Oliver Hofmann

Profile

From the pressroom to the cluster

Five years running the presses at Tamedia — printing and quality-controlling the daily newspaper for German-speaking Switzerland, well enough to place third at the Swiss printing championship. Then a full-stack bootcamp, a handful of software engineering roles, and a slow pull toward the infrastructure underneath the code, until that became the job.

Mostly self-taught from there — Go, Kubernetes, Linux, virtualisation — learned by building a homelab and breaking it repeatedly. Drawn to problems with constraints that don't move: fixed hardware limits, healthcare regulation, a fleet that isn't allowed to go down.

Now

Platform Engineer — Cistec AG

Since October 2022, building and running the Kubernetes platform behind Cistec's clinical information system — the software Swiss hospitals run their operations on.

~60k3s clusters

~3,000ArgoCD apps

Hub–spokeGitOps architecture

GitOps: ArgoCD + KCL rendering every cluster's workloads, migrating the fleet from central push-mode to a hub–spoke model with argocd-agent.
Node lifecycle: an immutable, signed Fedora CoreOS image and an unattended reboot coordinator that respects disruption budgets and etcd quorum.
Security: in-tree ValidatingAdmissionPolicy/CEL, tiered break-glass RBAC, SELinux-hardened nodes, Tetragon runtime enforcement.

Timeline

How it went

2022 — present

Platform Engineer — Cistec AG

Kubernetes platform for a regulated healthcare-IT vendor.

2021 — 2022

Software Engineer — Inetum

Infrastructure for a Swiss Military platform, built from scratch.

2021

Software Engineer, Security — Kudelski Security

Tooling to bring security audits into the dev workflow.

2020 — 2021

Freelance — Zürich

Client websites; first hands-on Kubernetes and KVM.

2019 — 2020

Software Engineer — StoryShare & Asperger AG

First engineering roles: Go, PHP, Laravel, React.

2013 — 2018

Printing Engineer — Tamedia

Ran the newspaper presses. 3rd, Swiss printing championship.

Homelab

Same discipline, smaller blast radius

The homelab is run the same way the day job is: GitOps, real secrets management, nothing hand-configured that could be declared instead.

Kubernetes on Proxmox, deployed the same GitOps way as production, with Longhorn and MinIO for storage.
Secrets handled through Vaultwarden rather than files on disk.
Home and colocated MikroTik routers running BGP and IPv6.
Self-hosted mail with hardened DNS and DMARC.
A self-hosted LLM stack — Open WebUI in front of Ollama.
The whole workstation reproducible from a personal Nix/home-manager flake.

Off duty

Not at a keyboard

Cycling Building bikes Climbing Hiking