Marios Xenofontos
Marios Xenofontos

6 apps live on Cloudflare

Marios Xenofontos

IT Systems Administrator II · DevSecOps focus · Larnaca, Cyprus

I build web apps with AI, then do the part AI won't: secure them, ship them through CI/CD and keep them running on Cloudflare.

Email me GitHub ↗ LinkedIn ↗
  • 6 production apps built
  • Zero Trust on every app
  • GR · EN languages
  • Cloudflare
  • GitHub
  • GitHub Actions
  • Microsoft 365 & Entra ID
  • Docker
  • TypeScript
  • Hono
  • Linux
  • PostgreSQL
  • Nginx

Work

Things I've built.

Production web apps I designed, built with AI and run on Cloudflare's edge. Each sits behind Zero Trust login and goes through the same security baseline. Screens are illustrations; no employer or client details are shared.

buildingMCPRBACGDPR

Internal AI Assistant

A central AI chat that answers questions from an organisation's databases through MCP. It only sees what the person asking is allowed to see, with limits on what it can read and GDPR and EU AI governance built in.

  • Role-based access on every data source
  • Guardrails on what the AI reads and returns
  • Runs on Cloudflare Workers behind Cloudflare Access

liveGitHub APICloudflare API

IT Environment & Asset Hub

Every system and piece of software in an IT environment, what it does, where its data lives and who manages it, plus hardware per person and joiners and leavers. It covers what an asset tool like Snipe-IT would, and more.

liveorganisation-widepayroll

Workforce Scheduling

Replaced the shift spreadsheets. Managers publish their own team's shifts, overtime is calculated automatically, and HR gets payroll-ready exports.

liveper department

Department Operations Apps

One app per department for tracking its KPIs and cases, built around how that team actually works.

liveorganisation-wideHR

Appraisal System

One review process for the whole organisation, with history in one place and each person seeing only what their role allows.

livemarketing

Social Media Calendar

One content calendar across all social accounts, so everyone sees what goes out, where and when.

in useDevSecOps

Security Baseline for AI-Built Apps

The standard every app meets before it ships: a hardened Workers template, OWASP rules for AI and humans, and scanning of code, dependencies and the live site.

How I ship

How my apps run on Cloudflare.

Code goes from GitHub through scanning to the edge. People reach it only through Zero Trust, and data is backed up somewhere else.

Architecture of my apps on Cloudflare Code is pushed to GitHub, scanned by Semgrep and dependency checks in GitHub Actions, and deployed with Wrangler to Cloudflare Workers. Everything the apps do is logged, health-checked and alerted on. Staff on Intune-compliant devices sign in through Cloudflare Access with Entra ID, pass the WAF and bot rules, and reach the Workers apps, which use D1, KV and R2 and are backed up to off-site storage. The AI assistant reaches databases through MCP with role checks. CLOUDFLARE EDGE Staff Intune-compliant devices Access Zero Trust · Entra ID WAF & bots rules · origin lock Workers apps internal web apps Data D1 · KV · R2 · databases Off-site backups external storage · DR plan GitHub code & review Scan Semgrep · Gitleaks · deps GitHub Actions wrangler · health check Logs & alerts logs · audit · alerts Apps and the AI assistant read data only through MCP, with a role check on every request MCP role check

The same setup, written up on GitHub: github.com/mariosxen ↗

  1. 1

    Start secure

    Hardened template, threat model, OWASP rules.

  2. 2

    Scan

    Semgrep, Gitleaks, actionlint and Dependabot on every change.

  3. 3

    Deploy

    GitHub Actions to staging, then production, then a health check.

  4. 4

    Protect

    WAF and bot rules; origin only accepts Cloudflare.

  5. 5

    Gate access

    Entra ID from compliant devices at the edge; inside apps, open-source Better Auth on D1 with rate-limited email one-time codes and secure sessions.

  6. 6

    Recover

    Off-site backups and a written recovery plan.

Watching it in production

  • Logs

    Workers Logs with sampling, shipped out with Logpush.

  • Audit trail

    Audit logs of user actions, plus security events: logins, denials, rate-limit hits.

  • Metrics

    Analytics Engine for app metrics, Web Analytics for traffic.

  • Health

    /health endpoints, post-deploy checks, uptime monitors and alerts.

  • Front door

    Turnstile on forms and logins, rate limiting, WAF and Access logs.

  • Headers

    CSP, HSTS and a security.txt on every app.

Experience

Where I've worked.

  1. May 2024 – now · Kiti, Larnaca · hybrid

    IT Systems Administrator II

    Greendial Software Solutions promoted Jun 2025

    • Microsoft 365, Intune, Entra ID and Conditional Access, passkey MFA.
    • Network administration with VLAN segmentation.
    • Security and access practices: Zero Trust, logging, backups.

  2. Jul 2023 – May 2024 · Larnaca

    IT Support & Field Engineer

    Simplex Software & Internet Services · data centre

    • VMware vSphere and Proxmox VMs, Veeam backups, Synology storage, Zabbix monitoring.
    • Windows Server, Active Directory, Exchange and Zimbra, Cisco Meraki, DNS, VPN and firewalls.

  3. Jan 2022 – May 2023 · Larnaca

    Internship Trainee, Network Infrastructure

    CYTA

    • GIS design, fibre and copper cabling, fault finding and DSLAM equipment.

Education

Diploma in Networks & Telecommunications, MIEEK Larnaca. Final grade 99/100.

Volunteering

IT for Anorthosis Famagusta FC since 2023, including the infrastructure on home matchdays.

Homelab

Docker, Ansible, Authelia SSO, Grafana, Uptime Kuma, NetBox, Nextcloud, TrueNAS.

Skills

What I work with.

I build with AI and Cloudflare every day, so I keep up with both as they change: new models and agent tooling on one side, new Workers features on the other.

Cloudflare

WorkersPages & static assetsD1KVR2Durable ObjectsQueuesWorkflowsWorkers AIVectorizeHyperdriveEmail sendingAnalytics EngineSecrets StoreRate limitingmTLSImagesWorkers for PlatformsAccess / Zero TrustWAFDNSCron triggersService bindingsObservabilityStaging & production envs

Logging & checks

Workers LogsLogpushAudit logsSecurity event loggingAnalytics EngineWeb Analytics/health endpointsPost-deploy checksUptime monitorsAlertsTurnstileRate limitingAccess logsCSP & HSTSsecurity.txt

GitHub & CI/CD

GitHub ActionsReusable workflowsScheduled workflowsEnvironments & production gatesDependabotCODEOWNERSGitleaks secret scanningactionlintSemgrep SASTDependency auditsD1 migrations in CIPost-deploy health checksWranglerGit

Microsoft & identity

Microsoft 365Exchange OnlineSharePointTeamsIntuneEntra IDConditional AccessPasskeys

Development

TypeScriptNode.jsHonoReactNext.js (OpenNext)ViteTailwind CSSZodDrizzlePrismaVitestPlaywrightESLintBiomeBetter Auth (email OTP on D1)JWT (jose)TOTP 2FAVercel AI SDKMCPAI-assisted development

Security

Zero TrustThreat modellingOWASPGDPRSecret scanningRate-limited sign-inTrusted-origin checksFail2banBackups & DR

Infrastructure & network

Ubuntu ServerWindows Server & ADDockerNginxAnsibleVMware vSphereProxmoxHyper-VVeeamSynologyTrueNASUniFiCisco MerakiVLANsWireGuardIPsecZabbixGrafanaUptime KumaPowerShellBash

Contact

Let's talk shop.

Happy to compare notes on Cloudflare, Zero Trust, CI/CD or securing AI-written code. Drop me a message.

mariosxen7@icloud.com LinkedIn ↗