// selected work

I take apart systems other people built and say what to do next.

Infrastructure, legacy platforms and undocumented systems: I map what is there, hand over a written roadmap, and where it makes sense I do the work myself, down to rewriting the code. Five cases below, each with what was broken, what I did and what came out of it.

Case studies

Selected work

Self-hosted RustDesk panel
Reverse engineering · Node

Control panel for self-hosted RustDesk

Challenge. The open RustDesk server connects devices and stops there. Accounts, a synced address book and a management panel exist only in the closed paid edition, priced per seat. For anyone self-hosting to avoid depending on someone else's service, buying a closed component puts them back where they started.
Approach & solution. Wrote the missing half: a Node and Express server with SQLite, implementing the same client-API the RustDesk client calls, plus a browser panel with registration, devices and address book. The API contract is undocumented, so it was recovered from the client sources. Three findings paid for the effort: the address book is more reliable served in legacy mode, the api-server address will not fit into the filename config format because a colon is illegal in Windows filenames, and the address book's hash field is a ready-to-use connect credential rather than a fingerprint, so it gets encrypted at rest.
0
per-seat licences
1 host
no external database
open
source published
BSDnas
FreeBSD · ZFS

BSDnas: TrueNAS CORE fork on a supported base

Challenge. iXsystems ended the CORE line. The final release shipped on 29 April 2025 on top of FreeBSD 13.3, which is out of support and receives no security patches. The vendor's migration path leads to their Linux edition, meaning a platform change for everyone who stayed on FreeBSD and ZFS deliberately.
Approach & solution. Forked and carried forward to FreeBSD 15: six repositories covering the operating system, middleware, build system and web interface, a build that works again, and installable images. The CORE build system had to be understood end to end first, since it is FreeBSD-make wrapped around a Python DSL with its own repository manifest.
FreeBSD 15
base, up from 13.3
6
repositories maintained
2029
security support through
Billing migration
Legacy migration · PostgreSQL

ISP billing off a dead platform

Challenge. An internet provider's billing ran on PHP talking to DB2/2 version 7.2.9 over ODBC. It charges subscribers every night and cannot pause for a day. Specialists in that platform are close to extinct, so the next failure would have had nobody to call.
Approach & solution. Moved to PHP 8.3 and PostgreSQL 16 under Docker Compose. The deciding choice was to leave the business logic alone: the legacy code runs as it is, odbc_* calls are shimmed onto pg_*, functions dropped from PHP over twenty years come back as polyfills. Correctness is verified by replaying the nightly billing run on a copy and reconciling against the daily dumps of the live DB2 database, day after day across months.
134
tables migrated
6.2M
rows of billing history
4 / 15 168
balance diffs on replay
Self-hosted DNS
DNS & Infrastructure

Self-hosted DNS: 30+ zones off Cloudflare

Challenge. Complete dependence on an external DNS provider: no control over the data, no jurisdiction split, no redundancy of one's own.
Approach & solution. Hidden-primary PowerDNS with authoritative NSD edge nodes in several countries, two NS pools split by region, wildcard certificates issued automatically over DNS-01, scheduled zone sync. Every zone was reconciled against the old provider before the delegation was cut over.
30+
zones migrated
0
downtime at cutover
auto
wildcard certificates
Multisite platform
Web · Automation

Eighteen landing sites on one engine

Challenge. Several SEO-distinct landing sites for different services, without growing into a zoo of separate codebases maintained one by one.
Approach & solution. One technical core carries markup, form, captcha and backend; per-domain content, theme and keywords live in data. A single Ansible run loops over every site, and one shared form backend tags each submission with its source. Adding a site is a row in the inventory plus its content.
18
domains on one core
1
command deploys all
1
shared form backend
Toolbox

What I work with

KubernetesDockerTerraform AnsibleArgoCDGitLab CI / Actions HelmPrometheus / GrafanaLoki PowerDNS / NSDVault / SOPSTrivy / Semgrep Angie / nginxPostgreSQLPython Node / Next.jsAWS / GCPLinux

Got a system nobody fully understands any more?

Tell me what it is and what worries you about it. I reply within a day.

No spam, no pushy calls.