I work on cloud security and platform engineering: Kubernetes, GitOps delivery, and the supply chain that feeds them. I study Cyber Security at FAST-NUCES Islamabad, where I lead the AWS Student Builders Community.
Floci is an open-source local AWS emulator. Its EventBridge API destinations could not deliver to an endpoint whose certificate came from a private CA. Floci's own HTTPS clients trusted only the roots built into the binary, so adding a CA to the host's trust store changed nothing.
I traced the failure to the HTTP client behind API destination delivery, proposed a design on the issue, agreed the scope with the maintainers, and shipped it in #7850.
FLOCI_TLS_EXTRA_CA_PATHtakes a PEM file of CA certificates and works with Floci's TLS on or off.- Outbound trust is now assembled in one place: the JVM roots, Floci's own CA, and the extra CAs.
- The JWT issuer fetch uses the same trust, so HTTP API JWT authorizers and AppSync OIDC providers accept those CAs too.
- Tests run against a local HTTPS server with a throwaway CA. The setting is documented in the TLS and environment variable guides.
| palisade | Secure, self-hosted LLM inference. GitOps-delivered serving with a verified supply chain, per-tenant token budgets, and policy enforcement at admission. |
| SecureKubeOps | A DevSecOps pipeline from commit to cluster: CI/CD, Docker, Kubernetes, with Prometheus and Grafana watching it. Manifests live in securekubeops-infra. |
| cloud-security-roadmap | A 26-week, gate-driven path through cloud security and DevSecOps, built on hands-on labs. |
| AWS-Learning-Journey | Security-first AWS labs on the Free Tier, written in Terraform. |
| solarwatch | Watches a solar inverter and sends an hourly heartbeat and alerts to WhatsApp. |