Garden

Context

Garden is a non-custodial bridge for Bitcoin. Swaps settle through HTLC atomic swaps, matched by solvers, across Bitcoin, Solana, Starknet and most EVM chains. The protocol has moved more than $2B.

I joined as an intern in August 2024 and went full-time in July 2025. The title was DevOps engineer. In practice the job was whatever the system needed: cloud cost, hosting, security, internal tools and parts of the protocol API.

Cutting cost about 90%

The AWS setup I inherited averaged around $3,000 a month and peaked near $5,000. It had been badly configured from the start. The first pass kept the architecture and fixed the configuration, which brought it to roughly $1,500.

Then we asked whether we needed the cloud at all, and moved production to a single bare-metal server on Hetzner. The bill dropped to under $300 a month, with uptime at the level we needed.

One server is one point of failure. We took that trade on purpose: a system you can hold in your head, at a tenth of the price.

Zero trust, on-prem

After a partner solver had a key compromised, the decision was to move infrastructure on-prem. A server in the room still answers to every laptop that can reach it, so I built access around zero trust instead of around the building.

• Managed endpoints. Machines that touch infrastructure are managed with Jamf.
• Cloudflare WARP. Internal services sit behind WARP, not the open internet.
• Internal-only domains. Nothing public to scan.
• Controlled access. People get what their role needs.

Garden of Secrets

Code went through pull requests. Config and secret files didn't. I built Garden of Secrets so they could.

Source on GitHub ↗

Protocol and operations

• Database triggers that make order status tamper-proof in the protocol API.
• Time-window filters for order queries, structured error codes and affiliate fees.
• A root-cause-analysis agent: a known-issues knowledge base and a Slack bot, on FastAPI with Loki logs.