Project index / 2026

Security controls,
under pressure.

Selected systems from my home lab and engineering work, documented around trust boundaries, test evidence, and safe failure.

P-01

Validated

Fail-Closed File Intake

A staged malware-scanning pipeline that prevents downstream import until completion, scan, and move verification all pass.

Problem: Automated downloads land faster than anyone can manually inspect them — a single infected or corrupted file reaching a media library is worse than a slower pipeline.
Known limitation: Scan latency for very large files can leave content quarantined longer than expected under load; there's a bounded retry policy, not a latency guarantee.

ClamAVPythonDocker

P-02

Operational

A shared-network-namespace design with controlled LAN access, verified tunnel egress, and kill-switch regression checks.

Problem: A VPN status badge in a dashboard doesn't prove application traffic is actually routed through the tunnel — a misconfigured route can leak straight to the ISP.
Known limitation: Kill-switch testing currently covers planned tunnel stops and host restarts; it hasn't been exercised against every possible VPN client crash mode.

GluetunNetworkingContainers

P-03

Operational

An internal reverse proxy with split DNS, isolated management access, internal TLS, backup, and tested rollback.

Problem: Convenient internal hostnames for home-lab services shouldn't require exposing anything to the public internet.
Known limitation: Client classes that can't easily trust an internal CA — some smart TVs and appliances — still need a case-by-case exception rather than one unified certificate strategy.

NginxPKIDNS

P-04

Design

A zero-change migration plan that preserves ports, paths, credentials, networking behavior, data, and recovery semantics.

Problem: Moving existing services onto Kubernetes is only safe if the migration preserves every port, path, credential, and recovery behavior — not just "roughly works."
Known limitation: Still in the design phase — no production traffic has been cut over yet, so real-world parity is unverified beyond the plan.

K3sArchitectureGitOps