An S3-compatible proxy that unifies multiple object-storage providers behind a single endpoint.

• Stacks per-backend byte quotas into one logical bucket with automatic overflow routing
• Multi-cloud replication across providers at a configurable factor
• Operator primitives: online drain, rebalance, integrity scrub, and live failover
• Optional envelope encryption (AES-256-GCM via Vault Transit) so backends only ever see ciphertext
• SigV4 authentication with multi-bucket credential isolation and rate limiting
• Per-backend and per-database circuit breakers with degraded-mode reads on DB outage
• Multipart uploads and a durable cleanup queue with dead-letter handling
• Metadata layer in PostgreSQL or embedded SQLite (sqlc) tracking placement, replicas, and quotas
• Hot-reloadable backend and quota config; cosign-signed images and release checksums
• Web dashboard and admin API, with OpenTelemetry tracing and Prometheus metrics

A production-grade homelab infrastructure platform spanning on-prem bare-metal, Proxmox, and cloud nodes linked over WireGuard.

• Built on HashiCorp Nomad, Consul, and Vault
• Provisioned as code end to end: Terraform/Terragrunt for cloud and cluster config, Chef/Cinc cookbooks for node setup
• Vault as the security backbone: SSH CA, PKI mTLS for Nomad/Consul, Transit encryption, KV secrets, and Workload Identity
• Temporal server and UI running scheduled Go workflow workers for backups, ACME cert issuance, Trivy scanning, and cleanup
• Custom Go services: multi-cloud S3 orchestrator, a Cloudflare log collector, a Vault PKI certificate manager, and an Oracle free-tier node watchdog
• HA data tier: PostgreSQL (Patroni), Redis Sentinel, and HAProxy
• DNS, ACLs, secrets, and Postgres databases all declared in Terragrunt (Pi-hole + dnsdist, Cloudflare, Consul/Nomad ACLs)
• Every node runs CoreDNS that resolves .consul via the local Consul agent and round-robins all other queries to the Pi-holes
• Self-hosted dev infra: Forgejo with CI runners, private GitHub Actions runners, a Docker registry, and an aptly APT repository
• Full observability: Prometheus, Grafana, Loki, Tempo, and Alertmanager
• Dual HA ingress nodes, each running the full stack (Traefik, keepalived, oauth2-proxy, cloudflared tunnel), so a keepalived VIP failover lands on a complete ingress path

Collects Cloudflare zone analytics and account audit logs and ships them into an observability pipeline.

• Ingests firewall events, HTTP traffic, and account audit logs from Cloudflare's GraphQL and REST APIs
• Incremental seek-based pagination across poll cycles
• Ships structured JSON log streams to Loki with multi-tenant support
• Exposes traffic metrics (by method, status, country) and poll latency to Prometheus
• OpenTelemetry tracing with trace and span IDs injected into logs for log-to-trace navigation in Grafana
• Multi-zone and multi-account collection; configurable poll interval, backfill, and batch size

Temporal workflow workers that automate recurring infrastructure operations across a Nomad/Consul/Vault cluster - five worker images hosting eight cron-scheduled jobs.

• Five worker images / eight scheduled jobs; a shared cleanup worker runs four of them on one task queue (node cleanup, registry GC, aptly cleanup, Postgres VACUUM)
• Backup workflow snapshots Nomad + Consul (Vault) Raft and PostgreSQL concurrently, with per-database pg_dump fan-out and S3 upload with local/off-site retention
• Trivy workflow discovers running images from the Nomad API and scans them with bounded concurrency, persisting CVEs to PostgreSQL
• Maintenance saga shared by registry GC and aptly cleanup: scale the Nomad job offline, do the work, then always scale it back (deferred compensation, so nothing is left stranded)
• Node cleanup deletes stale Nomad alloc directories over SFTP (native operations, never a remote shell); online Postgres VACUUM (ANALYZE) fans out across every database
• Cert acquirer issues the *.munchbox.cc wildcard via ACME DNS-01 (lego), staging cert+key in Vault so a publish failure never re-runs issuance; GitHub token renewal mints short-lived GitHub App tokens and NaCl-seals them into each repo's Actions secret, replacing hand-rotated PATs
• Newer workers authenticate to Vault via Nomad Workload Identity (no static tokens); shared retry/backoff with heartbeats and transient-vs-permanent error classification, OpenTelemetry tracing to Tempo, scheduled via Terraform-managed Temporal Schedules

An S3-compatible storage gateway that stores objects in Google Drive and their metadata in Gmail.

• S3-compatible API (PutObject, GetObject, ListObjectsV2, and bucket operations)
• Maps Gmail labels to buckets, Drive files to objects, and Gmail messages to metadata pointers
• Local SQLite or PostgreSQL index serves HeadObject and ListObjects with zero Google API calls
• Resumable multipart uploads streamed to Drive (up to 10,000 parts)
• SigV4 authentication with constant-time signature verification
• Independent rate-limit pools for the Drive and Gmail quotas; Prometheus and OpenTelemetry instrumentation

A distributed monitor-and-recovery system that detects stuck Oracle Cloud free-tier instances and automatically restarts them.

• Monitor mode holds a session-locked Consul KV heartbeat on each Oracle node; the lock auto-expires when a node goes silent
• Agent mode polls Consul for missing heartbeats and drives OCI stop/start restart cycles
• Safety controls: restart timeout, max attempts per node, duplicate-restart prevention, and a dry-run mode
• Self-healing: never crashes on Consul or OCI unavailability; continuously retries and emits state metrics
• Optional WireGuard endpoint resolver that updates the kernel peer endpoint via netlink when a hostname's IP changes
• Optional Cloudflare DDNS updater that keeps an A record synced to the host's public IP
• Prometheus metrics for monitor and agent modes; OpenTelemetry tracing to Tempo

A self-hosted service that tracks aircraft around a configurable location in real time.

• Ingests flight data from the OpenSky Network API or a local FlightAware/dump1090 ADS-B antenna
• Filters aircraft to a configurable radius with haversine distance on a set poll interval
• Enriches aircraft (registration, type, route) from a fallback chain of APIs (HexDB, OpenSky, AirLabs, FlightAware AeroAPI), cached in PostgreSQL
• Async enrichment worker pool with a shared backoff and circuit-breaking HTTP client
• Detects global emergency squawk codes with Discord/Telegram alerts
• Dual storage (Redis live state + PostgreSQL history via sqlc); live Leaflet dashboard, OpenTelemetry, and Prometheus

Diagnosed and fixed a Nomad state-store bug where jobs written in the same Raft transaction (such as mass rescheduling after a node failure) shared a ModifyIndex and silently vanished from the /v1/jobs/statuses endpoint and the web UI jobs page, while still appearing via /v1/jobs and the CLI.

• Root cause: the jobs-table modify_index memdb index was declared unique, but ModifyIndex is not unique across jobs, so colliding jobs were dropped from any query iterating that index
• Submitted a written root-cause analysis, a live-cluster reproduction, and a self-contained Docker A/B harness that proves the bug and verifies the fix
• Fix marks the index non-unique and adds a regression test; reviewed and merged into hashicorp/nomad

Fixed a typo in the Go protobuf library, discovered through a custom CI/CD pipeline I designed for a backend service. Registered as a Go contributor and pushed the fix through Gerrit per the contribution rules; merged in version 1.25.