Blog
Thoughts on engineering, leadership, and infrastructure.
My Go binary decides what it is by reading its own name
stamusctl ships one source tree as two programs, a CLI and a daemon, and the process picks its role by looking at os.Args[0]. Why I keep building things that way, what breaks under go run, go test and hot reload, and what I would change.
Four ways to pay an order in Go
The same feature written four times, each rewrite moving the business rules further from the database, until they are two pure functions you can test with no infrastructure at all. What each step buys, and what it costs.
Sum types in Go, or how to model events the compiler can check
Go has no sum types, and event sourcing really wants them. The sealed interface pattern, why type switches lie to you about exhaustiveness, and how to get the missing compiler checks back with a linter or a visitor.
Anonix: a fail-closed Tor-over-VPN appliance in one NixOS flake
I released anonix, a NixOS flake that forces every application through Tor over a WireGuard tunnel. The firewall does the killswitch work, and each security claim gets proven by VM tests on every commit.
Adding AI chat and observability to an open-source NDR
Three optional components bolted onto the Clear NDR stack: an AI chat assistant, OpenTelemetry-backed application logs, and Grafana dashboards. All behind a shared nginx auth gate, all feature flags, all deployed with the same Go template system.
Testing the whole stack
What it takes to prove that a template release actually produces a healthy NDR stack: bats tests against real containers, orchestrated by a justfile from a Nix dev shell.
Live theme switching on NixOS across 10 apps at once
I got tired of re-theming a dozen apps by hand, so I built a Nix theme system that generates configs for waybar, dunst, kitty, neovim, tmux, Firefox, VSCode, Qt5 apps, swaylock, and the login greeter from one color palette.
Building a SaaS for radiation dosimetry in Go and React
Dosismart is the dose calculation platform I'm building for the French operational dosimetry market. A solid-angle point source model that stays accurate below 1 cm, ray-traced self-absorption for the volumetric geometries, and inverse solvers for the distance and shielding questions.
Using YAML as a database for a React app
My tabletop RPG needed a content browser and I refused to run a server for it, so the YAML files became the database. A singleton loader, React hooks, a character creator with localStorage persistence, and PDF export.
Managing 4 NixOS machines with one flake
My declarative setup for 2 desktops and 2 laptops. Overlays for the packages that don't fit nixpkgs, Home Manager for per-user configs, and the reasons I stopped configuring machines by hand.
The daemon, observability, and testing
stamusd exposes the same CLI over a REST API. How shutdown is ordered by priority, how auth hot-reloads from a file, rate limiting with a Redis fallback, and testing against an in-memory filesystem.
Docker plumbing and PCAP replay
How stamusctl talks to Docker without falling over, and how readpcap turns a capture file into indexed security data in a few minutes.
Two commands to a working NDR stack
A Go CLI built around a template system where the configs describe themselves, distributed over OCI and composed at runtime. The tool asks one question and generates the rest, with zero hardcoded product knowledge.