Skip to content
Saim Hashmi

SAIM
HASHMI.

Systems & DevOps engineer. I build the layer between code and production.

Carleton University, May 2027. Previously at Synopsys. Merged into Shopify's CLI.

Where I've been.

Experience

  • Software Development Intern · Synopsys (Ansys Fluent R&D)May–Aug 2026Shipped a plotting feature to every Fluent user in two weeks, then moved 13+ repos to Python 3.13.
  • Open-source contributor · Shopify CLINov 2025–Jan 2026Added app config pull to Shopify's developer CLI, merged upstream after maintainer review.
  • Full stack developer · cuHackingSep 2024–Apr 2026Built the event portal for 400+ hackers, on an Nx monorepo with a shared Storybook library.
  • Software development lead · Autonomous Robotics CarletonJul 2025–Jan 2026Cut ROS2 inter-process latency by 15%, and set up Docker CI that onboarded 20+ contributors.
  • B.Eng. Computer Systems · Carleton Universityto May 2027Operating systems, computer networks, embedded systems.

Most of what I build sits where nobody looks: pipelines, tooling, the box under the desk. Here is some of it.

Built by hand.
Taken apart on scroll.

Lotus58 split keyboard

58 keys, hot-swap sockets, an RP2040 and an OLED. Scroll and it comes apart layer by layer, each part labelled with what it is and why I picked it.

Lotus58 split keyboard, assembled
  1. 01Assembled

    58 keys, built by hand this summer.

  2. 02Exploded

    Seven layers, from printed case to keycaps.

  3. 03Schematic

    Every part, every millimetre.

  4. 04End to end

    Software, infrastructure, and the hardware under my hands.

A cluster on a Pi, run like production.

Homelab

VaultPi started as Docker Compose on a Raspberry Pi. It is turning into k3s, driven entirely from git: Argo CD keeps the cluster in sync with the repo, Renovate keeps it current, secrets stay encrypted with SOPS, and OpenTofu owns the Cloudflare side. Zero inbound ports, zero cost.

Hover a node to see what it does. Drag one to pull the graph around.

Read the VaultPi write-up →

  • GitHub repo (GitOps): homelab-gitops: every manifest lives here. If it isn't in git, it doesn't exist.
  • Renovate (GitOps): Opens pull requests to bump image and chart versions.
  • GitHub Actions (GitOps): kube-linter and OpenTofu plan on pull requests, apply on main, over the tailnet.
  • SOPS + age (GitOps): Secrets are encrypted in git and decrypted in the cluster by KSOPS.
  • Argo CD (GitOps): App of apps: keeps the cluster in sync with the repo.
  • OpenTofu (GitOps): Cloudflare DNS and the tunnel as code, with state kept on Garage.
  • Raspberry Pi 4 (Cluster): 8 GB, arm64. The whole homelab runs on it.
  • k3s (Cluster): Lightweight Kubernetes on the Pi, moved over from Docker Compose one service at a time.
  • This site (Cluster): The portfolio you're reading, deployed by Argo CD.
  • Garage (Cluster): Self-hosted, S3-compatible object storage.
  • cloudflared (Edge & access): An outbound-only tunnel: zero inbound ports on the home network.
  • Cloudflare (Edge & access): DNS and the edge in front of the site.
  • Tailscale operator (Edge & access): Private services are reachable only on the tailnet.
  • You (Edge & access): Reading this page through that same tunnel.
  • Prometheus (Observability): kube-prometheus-stack scrapes the cluster, the Pi and the containers.
  • Grafana (Observability): Dashboards for the Pi, every workload and the AWS side.
  • Alertmanager (Observability): Disk, TLS and uptime rules route from here.
  • Discord (Observability): Where the alerts land.
  • healthchecks.io (Observability): A dead man's switch: if the alerts go quiet, that is an alert.
  • 1 TB HDD (Storage): The photo library and the file share.
  • Immich (Storage): Self-hosted photos. Replaced iCloud for 14,000+ of them.
  • Samba (Storage): A LAN-only file share. It never touches the tunnel.
  • S3 (AWS pipeline): Photos sync up from the HDD.
  • Lambda (AWS pipeline): Every upload triggers it.
  • Bedrock + Rekognition (AWS pipeline): Tags and embeds each photo for duplicate detection and text search.
  • DynamoDB (AWS pipeline): Where the tags and embeddings are stored.
  • CloudWatch (AWS pipeline): AWS metrics, pulled into Grafana.

Flows: Renovate to GitHub repo; GitHub repo to GitHub Actions; GitHub Actions to OpenTofu; OpenTofu to Cloudflare; OpenTofu to Garage; GitHub repo to Argo CD; SOPS + age to Argo CD; Argo CD to k3s; Raspberry Pi 4 to k3s; k3s to This site; k3s to Garage; k3s to Prometheus; k3s to cloudflared; k3s to Tailscale operator; This site to cloudflared; cloudflared to Cloudflare; Cloudflare to You; Prometheus to Grafana; Prometheus to Alertmanager; Alertmanager to Discord; Alertmanager to healthchecks.io; CloudWatch to Grafana; Tailscale operator to Grafana; Raspberry Pi 4 to 1 TB HDD; 1 TB HDD to Immich; 1 TB HDD to Samba; 1 TB HDD to S3; S3 to Lambda; Lambda to Bedrock + Rekognition; Bedrock + Rekognition to DynamoDB; Lambda to CloudWatch.

Everything else I've shipped.

Projects

Ottawa, where the winters make you build things indoors.

Where I come from

cuHacking organizers in green shirts under the cuHacking banner
cuHacking
Four teammates holding up phones at the SKYTRAC hackathon
SKYTRAC hackathon
Presenting a Git vs GitHub slide in a lecture hall
Git workshop, ARC

Fourth year of Computer Systems Engineering at Carleton, graduating May 2027. Most of my time goes to the parts of software you only notice when they break: build systems, deploys, the network between two machines.

Last summer I was a software development intern at Synopsys. Before that, a merged pull request into Shopify's CLI, and a string of hackathons that ended with a QNX grant, a top 5 and a third place.

Open to new-grad roles in systems, DevOps and developer tooling from summer 2027. Happy to relocate.

Good at

Making a messy setup reproducible, and leaving it documented for the next person.

Bad at

Leaving a flaky test alone. It will get fixed tonight, whether it wants to or not.

Write. Build.
Ship. Run.

How I work

Code is the easy part. Most of the work is the path it takes to production: the build that has to be reproducible, the pipeline that has to be boring, and the box it runs on that has to stay up while I sleep.

  1. 01Write

    Small changes, reviewed, with tests that fail for the right reason.

  2. 02Build

    Reproducible from a clean checkout. Containers, pinned versions.

  3. 03Ship

    CI/CD that does the same thing every time, so nobody has to remember.

  4. 04Run

    Terraform, Ansible, dashboards. Up while I sleep.

Notes from the build.

Writing

Open to new-grad roles, summer 2027.

Get in touch

I'm in Ottawa and happy to relocate. Email is fastest: hashmisaim037@gmail.com · LinkedIn · GitHub