johnrey-altamarino

John Rey T. Altamarino — DevOps Engineer · Las Piñas, Philippines

Built to stay up.

Two disciplines, held separately: DevOps — EC2 instances, Jenkins pipelines, and the Cloudflare and TLS layer in front of them — and live streaming, self-hosted MediaMTX ingest through to the player people actually watch. Each is a job on its own; I've run both in production, and the goal doesn't change: keep it up, make the next deploy boring.

Service healthAll operational
svc/infrastructureInfrastructureAWS · JenkinsOct 2025 —
svc/streamingLive streamingMediaMTX · WebRTCMar 2024 —
svc/edgeDelivery & edgeCloudflare · TLScurrent
on call · johnrey-altamarino

svc/ — three services, one operator

What I run

Three services, and I'm the operator on each. The pipeline, the stream, and the edge in front of them are separate problems — I've owned all three.

svc/infrastructure

Infrastructure & platform

Work with the developers on the path from dev to production and automate the repetitive parts out of it — Jenkins pipelines, the EC2 instances on both sides of that line, and CloudWatch monitors watching them — so shipping is a pipeline run instead of someone on a terminal at midnight. Grafana and Prometheus I read at a working level, and Windows Server I've only provisioned and left running — enough to answer a question either way, not enough to claim depth.

  • AWS
  • EC2
  • CloudWatch
  • Jenkins
  • Laravel Forge
  • Ubuntu
  • SSH · Termius / Tabby
  • Git
svc/streaming

Streaming systems

Run the delivery path end to end: self-hosted MediaMTX over WebRTC, a Filament console to administer it, and a player built to match what each client actually needs from the stream. It's the part of the stack an audience notices the second it slips.

  • MediaMTX
  • WebRTC
  • Laravel / Filament
  • Token & JWT auth
  • Strict referrer
  • Wowza
  • CDNetworks
  • Encoders
svc/edge

Delivery & edge

Everything between the internet and the origin: TLS, Cloudflare, and the reverse proxies that let one box answer for several hostnames without anyone downstream noticing. Same path without a cloud provider too — an Ubuntu Server on VirtualBox on-premise, port-forwarded out through the ISP's public IP until it answers like anything else on the internet.

  • Cloudflare
  • SSL / TLS
  • Apache
  • Reverse proxies
  • DNS
  • Port forwarding
  • VirtualBox
  • GoDaddy
  • Namecheap

releases/ — newest first

Selected deployments

Every entry shipped to production and carried real traffic. If a figure isn't measured, it isn't here.

v3.0.02026-02

Pipelines and a fleet that stays up

Stood up Jenkins CI/CD on the development servers so a release is a pipeline run, and took over the fleet it deploys to — Ubuntu instances on AWS, a Windows Server box I provisioned alongside them, and the rest managed through Laravel Forge over SSH.

  • Jenkins
  • AWS
  • Laravel Forge
  • Ubuntu
hand-run → pipeline
v2.2.02025-11

The edge in front of it

Put Cloudflare, TLS, and Apache reverse proxies between the internet and the origin, and moved domain management onto GoDaddy and Namecheap so a DNS change stops being a search for whoever registered it.

  • Cloudflare
  • SSL / TLS
  • Apache
  • Reverse proxies
  • DNS
one origin, many hostnames
v2.1.02025-07

Playback by permission

Closed the stream to anyone without a reason to be there: JWT-signed playback tokens, hash validation on the request, and strict referrer checks, so a URL lifted out of the page is worth nothing on its own.

  • JWT
  • Signed tokens
  • Hash validation
  • Strict referrer
open URL → signed request
v2.0.02025-04

Self-hosted WebRTC, ingest to player

Deployed self-hosted MediaMTX delivering over WebRTC, built a Filament/Laravel console to administer it, and wrote a video player that adapts to what each client actually needs from the stream.

  • MediaMTX
  • WebRTC
  • Laravel
  • Filament
self-hosted, end to end
v1.1.02024-03

Live delivery on the vendor stack

Designed and refined the live streaming workflows behind the platform: encoder ingest, Wowza delivery, and end-to-end CDN management on CDNetworks.

  • CDNetworks
  • Wowza
  • Encoders
owned end to end

history/ — 3 years in production

How I got here

Oct 2025 — present

DevOps Engineer · The Pinnacle Operating Systems Inc.

Own the cloud infrastructure behind the platform: Jenkins pipelines on the development servers, EC2 instances running Ubuntu and Windows Server with CloudWatch monitors on them, Apache and reverse proxy configuration, Cloudflare and TLS at the edge, and the server fleet in Laravel Forge.

Mar 2024 — Oct 2025

Streaming Engineer · The Pinnacle Operating Systems Inc.

Ran content delivery end to end and built the stack it runs on — self-hosted MediaMTX over WebRTC with a Filament admin console and a custom player, token- and JWT-based stream access, and CDNetworks, Wowza, and hardware encoders before it.

Nov 2022 — Apr 2023

Cybersecurity Threat Engineer · Trend Micro Inc.

Supported threat analysis, backup and restore procedures, and malware analysis across a hybrid workplace.

build/ — the page you're on

How this site was built

The same discipline as the rest of the page, turned on the page itself: pick the smallest stack that does the job, ship it static, and don't claim anything you can't show.

No CSS framework

Design tokens in :root, one CSS Module for layout, flat single-class selectors. Tailwind and a component library were both on the table and both left off — at this size they are more config than code, and I would rather own the cascade than debug someone else's.

No client components

Every component here renders on the server, so the HTML arrives complete and nothing of mine hydrates. Next's App Router runtime still ships with it, and the scroll reveal is a dozen-line inline script that watches for content entering the viewport — the one piece of my own code that runs in the browser. A page with no client components is not a page with no JavaScript, and I would rather say that than round it down to zero. The rest of the motion lives in the stylesheet: the health panel boots its rows on first paint, content below the fold slides in once as it comes into view, and one pulsing dot repeats through the nav, the panel, the release rows, and the contact pill.

No numbers I can't defend

An earlier draft of this page carried p99 latencies and pipeline pass rates. I had not measured any of them, so they came out and nothing replaced them. What is here now is tooling and dates, and every line of it traces back to work I actually did.

Open to new workJohn Rey T. Altamarino

Let's talk about your uptime

Platform builds, streaming delivery, or a release process that keeps waking people up. Tell me what's breaking.

Still early enough in this to want the parts I haven't done yet. Hand me a stack I don't know and I'll learn it the way I learned this one — in production, carefully.

johnrey.altamarino@gmail.com