Serious ones up top if you’re hiring. The fun ones are where the soldering burns are.
Run 5 NixOS machines (2 desktops, a home server, a public VPS, and a recovery/install ISO) from one Git-tracked flake, with every host reproducible from the repo and no hand-run setup steps. The home server's root filesystem is wiped on every boot, so only explicitly declared state survives.
see it →Built an automated ZFS backup system across three machines: zrepl takes snapshots every 5 minutes, the home server pulls replicas from two desktops and its own data pool every 15 minutes into a mirrored backup pool (4x 12 TB drives in two ZFS mirrors), and snapshots are kept for about 13 months. A weekly Restic job backs up about 2.9 TiB to Backblaze B2 from mounted ZFS snapshots, so every offsite backup is atomic and incremental. Migrated the system from Sanoid/Syncoid to zrepl.
see it →Wrote a restore drill suite, run monthly, and an automated canary check that restore from real ZFS and Restic backups into scratch space and verify the data; a full-scale test restored 873 GB in 11 h 17 min.
see it →Public traffic lands on a small hardened VPS that tunnels home over WireGuard, so the home server is never directly reachable from the internet. The home server builds the VPS's configuration and pushes it over Tailscale, so the small VPS never compiles its own config.
see it →Set up fleet-wide log collection with Grafana Alloy, Loki, and Grafana, and periodic ZFS, SMART, and systemd health checks that send a Discord alert when a disk or service fails. The alerts caught silent checksum corruption from a faulty USB drive enclosure, traced to its UAS link and fixed with a kernel quirk and a cable replacement.
see it →Automated remote installation and declarative NixOS configuration of servers using nixos-anywhere; 98% of setup is automated, with only secret provisioning done by hand. A full reinstall of the public VPS takes about 30 minutes, nearly all of it unattended.
see it →Set up declarative SOPS-based secret management shared across 4 machines, each decrypting with its own age key, stored in a public GitHub repo without leaking secrets.
see it →Set up FIDO2 hardware-backed SSH keys: a YubiKey-backed key authorizes root SSH access to the home server, the public VPS, and the install ISO, and a TPM-backed key was used on a laptop.
Host Jellyfin and Immich with NVIDIA GPU transcoding, run services in Docker with user-namespace remapping, share files over Samba and NFS, and manage DNS as code with octoDNS on Cloudflare, including the mail records for a Google Workspace domain.
see it →Gave AI coding agents (Claude Code and OpenAI Codex) their own unprivileged Linux user on a NixOS desktop, declared in Nix: systemd sandboxing with a read-only system, only the GPU and KVM devices passed through, a shared cgroup cap of 64 GB of memory, and an iptables egress firewall that blocks the home LAN and VPN. A NixOS virtual machine test checks each boundary from the agent's side.
see it →Run unattended Claude Code jobs on systemd timers: a weekly job updates the fleet's dependencies, builds every host, and opens a pull request for review; a daily job checks new security advisories against the package versions the fleet actually runs. The job prompts live in the Git repo, so a job only changes through a reviewed pull request.
see it →Ran a security audit of the 5-machine fleet with AI agents: wrote a threat model and severity rubric first, had agents audit 9 areas against it, and ranked the 158 findings by root cause. The most urgent was a live private SSH key left in /tmp, where automatic snapshots had copied it.
see it →Direct AI coding agents (Claude Code and OpenAI Codex) on the homelab fleet while designing, reviewing, and deploying every change personally: the agents work from written plans and send changes as pull requests for review, 153 merged from August to October 2026. Still writes Nix, and some Bash, by hand.
see it →Handle IT for family and friends: installed TVs, printers, sound bars, and audio; fixed internet problems and incorrectly wired A/V; ran Ethernet cable; removed viruses and reinstalled operating systems; set up password managers and Backblaze backups; taught elderly relatives to use their computers; and planned PC builds and helped friends choose laptops.
Replaced the battery in an iPod Classic, replaced several laptop batteries, reapplied thermal paste on many laptops, and built a desktop PC.
Ran Pi-hole on a Raspberry Pi as a whole-house DNS ad blocker.
Built split ergonomic keyboards from kits, a Charybdis Nano and then a Faux Fox Keyboard (FFKB), and currently building a Svalboard. Did through-hole and surface-mount soldering and assembly, configured the layout in Vial, and had PETG parts 3D printed by PCBWay and a laser-cut, powder-coated steel base made by SendCutSend. Chose the second board by working out why the first caused wrist pain.
Member of the Bay Area Meshtastic (LoRa mesh radio) group: one of the lead presenters at the open-source booth at Open Sauce 2025, and ran a solar and battery powered RAK4631 repeater node for a few months.
see it →Contribute to MusicBrainz, the open music metadata database: 375 edits since January 2026 (373 applied, none voted down), adding 44 releases and 37 cover art images.
see it →Won the robot competitions (about 10 teams each) in a high school electronics class and a college robotics class, building and programming both robots alone. The first was a two-wheel robot that navigated a room using only bumper sensors and solved mazes; the second followed lines through a hidden maze, was driven manually through another section, and dragged a rubber duck back to the start in reverse.
Founded a high school drone club with about 7 members.
Helping build a foam-core insulated workshop from scratch (started August 2026), framing it in wood around standard pallet racks with power tools, and ran the 120-volt wiring for its lighting.
A constructed language built as a thought experiment in what the best human language could be, with lessons, a full reference and a searchable dictionary. I'm also learning it.
see it →An electropop music video about the AI discourse, sung by a very eager assistant. Every event in it is real and sourced, and the whole video is code you can render yourself.
see it →Stickers, a fox, a cloud with feelings, vim keys and a fake terminal, served from a homelab through a WireGuard tunnel. Built with an AI pair, disclosed on /ai.
see it →
Skyseeker