Debian Core Systems & Release Engineer (Native Packaging, .deb, reprepro/aptly)

🛑 𝗠𝗔𝗡𝗗𝗔𝗧𝗢𝗥𝗬 𝗙𝗜𝗟𝗧𝗘𝗥 — 𝗣𝗟𝗘𝗔𝗦𝗘 𝗥𝗘𝗔𝗗 𝗕𝗘𝗙𝗢𝗥𝗘 𝗔𝗣𝗣𝗟𝗬𝗜𝗡𝗚: * Do 𝗡𝗢𝗧 apply if your primary expertise is in AWS, Docker, Kubernetes, or standard web hosting. This project does 𝗻𝗼𝘁 use containers or public cloud orchestration. * Do 𝗡𝗢𝗧 apply if you have never built a native Debian package using `debhelper`/`dpkg-dev` or managed a private APT repository using `reprepro` or `aptly`. * 𝗔𝗯𝗼𝘂𝘁 𝗠𝗲: I am a Senior Full Stack Web Developer. I can easily spin up Linux boxes, write bash scripts, and manage systemd units. 𝗜 𝗮𝗺 𝗵𝗶𝗿𝗶𝗻𝗴 𝘆𝗼𝘂 𝗯𝗲𝗰𝗮𝘂𝘀𝗲 𝘆𝗼𝘂 𝗸𝗻𝗼𝘄 𝘁𝗵𝗲 𝗱𝗲𝗲𝗽 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹𝘀 𝗼𝗳 𝘁𝗵𝗲 𝗗𝗲𝗯𝗶𝗮𝗻 𝗢𝗦 𝗽𝗮𝗰𝗸𝗮𝗴𝗶𝗻𝗴 𝗲𝗰𝗼𝘀𝘆𝘀𝘁𝗲𝗺 𝘀𝗶𝗴𝗻𝗶𝗳𝗶𝗰𝗮𝗻𝘁𝗹𝘆 𝗯𝗲𝘁𝘁𝗲𝗿 𝘁𝗵𝗮𝗻 𝗜 𝗱𝗼. You are here to save me time and act as an architectural peer. To prove you have read this and respect the architecture, 𝘆𝗼𝘂 𝗺𝘂𝘀𝘁 𝘀𝘁𝗮𝗿𝘁 𝘆𝗼𝘂𝗿 𝗰𝗼𝘃𝗲𝗿 𝗹𝗲𝘁𝘁𝗲𝗿 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗲𝘅𝗮𝗰𝘁 𝘁𝗼𝗼𝗹 𝘆𝗼𝘂 𝗽𝗿𝗲𝗳𝗲𝗿 𝗳𝗼𝗿 𝗺𝗮𝗻𝗮𝗴𝗶𝗻𝗴 𝗳𝗿𝗼𝘇𝗲𝗻 𝗗𝗲𝗯𝗶𝗮𝗻 𝘀𝗻𝗮𝗽𝘀𝗵𝗼𝘁 𝗺𝗶𝗿𝗿𝗼𝗿𝘀. Generic, AI-generated copy-paste proposals will be archived instantly. --- 𝗣𝗿𝗼𝗷𝗲𝗰𝘁 𝗢𝘃𝗲𝗿𝘃𝗶𝗲𝘄 We are migrating our VoIP/unified communications platform, CMX, from an End-of-Life AstLinux distribution to a hardened 𝗗𝗲𝗯𝗶𝗮𝗻 𝟭𝟯 (𝗧𝗿𝗶𝘅𝗶𝗲) base for v2.0 of the product. CMX is an appliance-style product deployed as a dedicated VM per customer (primarily hosted on our own cloud infrastructure, with some customer-premise deployments across VMware, Proxmox, KVM, and Hyper-V). This requires building an infrastructure that supports completely reproducible, versioned deployments across N independent customer systems. Our in-house full-stack developer handles the PHP application layer. 𝗬𝗼𝘂 𝘄𝗶𝗹𝗹 𝗰𝗼𝗺𝗽𝗹𝗲𝘁𝗲𝗹𝘆 𝗼𝘄𝗻 𝗲𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴 𝗯𝗲𝗹𝗼𝘄 𝘁𝗵𝗲 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗹𝗮𝘆𝗲𝗿. 𝗬𝗼𝘂𝗿 𝗦𝗰𝗼𝗽𝗲 𝗼𝗳 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 * 𝗣𝗵𝗮𝘀𝗲 𝟭 — 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗦𝗲𝘁𝘂𝗽: Build a documented, reproducible process for a minimal, hardened Debian 13 (Trixie) VM base image (no derivatives like DietPi). * 𝗖𝘂𝘀𝘁𝗼𝗺 𝗔𝗣𝗧 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝘆 & 𝗦𝗻𝗮𝗽𝘀𝗵𝗼𝘁 𝗠𝗶𝗿𝗿𝗼𝗿: Set up a self-hosted, GPG-signed APT repository (`apt.cmxexample.net`) using `reprepro` or `aptly`. Create automated scripts to capture package snapshots from `snapshot.debian.org` tied to CMX release versions so that deployments remain bitwise-identical. * 𝗗𝗲𝗯𝗶𝗮𝗻 𝗣𝗮𝗰𝗸𝗮𝗴𝗲 𝗕𝘂𝗶𝗹𝗱 𝗦𝘆𝘀𝘁𝗲𝗺: Implement a `.deb` package build system using `dpkg-dev` and `debhelper` integrated into a CI/CD pipeline for automated package building, version tagging, and signing. * 𝗦𝘆𝘀𝘁𝗲𝗺 𝗖𝗼𝗻𝗳𝗶𝗴𝘂𝗿𝗮𝘁𝗶𝗼𝗻: Write and maintain robust systemd service units/targets for the entire 9-service CMX stack (Asterisk, Prosody, OpenLDAP, Lighttpd, and several custom Go binaries) ensuring proper dependency ordering and environment loading. * 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 & 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗛𝗮𝗿𝗱𝗲𝗻𝗶𝗻𝗴: Configure network interface templates (with VLAN support), `nftables` firewall rules, `fail2ban`, AppArmor profiles, and automated security-only updates via `unattended-upgrades`. * 𝗠𝗶𝗴𝗿𝗮𝘁𝗶𝗼𝗻 & 𝗥𝗼𝗹𝗹𝗼𝘂𝘁: Build automated migration scripts to safely transition existing clients from AstLinux to Debian (exporting configs, databases, and LDAP directory migrations). 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗱 𝗧𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗘𝘅𝗽𝗲𝗿𝘁𝗶𝘀𝗲 (𝗘𝘀𝘀𝗲𝗻𝘁𝗶𝗮𝗹) * Deep Debian system administration (Debian 12/13). * Expert-level native Debian packaging (`dpkg-dev`, `debhelper`, maintainer scripts). * Private APT repository administration (`reprepro`, `aptly`, GPG signing architectures). * Advanced systemd configuration (custom targets, dependency graph management). * Linux networking, VLAN routing, and `nftables`. * Hypervisor familiarity (KVM/libvirt, Proxmox, VMware). 𝗪𝗼𝗿𝗸𝗶𝗻𝗴 𝗥𝗲𝗹𝗮𝘁𝗶𝗼𝗻𝘀𝗵𝗶𝗽 & 𝗘𝗻𝗴𝗮𝗴𝗲𝗺𝗲𝗻𝘁 * 𝗧𝘆𝗽𝗲: Contract / Freelance * 𝗗𝘂𝗿𝗮𝘁𝗶𝗼𝗻: TBD (To be determined by you after a full review of our detailed sub-scope document). * 𝗔𝗿𝗿𝗮𝗻𝗴𝗲𝗺𝗲𝗻𝘁: Remote, async-first. Because our application-layer adjustments are a larger workstream, your tasks will involve focused, high-intensity bursts with waiting periods in between while application milestones complete. This is perfect for an elite specialist managing multiple concurrent contracts. Full technical sub-scopes and repository access will be provided immediately upon shortlisting and initial alignment check.