I learn by building real systems end to end — edge sensors, secured services, real-time backends, and analytical tools. The pipeline above isn't a metaphor; it's the shape of most things in here.
AppSec · DevSecOps · IoT / OT security — secure by design, from the sensor to the dashboard.
~/projects
├── os/ # emberwall — hardened IoT/OT linux distro (buildroot + rust)
├── cybersecurity/ # secrets vault, zero-trust auth, scanners, hardening
├── iot/ # esp32, lora, edge-ml, secured telemetry pipelines
├── quant/ # backtesting engines, trading analytics
├── backend/ # real-time services, tamper-evident blockchain
└── games/ # because why notA whole Linux distribution, built from source — where my scanner and my vault become one native Rust binary.
A from-scratch Linux distribution built with Buildroot — its own cross-toolchain, a hardened kernel, and a few-MB immutable userland: no package manager, PIE / RELRO / SSP / FORTIFY, KASLR, lockdown + yama LSMs, and an nftables default-deny firewall. It ships sentinel, a native Rust tool that unifies my pyscan scanner and the AegisVault crypto core into a single static binary: concurrent TCP/UDP scanning with OT/ICS + IoT recognition (Modbus, S7comm, IEC-104, CoAP, LoRaWAN) plus an argon2id + XChaCha20-Poly1305 secrets vault. Designed to run as the secure MQTT edge gateway feeding the IoT pipelines below. Live ISO, workstation and locked-appliance variants for x86-64 and ARM64.
|
Local-first, zero-knowledge secrets manager built on DDD + hexagonal architecture: a Python domain core with a native Rust crypto engine (Argon2id + XChaCha20-Poly1305 + zeroize via PyO3). Envelope encryption with Shamir K-of-N recovery, master-password rotation, TOTP/2FA, a tamper-evident hash-chained audit ledger with SIEM export (CEF/syslog/JSON), HIBP breach checks via k-anonymity, X25519 public-key team sharing with revocation, secret injection for DevOps (
|
Ground-up zero-trust identity provider in Rust/Axum with a built-in Security Operations Console. RS256 JWTs with refresh rotation & JTI replay detection, mandatory TOTP MFA for admins, a per-request risk engine with GeoIP impossible-travel detection, RBAC, and a hash-chained (tamper-evident) audit trail. A React SOC console streams events live (SSE) with WebSocket alert popups and a geo-map, plus a built-in attack range — 10 scenarios + storm — to launch attacks and watch detections fire.
|
|
Zero-trust auth backend: JWT access/refresh with rotation & replay (JTI) protection, mandatory TOTP MFA for admins, a per-request risk engine with GeoIP impossible-travel detection, RBAC and a security-event audit trail. Fronted by an Astro SOC dashboard behind a Caddy TLS proxy, with a defensive attack simulator that CI-verifies the defenses. Optional HashiCorp Vault layer for secrets & dynamic DB credentials. 
|
A tiny modular network scanner in Python: async TCP connect scanning, banner grabbing, service/version fingerprinting, CIDR host discovery, JSON/table output, and read-only OT protocol identification for Modbus/TCP lab environments. Built on a clean hexagonal architecture so new scan strategies, discovery methods, and output formats drop in without touching the core engine.
|
|
Security-focused Arch Linux setup: system hardening, reduced attack surface, and production-ready configuration practices, documented end to end. 
|
▸ Live demos — attack ranges catching attacks in real time
Emberwall — the hardened distro booting, sentinel scanning & the vault, all live
Aegis — launch an attack from the SOC console and watch the detections fire
Auth-Lab — the attack simulator driving scripted scenarios against the defenses
Pyscan — the modular OT/port scanner in action
Simulation-first IoT. I build each pipeline against a coherent virtual world before any hardware exists — so the full edge → broker → TSDB → dashboard path is testable on day one, and the ESP32/LoRa integration stays isolated to adapter swaps. Hexagonal cores, MicroPython-ready, enforced by architecture fitness tests. Three end-to-end pipelines so far, 123 tests between them, security built in.
🔥 They all ingest through Emberwall — my hardened MQTT edge gateway.
| Pipeline | Domain | Security | Tests | Status |
|---|---|---|---|---|
| 🌾 agrisentinel | crops · water · livestock | HMAC + anti-replay + anomaly detection | 33 |
sim-ready |
| 🛡️ sentinel-node | air · presence · edge ML | on-device ML, raw media never leaves | 45 |
sim-ready |
| ☀️ solar-weather-station | weather · solar power | self-powered edge, LoRa link | 43 |
sim-ready |
|
Smart-farm lab across three domains at once — crops, water and livestock — where the sensor network itself is treated as an attack surface. Every field node signs its telemetry with HMAC + sequence + nonce; a gateway verifies each frame and runs four independent anomaly checks (out-of-range, replay, stale, rate) before forwarding only what it trusts. Clean telemetry and security alerts travel on separate MQTT streams, feeding two Grafana dashboards from one pipeline — an agronomy view and a SOC-style security view. Inject a spoof/replay/forged attack from the CLI and watch the SOC light up live. Physics is the last line of defence: even a stolen key can't report soil moisture at 250%. 
|
Space-monitoring node fusing air quality (BME680), mmWave human presence
(LD2410), and on-device ML for acoustic events (INMP441 + TinyML) and vision
(ESP32-CAM). Its hexagonal core models two kinds of observation on purpose — scalar
|
|
Solar-powered weather-station architecture developed simulation first. A coherent virtual weather world drives simulated BME280, BH1750, PMS5003 and rain sensors, reproducing daylight cycles, pressure fronts, rainfall, humidity changes, particulate scrubbing, solar charging and battery behavior. Telemetry flows over MQTT through Node-RED into InfluxDB and Grafana, while the hexagonal, MicroPython-ready core keeps the future ESP32 + LoRa hardware integration isolated to adapter changes. Ingest is handled by my Emberwall MQTT edge gateway. 
|
Why simulation-first? Building against a virtual world means the whole pipeline — sensors, broker, storage, dashboards, and the security layer — is verified in CI before a single wire is soldered. The domain and application layers are MicroPython-safe, so the move to real ESP32 hardware is a mechanical adapter swap, not a rewrite. Same discipline I apply to backend work: test the contract, isolate the I/O.
▸ Live demos — dashboards & a security layer catching an attack
sentinel-node — occupancy, air quality & a scripted acoustic anomaly
agrisentinel — a spoof attack lighting up the SOC dashboard in real time
solar-weather-station — a simulated day with a scripted rain event, streamed live
▸ More IoT — earlier hardware & LoRaWAN projects
|
End-to-end temperature & humidity monitor: ESP32 + DHT22 firmware publishing over MQTT to a Node.js/Express backend and a real-time React dashboard. 
|
Energy monitoring over LoRaWAN: collecting, processing, and visualizing electrical consumption data through an InfluxDB + Grafana telemetry stack. 
|
|
Wearable IoT project using LoRaWAN, embedded sensors, and remote monitoring.
|
|
Python trading backtesting engine built with DDD + hexagonal architecture: a rich domain core with
|
|
Real-time cryptocurrency terminal: a Rust/Axum backend streaming live prices over WebSockets to an Astro + React dashboard, with PostgreSQL persistence and a full Docker stack.
|
A toy blockchain in Ruby on Rails built to make integrity visible: SHA-256
proof-of-work mining, per-block validation, and a 
|
▸ Live demos — real-time terminal & a chain breaking in cascade
Crypto·Watch — live prices, charts, and market analytics
toychain — mine, tamper, and watch chain integrity break in cascade
|
A Nokia-era classic rebuilt as a polished arcade game: HD rendering, custom pixel-art sprites, combo multiplier, power-ups, sound, screen shake, and a SHA-256 tamper-evident leaderboard backed by a Rust/Axum service.
|
▸ Live demo — Snake HD
> build small systems, not isolated scripts
> measure what you build
> keep security in mind from line one
> ship something that actually works
From edge devices to secured data — still learning, still building.