PingMail
An SMTP to webhook bridge that replaces on-premises relays
A small Go agent accepts SMTP on the local network and forwards each message as a signed HTTPS webhook to a Cloudflare Worker, which authenticates it and records delivery in D1.
Harry Shelton
I build and secure cloud infrastructure on Microsoft Azure and Cloudflare®. Most of it is Terraform and pipelines rather than dashboard work: landing zones, identity governance, and recovering estates that were never designed to be recovered.
Cloudflare Landing Zones (CFLZ)
Enterprise Terraform for multi-account Cloudflare footprints, built on the Microsoft Cloud Adoption Framework (CAF) hierarchy.
Principles
GitOps over "click-ops"
Terraform never runs on a workstation - not on an operator laptop and not on a contributor machine. Credentials and state keys live only in GitHub Environments, so the dashboard becomes a read surface and the repository is the source of truth. Every managed resource carries a managed-by tag, so anything created by hand shows up as a diff rather than a surprise.
Separation of logic and configuration
The .tf files are customer-agnostic and identical across every tenant. Everything tenant-specific - account IDs, domains, IP ranges, rules - is data in .tfvars. Onboarding a zone is a configuration edit, not a code change.
Decoupled state per layer
Each product area is its own root module with its own state file and its own scoped API token. A WAF apply cannot propose destroying a zone, because zones are not in its state and its token cannot edit them.
Hierarchy
Platform Landing Zone
Account governance, RBAC lockdown, Entra ID SSO, Cloudflare WAN
Vended via Pipeline
Application Landing Zone
Zone DNS, WAF rulesets, Bot Management, Workers, R2 buckets, Zero Trust access
Cloud Adoption Framework
CAF Aligned
Plan & Apply Phase
Guardrails fail early
CI/CD
R2 state backends
Multi-Tenant
Isolated repositories
Projects
Infrastructure as code, edge applications, and the automation I use to keep estates consistent.
OpenMarkdown
A Markdown and Mermaid workspace that runs entirely on Workers
Side by side Markdown and Mermaid editing with PDF export, served from Cloudflare Workers and gated by Cloudflare Access.
Autopilot hardware hash import
Registering existing devices into Intune Autopilot without touching each one
PowerShell that reads a device hardware hash and registers it with Autopilot through the Graph API, so an existing estate can be enrolled without a technician visit or a CSV upload.
AetherCred
Entra ID credential and posture reporting over the Graph API
PowerShell reporting that queries Entra ID for dormant privileged accounts, ageing service principal secrets, and MFA gaps, then scores and writes them up for an audit.
Azure Terraform templates
Hub and spoke foundations for new Azure environments
Terraform modules for greenfield Azure builds, following the Cloud Adoption Framework: hub and spoke networking, NSG flow logs, Bastion, and RBAC set at subscription level.
Infrastructure & Edge
Home lab
Where I test Zero Trust and edge patterns before a client sees them
A small highly available cluster I use to try things properly first: Cloudflare Tunnels, Sophos HA segmentation, OpenZFS storage, and containers.
What I work with
The platforms and tooling I use most, and what I use them for.
Cloudflare & Edge Computing
Cloudflare Zero Trust (SASE)
Access, Gateway, WARP, CASB, Browser Isolation
Cloudflare Workers & Pages
TypeScript, WinterCG, Serverless API gateways
Cloudflare WAF & Rulesets
Custom rules, Rate Limiting, Bot Management, API Shield
Cloudflare R2 & D1 & KV
Edge SQL, Object Storage, low-latency global state
Cloudflare Magic WAN & Tunnels
IPsec tunnels, Anycast routing, BGP interconnect
Cloudflare DNS & SSL/TLS
Anycast DNSSEC, Custom certificates, mTLS, TLS 1.3
Microsoft Azure & Enterprise Cloud
Azure Architecture (CAF)
Hub-Spoke topologies, Virtual WAN, Private Endpoints
Microsoft Entra ID
Conditional Access, PIM, App Registrations, RBAC governance
Microsoft Intune & Autopilot
Zero-Touch Provisioning, Device compliance, OOBE enrolment
Azure Compute & Storage
Azure Files, Azure SQL, Clustered Hyper-V/VMware migrations
Defender & Sentinel
Incident detection, logpush aggregation, posture monitoring
DevOps, IaC & Automation
Terraform (IaC)
Landing Zone modules, state management, validation guardrails
PowerShell & Graph SDK
Automated tenant management, idempotent scripts, REST APIs
CI/CD & GitOps
GitHub Actions pipelines, automated drift detection, test suites
Go & TypeScript
High-performance agents, edge microservices, tooling
Networking, Security & Compliance
Zero Trust Architecture
Micro-segmentation, identity-aware proxies, least privilege
Cisco Meraki & SD-WAN
Enterprise multi-site routing, Auto VPN, MX security appliances
Sophos HA & SonicWALL
High-availability perimeter firewalls, IPS/IDS, SSL-VPN
Compliance & Audits
SOC2 technical assurance, Cyber Essentials+ remediation
Experience
Cloudflare Solution Engineer
Focus Group- Leading the Cloudflare engineering and consultancy practice full-time: architectural direction, practice delivery, and enterprise consulting for Cloudflare deployments.
- Focus Group is the sole Cloudflare Design Partner in the UK and Ireland, so the practice works directly with Cloudflare and customers to design and deliver the cloud standards we have always pushed for.
- Designing scalable edge security frameworks, automating infrastructure through GitOps, and guiding clients through Zero Trust transformations.
- Built on the bespoke Landing Zone frameworks, InfoSec event support, and the migration of hundreds of Focus Group customers to Cloudflare that came before the role.
Cloud Project Engineer
Focus Group- Cloudflare lead and subject matter expert. I pitched the Cloudflare Agency Partner programme and got it signed, then built the partner portal that onboards tenants with scoped RBAC instead of shared logins. Several hundred customer domains have moved onto Zero Trust since.
- Led Azure migrations end to end for multiple clients, re-architecting workloads onto Azure Files, Azure SQL, and Virtual WAN rather than lifting VMs across unchanged. Lower running cost, and a security baseline that was actually written down.
- Designed and ran an emergency Azure recovery for a UK hospitality group after a ransomware incident, with every site back to full operation inside 48 hours.
- Built one RBAC and Conditional Access model covering Azure, Microsoft 365, and Meraki, so a 150 person engineering team works from least privilege rather than standing admin.
IT Technical Engineer, Projects
Focus Group- Ran an unplanned Azure migration after a client lost their on-premises hardware. The replacement was greenfield rather than a like for like rebuild, which cut login times for their main line-of-business application by 70% and came in 15% under budget.
- Provided the technical assurance and hardening for clients going through SOC2 and Cyber Essentials+ audits, all of which passed first time.
- Delivered cloud, hybrid, and modern workplace projects concurrently for SME and mid-market clients.
IT Technical Field Engineer
Focus Group- On-site installs across multiple sites: core switching, clustered Hyper-V and VMware hosts, and resilient NAS storage.
- Deployed and hardened SonicWALL, Sophos HA, and Cisco Meraki firewalls, including the site to site VPN between them.
Certifications
Microsoft, Cloudflare, and Cisco credentials, with verification links where they exist.
Microsoft
Verify
Microsoft Certified: Azure Administrator Associate (AZ-104)
ID EBD01777F3B5E325
Cloudflare
Verify
Cloudflare Certified: Zero Trust Engineer (ZTE)
Cloudflare
Verify
Cloudflare Certified: Application Security Engineer
Cloudflare
Verify
Cloudflare Certified: Cloudflare One Advanced
Cloudflare
Verify
Cloudflare Certified: Application Security Advanced
Cloudflare
Verify
Cloudflare Certified: Network Services Essentials
Cloudflare
Verify
Cloudflare Certified: Developer Platform Essentials
Microsoft
Verify
Microsoft Certified: Azure Fundamentals (AZ-900)
ID 2D5EDD6742B17DE7
Cisco
Engineering Cisco Meraki Solutions (ECMS)
Course completion, no public credential link.
Cisco
Cisco Meraki Network Associate (CMNA)
Course completion, no public credential link.
Cisco
Cisco Umbrella Studio 3.0
ID p9Y34OcXko
Course completion, no public credential link.
Get in touch
Happy to talk about Cloudflare landing zones, Azure migrations, or a Zero Trust rollout you are part way through.
harry@harryshelton.com