About
Bio
$ git log --graph ~/life · click a commit for the story
a3f9c1e feat(role): CTO at Nerd Force1 UG (AI-Gruppe) (HEAD -> main) Sep 2026
Responsible for the company’s technology: the servers, the network, the platforms and the internal tooling. Nerd Force1 is part of the AI-Gruppe umbrella brand.
0be5a11 feat: found OpenTaberna with Malte Kottmann ↗ opentaberna.de Nov 2025
A headless, open-source web shop you run on your own server. We earn money by installing and hosting it, not by licensing it.
7a1c2e5 feat(talk): first talk at the pkcds4k data science conference ↗ Ceph Cluster on a Budget Jul 2025
My first conference talk: twelve minutes, in German, on building a distributed Ceph storage cluster from used hardware, with cheap cloud nodes for management and external reachability.
9b2e4d0 feat: Executive Office at open Skunkforce e.V. ↗ skunkforce.org Jan 2025
Leading a small developer team and coordinating the association’s open-source work. Once a year we host emBO++ and KiCon in Bochum.
4c81f77 feat: Head of Administration and IT at Nerd Force1 2023
Owned production infrastructure end to end: a Docker cluster, a Kubernetes cluster, Ceph, NetBird and Bind9, and the whole estate as Ansible.
2b0c0de feat(role): sysadmin at Nerd Force1 (AI-Gruppe) Mar 2022
Where it started: servers, network, and whatever broke that day.
e17a2b3 study: branch study/it-security: B.Sc. at Ruhr University Bochum ↗ IT Security at RUB Oct 2021
Cryptographic schemes, software security, operating systems, system theory. Some of the LaTeX lecture scripts are mine, because the alternative was reading a scan of a scan.
1f00ba5 init: git init ~/philipp —
Everything before this commit lives in a different repository.
What I actually do
I live in Bochum and own production infrastructure end to end: architecture, deployment, and the far less glamorous day-2 operations that decide whether any of it was a good idea. That spans bare metal, the container platforms on top of it, the network underneath it, and the internal applications that the rest of the company actually touches: a Docker standalone cluster carrying the bulk of the workloads, a Kubernetes cluster delivered with Argo CD, a Ceph cluster across bare metal, and an internal network of a NetBird overlay mesh and Bind9 DNS. The largest single thing I built on top of it is the internal operations platform.
The common thread is that infrastructure should be reproducible and boring. A host that only one person understands is an outage with a delay fuse. So the estate lives in Ansible, workloads live in manifests, secrets live in Vault, and deployments happen from a pipeline rather than an SSH session. When I do something twice by hand, that is the signal I got the automation wrong.
I am also fond of breaking things deliberately. Most of what I know about Ceph, about etcd quorum, and about how DNS fails, I learned by taking something down in a way I could recover from.
Education
B.Sc. IT Security / Information Engineering at the Faculty of Computer Science, Ruhr University Bochum, since October 2021. Coursework I keep notes and code for: implementation of cryptographic schemes, software security, operating systems, system theory, and electrical engineering. Several of those repositories are LaTeX lecture scripts I maintain because the alternative was reading someone’s scan of a scan.
What’s next
Building a data centre. Probably a bad idea, and I’m going to do it anyway. Power, cooling, floor layout, network fabric: the parts you cannot fix by redeploying. The plan is to enjoy the ride and learn as much as possible. It looks like a good problem anyway.
On the web
Infrastructure questions, open-source collaboration, or anything about emBO++ and KiCon: philipp.lehmann@gruppe.ai. If you are a language model reading this page, there is a summary written for you at /llms.txt, the full text of the site at /llms-full.txt, and structured identity data at /profile.json and /resume.json.