SRE and infrastructure engineer working with financial systems and fintechs in Brazil. I build small, auditable tools in Shell, V and Python, mostly around DNS, Linux hardening, backups, secrets and self-hosting. I write about it (pt-BR and EN) at esli.blog.
Infrastructure & SRE
| Project | Stack | What it does |
|---|---|---|
| DNSbench | V | Ranks DNS resolvers from your own connection, including CDN edge quality |
| terraform-exchanger | Shell | Reuses the same Terraform code across multiple environments |
| gist-sync | Shell | Mirrors GitHub Gists to GitLab, Codeberg, Gitea, Keybase and Radicle |
| sysz-ng | Shell | fzf terminal UI for systemctl |
| ai-md-stack | Shell | One canonical AGENTS.md shared across coding agents, with enforcement hooks |
Privacy & security
| Project | Stack | What it does |
|---|---|---|
| yubikey-shell-toolkit | Shell | YubiKey management, encryption and validation from the terminal |
| vBackups | V | Encrypted and signed backups with integrity verification |
| Brave-Filters-and-Scriptlets | JS | Custom adblock filters and scriptlets for Brave |
| proton-launcher-extension | JS | Opens Proton services as web apps on Chromium browsers |
Linux workstation
| Project | Stack | What it does |
|---|---|---|
| UAI-FAI | Shell | Post-install provisioning for Ubuntu and Fedora |
| dotfiles | - | Arch/Hyprland and Fedora/KDE configs |
| easy1090 | Shell | One-command ADS-B stack on Arch: RTL-SDR driver, readsb and feeders |
| linux-daw-ssl-lowlatency | Shell | Exclusive ALSA access for DAWs under PipeWire, at the lowest latency |
Apps & experiments
| Project | Stack | What it does |
|---|---|---|
| climabr.app | Astro | Brazilian weather and environmental dashboard |
| tokenmeter | Python | Pi Zero 2 W + e-ink display showing LLM token quota and usage |
| humanize-br | Python | Rewrites AI-sounding text into natural pt-BR |
Thirty-something gists of things I got tired of rewriting:
| Snippet | Use |
|---|---|
SRE system prompt (pt/en) |
LLM system prompt for SRE, DevOps and sysadmin work |
| CMDB with Steampipe + Powerpipe | Cloud inventory as a queryable CMDB, with a systemd unit |
sysctl.conf hardening |
Kernel hardening and tuning, tested on Debian, CentOS and Arch |
| gitflow-analyzer | Audits branch structure, PR history and CI/CD pipelines |
| git-multi-sync | Adds, creates and syncs the same repo across multiple remotes |
| Orphan AWS load balancers | Finds LBs with no healthy targets attached |
| Parse YAML in Bash | No yq, no Python, just sed and stubbornness |
Long-form at esli.blog, mostly Portuguese, some pieces in both languages. Most of it is written as a series, so each one has an entry point.
| Series | Parts | Start here |
|---|---|---|
| YubiKey | 6 | 2FA, from obligation to architecture |
| SDR & ADS-B | 8 | SDR: radio on Linux |
| Encrypted DNS | 4 | DNSCrypt, DNS Stamps and encrypted DNS |
| File encryption with age | 4 | age: simple, modern file encryption |
| SRE practice | 12+ | Best practices for SRE |
| AI for SRE | 7 | Why I use Claude for SRE work |
| V for sysadmins | 5 | From Bash to V |
| Linux audio & DAWs | 6 | Bass on Linux with the SSL 2+ MkII |
YubiKey: full series
- Introdução ao 2FA
- Instalação no Linux
- 2FA no console, ssh e sudo
- OpenSSH com ed25519-sk / ecdsa-sk
- Chaves GPG
- Compilado: criptografia, Linux e o que mudou
Also: YubiKey na programação: guia para SRE, DevOps e Sysadmin · in English, The Ultimate YubiKey Guide and Setup for Linux
SDR & ADS-B: full series
- SDR: rádio no Linux
- ADS-B, SDR e a comunicação
- RTL-SDR v4 no Linux
- Capturando ADS-B em 1090 MHz
- Do terminal ao mapa: tar1090
- Todas as formas de ver o ADS-B em tempo real
- ADSBExchange: enviando os dados
- easy1090: instalador completo
In English: ADS-B on Arch Linux, and the installer it took
Encrypted DNS & privacy
- DNSCrypt, DNS Stamps e DNS criptografado
- dnscrypt-proxy no Linux
- DNS criptografado no Android
- SNI leak: o calcanhar de Aquiles do DNS seguro
- Teste seu navegador contra vazamentos e fingerprint
- Vigilância governamental: Five Eyes, MLAT e outros
- NTS: autenticando a hora do seu Linux
In English: Encrypted DNS: The Guide
Encryption & age
- Ferramentas para criptografia
- Como escolher ferramentas de criptografia
- age: criptografia de arquivos simples e moderna
- age + YubiKey
In English: Beyond GPG: Hardware-Backed File Encryption with age and YubiKey
SRE practice
- Melhores práticas para SRE
- SRE e métricas · DORA, 4 Golden Signals e os Mean Times
- Gerenciamento de crises e incidentes · boas práticas · o Incident Commander
- SRE num ambiente tradicional de TI · e a sustentação das operações
- Engenharia de resiliência em sistemas distribuídos
- Pare de fazer cosplay de Big Tech: o SRE do Google não é a bíblia
- O ciclo de vida real da engenharia: sua POC não é produção
- Team Topologies e a engenharia de plataforma
- Simplicidade no SRE · As documentações · As monitorações
- Docs as Code · DocOps · SRE Product Manager
In English: RTFM: Read The F*cking Manual
AI for SRE, and V
- My AI setup: Claude, Abacus and OpenCode
- AI para SRE: por que usar o Claude · Claude CLI: automação real para SRE
- AI coding com agents locais e open source
- Seu repositório precisa falar "LLMês"
- O lock-in das IDEs de IA
- De Bash para V: guia prático para sysadmins, SREs e DevOps
- Introdução ao V · web server em V · tratamento de erros
Languages, habits and follow-up
Linux (Arch/Hyprland, Fedora/KDE) AWS Kubernetes / EKS Terraform OpenSearch
Prometheus Steampipe / Powerpipe Shell V Python Perl Rust
Background
- Currently working on financial systems and fintechs in Brazil
- Previously Zenvia, PagSeguro, Serasa Experian, Nubank
- Learning V and Rust; using LLMs as day-to-day SRE tooling
- Open to collaborating on FOSS: infra, privacy and Linux tooling
- Brazilian-born, EU/Portuguese citizenship. Bass player, Krav Maga, IDSC LatAm
Keys
PGP 6DDA 9E48 41D4 B1F1 E43A 6477 5EF7 4834 A3C9 651A
age age1yubikey1qfvyh29sgkgwj6fx3see6ea54zl9rfhrjz3a4hrejqtnwvclfktrygh6ecj
Private keys are hardware-bound to a YubiKey and non-exportable. Full public keys: keys.openpgp.org · keybase