outcome: Hands-on experience designing high-voltage analog electronics (±15V DAC) and converting digital geometry into analog control of precision optics — skills beyond typical embedded C, reused in later hardware projects.

   • 3 patented wireless visual-signalling modules for deaf athletes — full embedded C codebase.
     Stack: ATmega328PnRF24CADEagleEasyEDAC embeddedLow powerPlatformIO

     Circuit design and PCB layout for three modules of a single 2.4GHz wireless system providing visual/light signalling in sports venues for hard-of-hearing athletes.

     The project centred on a miniature referee whistle with integrated electronics, automatically and instantly detecting the moment it's blown, then communicating with the other modules over radio to trigger LED visual signalling on courts/halls (basketball, volleyball, among others).

     Challenges:

     • Minimising the whistle electronics' power draw while keeping instant responsiveness
     • Maximising runtime on a single lithium-ion charge
     • Speed and reliability of the wireless link
     • Radio frame addressing to prevent interference between multiple module sets in the same area, as well as other devices, e.g. Bluetooth or 2.4GHz WiFi
     • Integration with the existing game-clock systems used in the venues

     Outcome: A meaningful improvement in match quality for hard-of-hearing athletes through visual signalling of the referee's whistle, the clock, and other match events.

   • Custom C/C++ device deployed into Maxpol Sp. z o.o.'s production line.
     Stack: CC++Embedded3-axis CNCIndustrial automationRobotics

     Designed a dedicated 3-axis CNC device for applying polymer primers on a client's (Maxpol Sp. z o.o.) production line, including the C/C++ control software.

     The device was integrated into the production process together with a robotic arm feeding and retrieving the part to be primed.

     Outcome: Faster manufacturing throughput for the injection-moulded polymer parts plant, thanks to process automation.

Hosting & Homelab

The private infrastructure I design and run with the same practices I use at work — this site runs on it too.

Have a project in mind?

Send a few lines about what you want to build — I reply personally, usually within a business day. Also open to talking about full-time roles.