Fabian IkizogluDevOps Engineer · Stuttgart

Fabian
Ikizoglu

I build the pipelines, harden the walls — and occasionally try to break them.

  • DevOps Engineer
  • ex-Fullstack Developer
  • Security Tinkerer
Scroll

(01) About

I spend my days turning infrastructure into code: clusters, pipelines and the glue in between. Before that I wrote the apps that run on top of it, so I care about both sides of the deploy button.

After hours I poke at the security side of things — web application firewalls, detection with a SIEM, and labs where one team attacks while the other one watches the logs light up.

Now
DevOps Engineer
Acht S GmbH
Before
Fullstack Developer

Stack

Tools I reach for — from the cluster down to the component.

KubernetesDockerHelmTerraformAnsibleGitHub ActionsGitLab CIOpen Telekom CloudHetznerKubernetesDockerHelmTerraformAnsibleGitHub ActionsGitLab CIOpen Telekom CloudHetzner
Self-hostedTypeScriptJavaScriptGoPythonReactNext.jsAstroExpressSelf-hostedTypeScriptJavaScriptGoPythonReactNext.jsAstroExpress
HonoElastic SIEMOWASP CorazaModSecurityOWASP CRSNmapMetasploitHonoElastic SIEMOWASP CorazaModSecurityOWASP CRSNmapMetasploit

(03) Bachelor's thesis

Automated Installation and Evaluation of the Web Application Firewall OWASP Coraza in an IT Security Lab for Teaching

A fully automated, reproducible security lab for university classes. One command provisions N nodes with Ansible: one becomes an Elastic Stack SIEM, every node gets an Elastic Agent, and deliberately vulnerable web apps are deployed behind a web application firewall. A red team attacks, a blue team defends — and OWASP Coraza is evaluated against ModSecurity along the way.

  1. Step 01ProvisionAnsible roles bring up N lab nodes from scratch, every semester.
  2. Step 02SIEMOne node becomes the Elastic Stack: Elasticsearch, Kibana, Fleet.
  3. Step 03AgentsElastic Agents enroll on every node and ship logs to the SIEM.
  4. Step 04TargetsVulnerable web apps run behind OWASP Coraza or ModSecurity.
  5. Step 05ExerciseRed team attacks, blue team detects and responds — live, in class.

Coraza versus ModSecurity

Both engines, evaluated in the same Ansible-provisioned lab with the OWASP Core Rule Set.

Engine

CorazaModern Go implementation, embeddable as a library

ModSecurityEstablished C++ engine (libmodsecurity v3) with long track record

Rule set

CorazaRuns the OWASP Core Rule Set, SecLang-compatible

ModSecurityReference platform for the OWASP Core Rule Set

Automation

CorazaMore complex setup: no Apache module exists, so Caddy is deployed as a reverse proxy with the Coraza module — still fully automated with Ansible

ModSecuritySimpler deployment and far more freely available resources and documentation

Operations

CorazaDelivers the key threat data; CRS rules behave identically and are tuned in the same Caddyfile as the WAF and proxy

ModSecurityThe reference behaviour: the same CRS rules and detections the lab was first built on

Findings

  1. 01Swapping ModSecurity for Coraza made the deployment more complex (Caddy as a reverse proxy, a smaller community), yet the Ansible setup works as before and stays simple in a closed teaching network.
  2. 02Coraza cannot fully replace ModSecurity yet, but it delivers the most important threat data, and the OWASP Core Rule Set works identically — simple attacks like XSS or SQLi show no difference.
  3. 03A WAF on every application host (zero-trust) is more secure than one shared WAF (SPOE). For teaching, a hybrid is best: students attack the zero-trust setup, then SPOE, then both combined.

Selected work

Things I built, broke and rebuilt.

  • 01 — Monitoring · Go + React2026

    Monito

    A self-hosted monitoring tool in the spirit of Uptime Kuma, with an optional agent you install on a node to report system info, container status, storage and more. Go backend, React + TypeScript frontend.

    • Go
    • React
    • TypeScript
    • Monitoring
    • Agent
  • 02 — Terminal UI · Go2026

    servcli

    A terminal UI for sysadmins to manage servers from one place: time tracking, monitoring checks, certificate expiry, a kanban todo board, SSH session history and alerting.

    • Go
    • TUI
    • SSH
    • Monitoring
    • Alerting
  • 03 — Thesis · Security lab

    SecLab

    Ansible-provisioned red vs. blue teaching lab with an Elastic SIEM and a WAF shoot-out between OWASP Coraza and ModSecurity.

    • Ansible
    • Elastic Stack
    • Coraza
    • ModSecurity

(05) Security corner

Security is what I do when nobody pays me to. It started with my thesis and never really stopped.

No certificates or leaderboard flexing yet — just curiosity, a lab and a lot of logs.

  1. 01

    Web application security

    WAFs, the OWASP Top 10 and why rule sets are harder than they look.

  2. 02

    Detection & SIEM

    Turning noisy logs into signals the blue team can actually act on.

  3. 03

    DevSecOps

    Scanning, signing and hardening as a default part of every pipeline.

  4. 04

    CTFs

    Just getting started — expect write-ups once I have something worth writing up.

Based in Germany · CET

Contact

The best way to reach me.

Email ↗

Local time · Stuttgart

Hint: open the console.