Hi, I'mNguyễn Phúc Thọ
I build scalable backend systems, design cloud infrastructure on AWS, implement DevOps practices and CI/CD pipelines, and explore cryptography, CTF challenges, and AI.
Hi, I'm Nguyễn Phúc Thọ
Nguyễn Phúc Thọ
IT Student · DevOps & Cloud · Security & Backend
I design, deploy and run secure cloud-native systems — and I enjoy the plumbing as much as the product. Serverless on AWS and GCP, Kubernetes delivery, CI/CD pipelines and infrastructure as code are where I spend most of my time.
I'm heading toward DevOps and cloud engineering, with a soft spot for networking and security (I play the occasional CTF web challenge). The projects below are where I put that into practice.
Tech I work with
Languages, cloud & tooling
Languages
Cloud & DevOps
Tooling & data
Things I've built end to end
One production platform I run solo, plus four team builds across cloud, data and DevOps. The throughline: I like owning a system from the network and the pipeline all the way up to the UI — not just one slice of it.
Personal Web
Serverless microservices platform · live in production
The site you are reading right now — a cloud-native, serverless microservices platform that runs for about $0.02 a month. Six NestJS services sit behind a single API Gateway, the whole stack is described in Terraform, and every merge to main ships it through GitHub Actions.
Request path — static edge to serverless data
Key features
- Six NestJS Lambdas behind one API Gateway, provisioned end-to-end with Terraform and shipped by GitHub Actions on every merge.
- 465+ automated tests, IAM least-privilege, credentialed cross-site CORS, Gitleaks secret scanning and an AWS Budgets hard-stop.
- Real product surface: a MinerU OCR pipeline, a codebase RAG assistant, a stock/gold dashboard and TOEIC/IELTS study tools.
Serverless Web App with Zero-Cost & Secure
A locked-down VPC serverless architecture on AWS
A serverless web application built around a private VPC. The compute never touches the public internet: functions run in private subnets and reach DynamoDB over a VPC Gateway Endpoint, while CloudFront with Origin Access Control is the only public door to the static front end.
University project · VNUHCM University of Science
No public path to data — everything stays inside the VPC
Key features
- Lambdas in private subnets reach DynamoDB through a VPC Gateway Endpoint — no NAT gateway, no public route.
- CloudFront with Origin Access Control fronting a private S3 origin, plus a least-privilege IAM role per function.
- AWS Budgets alerts keeping the entire stack at effectively zero cost.
Cloud-Based Log Analytics & BI System
Streaming log analytics with a predictive layer
An analytics pipeline on Google Cloud that ingests logs in real time, warehouses them in BigQuery, and surfaces both business dashboards and a predictive model. Event-driven from end to end, so the pipeline scales with traffic and costs nothing while idle.
University project · VNUHCM University of Science
Ingest → warehouse → predict → visualise
Key features
- Event-driven ingestion through Pub/Sub and Cloud Functions into a BigQuery warehouse.
- A logistic-regression model over the warehoused data to classify and predict outcomes.
- Looker Studio dashboards for visual exploration of the results.
Enterprise CI Pipeline
Multibranch CI with security gates for the YAS microservices
A Jenkins CI system for the YAS Java microservices. Every branch builds, tests, and has to clear quality and security gates before it can merge — so nothing broken or vulnerable reaches the mainline. GitHub webhooks drive the pipeline and branch rulesets enforce the green build.
DevOps coursework · YAS reference microservices
Every branch earns its merge
Key features
- Multibranch pipeline triggered by GitHub webhooks, with branch rulesets enforcing green builds before merge.
- Automated tests kept above 70% coverage, sitting behind quality gates.
- Security scanning wired in with SonarCloud, Snyk and Gitleaks on every run.
Kubernetes CD System
GitOps delivery onto a self-hosted K3s cluster
A continuous-delivery system that ships the YAS microservices onto a multi-node K3s cluster. Git is the single source of truth: Argo CD reconciles the cluster to the repo, Helm packages each service, and a full observability stack watches it all in real time.
DevOps coursework · YAS reference microservices
Git is the source of truth; the cluster follows
Key features
- A multi-node K3s cluster (chosen over Minikube) with namespace-tiered environments.
- GitOps delivery via Argo CD and Helm; images tagged by commit and deployed per service and branch.
- Observability with Prometheus, Grafana and Loki behind Ingress-NGINX routing.
University and coursework projects were built in teams; full reports are available on request.
What I've built
Four products living inside one website. Pick one to watch a live demo of how it works inside.
About
Portfolio
A professional introduction — profile, certificates and GitHub projects.
- Personal profileBio, avatar, contact
- Weather themeColors shift with the live weather
- CertificatesUpload & showcase beautifully
- GitHub reposAuto-synced repositories
The code behind it
The repository is private, so it is not on my public GitHub. Browse a generated, read-only walkthrough of the README, file structure and git workflow instead.
Thanks for stopping by
The dashboard inside is a private workspace — Portfolio, English learning, stock analysis and CodeMind. Use “Sign in” at the top to step inside.