Blog
Thoughts on engineering, leadership, and infrastructure.
Anonix: a fail-closed Tor-over-VPN appliance in one NixOS flake
I released anonix, a NixOS flake that forces every application through Tor over a WireGuard tunnel. The firewall does the killswitch work, and each security claim gets proven by VM tests on every commit.
Adding AI chat and observability to an open-source NDR
Three optional components bolted onto the Clear NDR stack: an AI chat assistant, OpenTelemetry-backed application logs, and Grafana dashboards. All behind a shared nginx auth gate, all feature flags, all deployed with the same Go template system.
Testing the whole stack
What it takes to prove that a template release actually produces a healthy NDR stack: bats tests against real containers, orchestrated by a justfile from a Nix dev shell.
Live theme switching on NixOS across 10 apps at once
I got tired of re-theming a dozen apps by hand, so I built a Nix theme system that generates configs for waybar, dunst, kitty, neovim, tmux, Firefox, VSCode, Qt5 apps, swaylock, and the login greeter from one color palette.
Building a SaaS for radiation dosimetry in Go and React
Dosismart is the dose calculation platform I'm building for the French operational dosimetry market. A solid-angle point source model that stays accurate below 1 cm, ray-traced self-absorption for the volumetric geometries, and inverse solvers for the distance and shielding questions.
Using YAML as a database for a React app
My tabletop RPG needed a content browser and I refused to run a server for it, so the YAML files became the database. A singleton loader, React hooks, a character creator with localStorage persistence, and PDF export.
Managing 4 NixOS machines with one flake
My declarative setup for 2 desktops and 2 laptops. Overlays for the packages that don't fit nixpkgs, Home Manager for per-user configs, and the reasons I stopped configuring machines by hand.
The daemon, observability, and testing
stamusd exposes the same CLI over a REST API. How shutdown is ordered by priority, how auth hot-reloads from a file, rate limiting with a Redis fallback, and testing against an in-memory filesystem.
Docker plumbing and PCAP replay
How stamusctl talks to Docker without falling over, and how readpcap turns a capture file into indexed security data in a few minutes.
Two commands to a working NDR stack
A Go CLI built around a template system where the configs describe themselves, distributed over OCI and composed at runtime. The tool asks one question and generates the rest, with zero hardcoded product knowledge.