# Deepak Dinesh — Senior IT Systems Engineer & Digital Transformation Specialist

> Deepak Dinesh | Secure Networks. Automated Futures.
> node: Muscat, Oman · contact: deepakdinesh@outlook.com

# Routes

- https://www.deepakdinesh.com
- https://www.deepakdinesh.com/about
- https://www.deepakdinesh.com/work
- https://www.deepakdinesh.com/blog
- https://www.deepakdinesh.com/uses
- https://www.deepakdinesh.com/now
- https://www.deepakdinesh.com/tags
- https://www.deepakdinesh.com/guides
- https://www.deepakdinesh.com/guides/zero-trust-small-business
- https://www.deepakdinesh.com/guides/tailscale-vs-twingate
- https://www.deepakdinesh.com/guides/cost-discipline
- https://www.deepakdinesh.com/adr
- https://www.deepakdinesh.com/display
- https://www.deepakdinesh.com/status

# Case studies (6)

- [TweakDeals: Real Price History for AliExpress Tech](https://www.deepakdinesh.com/work/tweakdeals): Price-intelligence platform tracking AliExpress tech gear with real discount history from observed prices. Next.js 16 on Cloudflare Workers + Neon Postgres.
- [Spilled Palette Studio: Art Gallery at 95+ Lighthouse](https://www.deepakdinesh.com/work/spilled-palette-studio): Aesthetic-first Next.js 14 portfolio for digital artist Aswathi Bindhu Jawahar — dynamic masonry grids, Cloudinary image optimization, and Framer Motion interactions at 95+ Lighthouse.
- [Tally Prime Remote Access: Migrating RDS from blocked Tailscale to Twingate](https://www.deepakdinesh.com/work/rds-migration-tailscale-to-twingate): How I bypassed ISP-level DPI restrictions in Oman to restore Tally Prime ERP access. A migration from Tailscale to Twingate using RDS RemoteApp, Let's Encrypt, and Zero Trust principles.
- [Automated AI Inventory Forecasting: Python & Prophet](https://www.deepakdinesh.com/work/inventory-forecasting-tool): Built an ETL and forecasting pipeline using Python, SQLite, and Meta's Prophet AI to automate replenishment for ~7,800 SKUs. Reduced the supply chain planning cycle from days to hours.
- [Unified IT Infrastructure for a 10-Branch Retail Group](https://www.deepakdinesh.com/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group): Multi-year modernization for 10+ retail branches across two countries: centralized financial ERPs onto Windows Server 2019 RDS, replaced hardware VPNs with a Tailscale mesh, and added Prometheus and Grafana observability.
- [Mushtariyat.com: High-Performance E-Commerce on DigitalOcean](https://www.deepakdinesh.com/work/mushtariyat): Bespoke WooCommerce platform on a $20 DigitalOcean droplet serving 5,000+ monthly visitors, with Redis object caching, Cloudflare edge caching, and Thawani Pay for the Omani market.

# Terminal logs (22)

- [What Prometheus Sees: Monitoring 10 Branches from One Grafana](https://www.deepakdinesh.com/blog/monitoring-ten-branches-grafana): The unified-infrastructure case claims Prometheus and Grafana observability — this is the architecture behind the claim: what gets scraped, what the dashboard shows, what fires alerts, and the one blind spot the design still carries.
- [The Receipts Ledger: Every Dollar This Infrastructure Didn't Spend](https://www.deepakdinesh.com/blog/infrastructure-receipts-ledger): Pure synthesis, no new numbers: the $2,500/yr VPN saving, the $20 droplet vs $2,000 SaaS quote, the $20/mo KV line deleted, and the zero-bill pipelines — each linked to its proof.
- [Tally Prime on RDS RemoteApp: The Day-2 Shape (Sessions, Licenses, Certificates)](https://www.deepakdinesh.com/blog/rds-day-2-operations): The RDS cutover posts cover the migration night — this is what operating it looks like after: session-broker license management, timeout policies at peak hours, the 60-day certificate cycle, and the connector you still have to watch.
- [ZTNA Phase 2: The Plan and the Definition of Done](https://www.deepakdinesh.com/blog/ztna-phase-2-build-log): The /now entry commits to moving the last Tally Prime hop off the legacy VPN segment onto ZTNA. This is the plan, not a build log: what Phase 1 proved, what the last hop needs, and what done looks like — no completion claims yet.
- [18,000 Observations a Day: Inside the TweakDeals Price Pipeline](https://www.deepakdinesh.com/blog/tweakdeals-price-pipeline): The case proves the what — 2,084 products, 21 jobs, 2-minute poll. This is the how: the quota-aware poll loop, the scoring curve that unclumped 55.8% at 75, and stale-by-design edge reads.
- [The Database Emptied Itself Twice: Forensics on Shared Credentials and Truncate-Capable Scripts](https://www.deepakdinesh.com/blog/empty-database-postmortem): Twice in 2026 the TweakDeals database was emptied from under the site — in August, 2,544 products at 10:32 UTC were zero by 11:05. Forensics, guards, and the prebuild cache that saved the site.
- [Paperclip Agents Rebuilding My Portfolio: The DAR Loop and the LIKE/REJECT Gate](https://www.deepakdinesh.com/blog/paperclip-dar-loop): Four Paperclip agents took a Next.js portfolio from idea to merged pull request while I only reviewed. The interesting part is not the code — it is the DAR issue queue, the visual approval gate that stopped a broken redesign from shipping, and the two failure modes I had to design around.
- [The CSP Outage I Caused Myself: Placeholder Nonces, strict-dynamic, and Prebuilt Headers](https://www.deepakdinesh.com/blog/csp-nonce-outage): A placeholder nonce that shipped to production took this site down for 41 minutes. Here is the exact failure, why static headers cannot emulate per-request nonces, and the three fixes that made the site both faster and actually secure.
- [What I Ask Before Touching Your VPN](https://www.deepakdinesh.com/blog/vpn-migration-intake-checklist): Five outputs before any migration sketch: netcheck UDP, DERP reachability, the cert subject names, the NAT shape, and the rollback plan. Drawn from the RDS cutover's transcripts and ADR-003.
- [Tally Prime XML to SQLite ETL Cookbook](https://www.deepakdinesh.com/blog/tally-etl-cookbook): The unglamorous plumbing behind the 18h-to-4h forecasting win: streaming a 1.8 GB Tally Prime XML export with lxml iterparse, surviving mixed encodings and damaged nodes, into an indexed SQLite frame.
- [I Deleted My Vercel KV Instance: Rate Limiting on the Free Tier Without a Data Store](https://www.deepakdinesh.com/blog/killing-vercel-kv): Vercel KV cost me $64 in idle months and caused one 26-minute connection-pool outage. I moved the fast path to a per-process sliding window and the durable counters to Postgres — $20/month to zero, and p99 latency on /api/search from 310 ms to 12 ms.
- [RDS Certificate Subject-Name Mismatch: Binding Let's Encrypt Across All Four Roles](https://www.deepakdinesh.com/blog/rds-cert-binding-guide): Twingate routed RDS traffic fine — then RD Gateway rejected every session on certificate subject-name mismatch. The fix: win-acme DNS-01 plus one PowerShell script binding all four RDS roles every 60 days.
- [OpenClaw as an IT Operations Nerve Center: My 2026 Setup](https://www.deepakdinesh.com/blog/openclaw-it-operations-nerve-center): How I replaced a patchwork of cron jobs, scripts, and notifications with a single autonomous AI agent that handles infrastructure monitoring, code deployments, and operational workflows — running 24/7 on a MacBook Air.
- [The Slim CI Rebuild: One Pipeline Per Push, One Browser Download, Zero Redundant Installs](https://www.deepakdinesh.com/blog/slim-ci-rebuild): Every push to an MR branch ran two GitLab pipelines and every Playwright job downloaded its own Chromium. Commit 1f3a658 fixed all three with workflow rules, lockfile-keyed caching, and a shared browser artifact — here is the exact diff and what it cannot prove.
- [The Redirects That Vanished: vercel.json, Prebuilt Deploys, and 308s Rebuilt as Routes](https://www.deepakdinesh.com/blog/prebuilt-redirect-saga): vercel deploy --prebuilt reads .vercel/output/config.json, not vercel.json — so six redirect rules silently stopped firing and /syslog answered 404. Commit 4e238be re-emitted them as routes[] entries, and 19d1b23 taught the probes about trailing slashes. Real code, real ordering constraints.
- [Nonces End to End: generate, build, inject, finalize, verify](https://www.deepakdinesh.com/blog/nonce-pipeline-ensemble): Five scripts carry one UUID from mint to production header — scripts/generate-csp.mjs, inject-nonce.mjs, finalize-csp.mjs, csp-check.mjs, verify-prod-csp.mjs. Two production incidents drew the map; the pipeline diagram in this post is the repo's own chain.
- [Grounding the Ask Box: An 8 KB Fact Blob, a Cite-Slugs Rule, and the Guards Around It](https://www.deepakdinesh.com/blog/grounded-ask-fact-blob): The site's ask box answers from a build-time JSON blob capped at 8 KB — titles, slugs, summaries, tags, metrics, nothing else. Here is how scripts/generate-chat-facts.mjs builds it, the cite-slugs rule in src/pages/api/chat.ts, the rate-limit and body guards, and what none of that actually proves.
- [Build Attestation: One build.json Feeds the Footer, /status, and /api/health](https://www.deepakdinesh.com/blog/build-attestation-status-health): scripts/generate-build-info.mjs hashes every content file into src/generated/build.json before astro build; Footer.astro, status.astro, and api/health.ts all read that one file — counts never drift because there is exactly one place they can come from.
- [AI Inventory Forecasting: From 18 Hours to 4 Hours](https://www.deepakdinesh.com/blog/ai-inventory-forecasting): How I replaced a crashing Excel-based inventory planning process for 7,800+ SKUs with a Python multiprocessing pipeline using Meta's Prophet AI — cutting weekly planning time from 18 hours to 4 hours overnight.
- [Tailscale Blocked? Moving Tally Prime ERP to Twingate ZTNA](https://www.deepakdinesh.com/blog/bypassing-vpn-blocks): When TRA Oman blocked our VPN protocol, operations halted across 4 branches. Here is the technical and business breakdown of how we migrated to Zero Trust architecture and restored operations within 48 hours.
- [5 Lessons from 10 Years of Digital Transformation](https://www.deepakdinesh.com/blog/10-years-of-digital-transformation): A decade of leading IT initiatives in Oman — ERP migrations, AI deployments, Zero Trust adoption. Here are the hard-won strategic insights that actually translate to business value.
- [WooCommerce Optimization: Caching & Core Web Vitals](https://www.deepakdinesh.com/blog/woocommerce-seo-optimization): How I optimized a heavy WooCommerce store on a DigitalOcean droplet to pass Google's Core Web Vitals — cutting TTFB from 1,200ms to 300ms (−75%) and improving mobile conversion rates within 30 days.

# Stack (11)

- Astro + Tailwind [Frontend]: Static-first pages with islands where needed; this portfolio is the demo.
- Cloudflare Workers [Tooling]: Edge-served static shells with a micro-API for live data. Staleness by design, never blank.
- GitLab CI + Playwright/Vitest [Operations]: Empty-DB gates and staleness monitors in CI. Deploys that fail boring instead of blank.
- Neon Postgres [Tooling]: Serverless Postgres over HTTP for the edge; Prisma where there's Node, raw SQL where there isn't.
- Nginx + Redis [Infrastructure]: Nginx terminates and caches, Redis absorbs the catalog reads. The $20 VPS formula.
- PowerShell [Operations]: Every Windows Server I touch gets scripted before it gets documented. Repeatable beats clever.
- Prophet + SQLite [Data]: One time-series model per SKU, persisted in SQLite. Boring storage, honest forecasts.
- Python ETL (lxml/Pandas) [Data]: Stream the gigabyte, never load it. Iterparse plus a pre-processor beats RAM every time.
- Tailscale [Security]: The default mesh until the ISP says otherwise; ACLs per port, not blind LAN trust.
- Twingate [Security]: Outbound-TLS ZTNA is what survives DPI. No public IP, no inbound ports, no handshake to fingerprint.
- Windows Server RDS [Infrastructure]: RemoteApp turns a desktop ERP into a streamed app; session-host tuning is the whole job.

# Now (1)

- Current focus: Rebuilding this site on Astro 7 with a real command palette (no SaaS template in sight), because content-collections-driven pages keep the homepage metrics and deployment proof in sync instead of drifting apart. / Zero Trust rollout, phase 2: moving the last Tally Prime ERP hop off the remaining legacy VPN segment onto ZTNA (follows the completed Oct 2025 cutover in ~/work/rds-migration-tailscale-to-twingate), so no branch still depends on a fingerprintable VPN handshake. / Writing up the Prophet forecasting pipeline's move off the nightly cron. The ~7,800-SKU run from ~/work/inventory-forecasting-tool deserves a scheduler with retries and checkpoints, not a fire-and-forget timer.

> full dump: https://www.deepakdinesh.com/llms-full.txt
> feed: https://www.deepakdinesh.com/rss.xml
> resume: https://www.deepakdinesh.com/Deepak_Dinesh_Resume.pdf