Put a dozen internal tools behind single sign-on without opening an inbound port.
The challenge
A set of internal and self-hosted tools was only reachable on the local network, and the remote-access options were either a flat VPN or public exposure.
What we built
Identity-aware access in front of every application, with Google sign-in and a one-person allowlist policy
Outbound-only tunnels, so nothing listens on the public internet
Reverse proxy with automated certificate renewal and a least-privilege DNS token on a rotation schedule
Split-horizon DNS so devices resolve the same names at home and away, with an IPv6 leak found and fixed
Versioned scripts, runbooks, and a wiki so the setup can be replayed or handed over
Outcomes
About a dozen applications reachable from anywhere behind SSO and MFA
Sensitive admin consoles deliberately kept off the internet entirely
Every change scripted, backed up before it runs, and documented in the same commit
Cloudflare Zero TrustCloudflare TunnelCaddyTailscaleWireGuardDNSGoogle SSO
AI
Private AI platform with guarded agents
A local LLM stack and chat-driven agents where humans approve anything risky.
The challenge
Run capable AI models on owned hardware, keep data off third-party clouds, and let agents do real work without handing them the keys.
What we built
Local model serving with a private chat front end on a GPU workstation
A tool-using agent on its own unprivileged account with a command allowlist and human approval for everything else
Chat-ops bridges for Slack and Telegram, with owner-only access and a click-to-approve step before any push
A reproducible rebuild: every change recorded as a playbook or compose file after an earlier install was lost
Nightly backups that are verified, not assumed
Outcomes
Full rebuild from a clean OS reinstall driven by a repository, not memory
Chat bridge shipped with more than 1,700 automated tests
Agent permissions enforced by placement and policy rather than trust
GitLab, shared pipelines, Jira integration, and docs that publish themselves.
The challenge
Dozens of repositories across personal, client, and lab work needed one consistent way to build, test, deploy, document, and back up.
What we built
Self-hosted GitLab with a group layout that separates each zone, plus shared CI templates every project includes
Runners on dedicated hardware, with deploys to Vercel from the pipeline using the CLI
Docs-as-code: runbooks and changelogs publish to each project wiki on merge
Jira Cloud connected for traceability, and a scheduled poller that turns tickets into merge requests
A product analytics backend for the platform, with a documented upgrade and migration procedure
Outcomes
One template change updates the pipeline of every project
Every repository has a remote, a changelog, and published docs
Documentation drift removed by making the repo the single source of truth
GitLabGitLab CIDockerVercelJiraClickHouseBashYAML
Web
Multilingual website with a headless CMS
A three-language site for an international technology park, with editors who never touch code.
The challenge
The client needed a modern, trilingual public site and a way for non-technical staff to publish, without tying content to a developer or to a git host.
What we built
Migration of a Lovable-built design into a maintainable codebase with English plus two additional languages
Payload CMS with role-based access for admins, editors, and read-only users, on a managed Postgres database
Build-time content pull with a daily rebuild that only runs when content changed
Staging and production environments on separate hosts, with search indexing blocked on staging
Machine-drafted translations clearly marked for native-speaker review
Outcomes
Live CMS and staging site, with a runbook and an explicit cutover plan
Editors log in with CMS accounts, not developer tools
Content changes publish without a developer in the loop