SystemGSK
2025 - 2026Fleet & rental operations platformSole engineer
The platform GSK Service & Tour runs on: bookings, a live rental board, fleet, HR, finance and marketing in one system.
- Laravel
- PHP
- React
- TypeScript
- PostgreSQL
- Redis
Tech Lead & full-stack engineer
Eddy
I turn ideas into products, from architecture decisions to the App Store.
About
Before code, I ran operations and led marketing across APAC. Now I lead an eight-person engineering team, and I still think like the people who use what we build.
The switch came from a single moment: watching a colleague write code and realising it was a language only certain people knew. I wanted in, so I started learning and never stopped.
Today I'm a Tech Lead at NEXEA, leading a team across SaaS and mobile products. I've shipped two apps to the App Store and Play Store, and I bring the same operational instinct to every system: ship fast, communicate clearly, keep it healthy.
- engineers on the team I lead
- 8
- apps shipped to the stores
- 2
- years on the business side first
- 5
Path so far
- Sep 2019Operations ExecutiveGSK Service & Tour
- Feb 2022International Marketing InternSoftline Group
- Aug 2025Software Developer InternNEXEA
- Jan 2026Software EngineerNEXEA
- Feb 2026Tech LeadNEXEA
- Apr 2026AWS CertifiedSolutions Architect, Associate
Selected work
Products I've built, shipped and kept running, from a rental fleet to a coaching platform and a league app.
Also built
- Event TicketingMaintainer
Kept a live ticketing SaaS running and led its payment gateway migration to Payex with zero downtime while events were on sale.
- React
- Node.js
- RabbitMQ
- PostgreSQL
- Mobile ScannerMaintainer
Cross-platform OCR business card scanner with auto-cropping and multi-modal capture across 13 modules, shipped through EAS to iOS, Android and web.
- Expo
- TypeScript
- Firebase
- JWT
- Cloud InfrastructureDevOps & architect
Multi-cloud production infrastructure across DigitalOcean, GCP and AWS: multi-stage Docker builds, Nginx reverse proxies, Uptime Kuma monitoring.
- AWS
- GCP
- DigitalOcean
- Docker
- Nginx
Architecture
In May 2026 I led the move of a live, multi-tenant coaching platform from a DigitalOcean droplet to AWS. This is the production design: one right-sized node behind Cloudflare, managed PostgreSQL, private storage behind CloudFront, and deploys from CI. Pick a request and follow it through.
AWS Certified Solutions Architect, Associate
Follow a request
Clients
Mobile appExpo, iOS and Android
Web appReact, in the browser
Edge
CloudflareDNS, proxy, strict TLS
CloudFrontApp and files at the edge
AWS, Singapore region
VPC across two availability zones
Public subnet
EC2 node
CaddyTLS and reverse proxy
APIECS task, Express + Prisma
Private subnet
RDS PostgreSQLPrivate, encrypted, SSL only
Regional services
S3Private, versioned buckets
Secrets ManagerConfig, keys, origin cert
ECRImages, with expiry rules
CloudWatch + SNSLogs, alarms, alerts
Beyond AWS
AI servicesGemini on Vertex AI, Chroma
DeliveryGitHub ActionsBuild, deploy, verify
Why it looks like this
Caddy instead of a load balancer
A load balancer bills by the hour before it serves a single request. Caddy terminates TLS on the node that already runs the API, and a load balancer is the planned next step once traffic needs a second node.
ECS on EC2 instead of Fargate
The same orchestration (task definitions, health-checked replacement, deploys from CI) at a lower fixed cost for a single service, with direct access to the host when something needs debugging.
Only Cloudflare reaches the origin
The node accepts web traffic from Cloudflare's IP ranges only, and the database accepts connections from the app only. TLS is verified end to end, with the origin certificate kept in Secrets Manager.
Private by default
Uploads moved from public-read files to private S3. Images reach people through CloudFront with Origin Access Control, documents through links that expire after 15 minutes, and CI signs in with OIDC instead of stored keys.
Cheap now, with the upgrade written down
One node, one task and a single-AZ database is the cheapest setup that still counts as production. The cost is about 30 seconds of downtime per deploy and no failover; Multi-AZ, a second task and a load balancer are the documented next steps.
How the move happened
Account
Root MFA, a named IAM user with MFA, and budget alerts before anything else was created.
Network
A VPC across two availability zones, public and private subnets, a free S3 gateway endpoint, and security groups chained from edge to app to database.
State
Encrypted RDS PostgreSQL with seven-day backups and deletion protection, versioned private buckets with lifecycle rules, and image-expiry rules on ECR.
Compute
ECS on EC2 through a launch template, an Auto Scaling group and a capacity provider, with database migrations as a one-shot ECS task.
Cutover
Uploads moved from DigitalOcean Spaces into S3, stored links rewritten to keys by an idempotent script, then DNS switched. Runbooks, alarms and CI deploys went live with it.
Toolkit
Bridging business strategy with engineering execution: resilient full-stack systems and the infrastructure they run on.
TypeScriptReactNext.jsReact NativeExpoNode.jsExpressLaravelPythonPostgreSQLPrismaRedisDockerAWSGCPCloudflareLangChainTailwindSocket.ioGitHub
Interfaces that perform, from raw HTML and CSS to TypeScript and the React ecosystem, out to desktop with Electron.
- TypeScript
- React
- Next.js
- Tailwind
- JavaScript
- HTML
- CSS
- Bootstrap
- Electron
Let's build something.
EddyUsually replies within 48 hoursOpen to full-time roles, freelance projects, and the occasional interesting problem. Based in Malaysia, open to remote.