Internal IT Hub
for northwind.systems

Implemented Git pre-receive hook system on Bitbucket DC v9.4.9 with manage.sh CLI. Policies: file size limits, LFS enforcement, branch naming, repo size caps. Deployed via REST API. Pending: feature.hook.scripts=true in bitbucket.properties.

Migrated n8n from v1.x to v2.4.6. Configured external Python/JS task runners. Set up Hetzner Object Storage S3-compatible backend for binary data. Resolved JS runner timeout and memory issues. Added VPN-based nginx access control with SSE support for /rest/push.

Completed migration of xpromoadmin Yii2/PHP app to Docker on Hetzner KVM.

• Resolved SVN wc.db lock and ext4 metadata_csum overhead
• Fixed SAML stale SAMLResponse auth failures
• Resolved LDAP TLS trust with internal CA on Alpine
• Downgraded MySQL 8.4→8.0 for mysql_native_password compat

Nginx security hardening for Harbor container registry: IP whitelisting, rate limiting per endpoint, TLS 1.2/1.3 only, HSTS, removed server tokens. Configured Trivy scanner integration. All pushes now require authentication.

Deployed Nessus Professional on dedicated Gcore CCX23 instance. Configured production-safe scan parameters (throttle, no disruptive checks, exclude critical hosts). Scheduled weekly scans across all 83 Hetzner servers. Reports integrated into Confluence.

Configured IPv6 across AWS global and China regions (cn-northwest-1, cn-north-1) via Terraform and Ansible. VPC/subnet IPv6 CIDR association, dual-stack routing tables, updated security groups. All ELBs now respond on both stacks.