Blog

Thoughts on engineering, leadership, and infrastructure.

Adding AI chat and observability to an open-source NDR

LibreChat with MCP servers for threat hunting, OTel Collector for application logs, Grafana + VictoriaMetrics for dashboards, all behind a shared nginx auth gate, all optional, all deployed with the same Go template system.

Building stamusctl · Part 4

Testing the whole stack

Bats integration tests against a live Docker Compose deployment: PCAP injection, OpenSearch assertions, upgrade data survival, and a justfile that orchestrates all of it from a Nix dev shell.

NixOS from scratch · Part 2

Live theme switching on NixOS across 10 apps at once

I built a theme system in Nix that generates configs for waybar, dunst, kitty, neovim, tmux, Firefox, VSCode, Qt5 apps, swaylock, and the login greeter from a single color palette.

I built a monorepo template because I kept wasting the first two weeks

Every project starts the same way: auth, database, CI, Docker, tests. I got tired of redoing it, so I built a template. Here's what kept going wrong and how I fixed it.

Building a SaaS for radiation dosimetry in Go and React

Dosismart is a dose calculation platform I'm building for the French operational dosimetry market. Solid-angle point source model accurate below 1 cm, six volumetric geometries with ray-traced self-absorption, and inverse solvers for distance and shielding.

Using YAML as a database for a React app

I built a game codex viewer where all the data lives in YAML files. Singleton loader with concurrent fetching, React hooks, character creator with localStorage persistence, and PDF export.

NixOS from scratch · Part 1

Managing 4 NixOS machines with one flake

My declarative setup for 2 desktops and 2 laptops. Overlays for custom packages, Home Manager for user configs, and why I stopped configuring things by hand.

Building stamusctl · Part 3

The daemon, observability, and testing

stamusd exposes the same CLI as a REST API. Priority-based shutdown, hot-reloading auth, rate limiting with Redis fallback, and testing with an in-memory filesystem.

Building stamusctl · Part 2

Docker plumbing and PCAP replay

Circuit breakers for Docker, binary protocol parsing for log streaming, and how readpcap spins up a temporary Suricata container to turn a PCAP file into indexed security data.

Building stamusctl · Part 1

Two commands to a working NDR stack

A Go CLI with a self-describing template system: OCI-distributed, composable config fragments that the tool discovers at runtime. One question, dozens of configs, zero hardcoded product knowledge.