Projects
Selected projects I’ve built, deployed, and maintain on my own Ubuntu server: spanning full-stack web apps, an iOS app, deployment pipelines, and infrastructure work.
Featured
Secure VOIP Server (Asterisk) Running
A self-hosted Asterisk PBX with encryption enforced end-to-end: TLS-encrypted SIP signaling and SRTP-encrypted call audio, reachable only over my private WireGuard VPN. Verified with a real registered SIP client and a live encrypted test call.
- PJSIP with a TLS-only transport: no plaintext SIP exposed at all
- SRTP mandatory on every call (AES_CM_128_HMAC_SHA1_80)
- Bound to the VPN interface plus a firewall rule scoped to the VPN subnet
- fail2ban watching Asterisk's auth log for brute-force attempts
VoipPhone: Custom SIP Client In Progress
A full-stack replacement for using a stock SIP app on my self-hosted Asterisk PBX: a native iOS client with system-level call handling, backed by my own push-notification service, because a self-hosted SIP server can't use a stock app's push credentials.
- Native Swift/SwiftUI iOS app: login, keypad, call history, contacts, and in-call controls
- CallKit for native call UI and PushKit for background call delivery
- TypeScript/Express + PostgreSQL backend issuing VOIP push notifications, deployed with Docker Compose
- TLS-signaled, SRTP-encrypted calls end-to-end, matching the underlying Asterisk server
Live Projects
Read Smart: Student Management System Live
A full-stack student management system with role-based dashboards for admins, teachers, and students: academic records, course enrolment, and a library module, built for a university-style workflow (NFC Institute of Engineering & Technology).
- Role-based access control: separate admin, teacher, and student dashboards
- JWT authentication, bcrypt-hashed passwords
- React (Vite) frontend talking to a PHP/MySQL REST API
- Hosted on OVH VPS behind Nginx, with Namecheap DNS
DevOps & Infrastructure
Infrastructure Monitoring Stack Running
A Prometheus + Grafana monitoring stack watching my OVH VPS in real time: CPU, memory, disk, and network metrics on live dashboards, deployed entirely with Docker Compose.
- Node Exporter scraping host-level system metrics
- Prometheus as the time-series metrics store
- Grafana dashboards provisioned as code (datasources + dashboards via config files, no manual clicking)
- Bound only to my private WireGuard VPN interface: never reachable from the public internet
What’s next
- Server hardening with Ansible: SSH/UFW/fail2ban baseline and unattended security upgrades, idempotent and version-controlled instead of manual one-off changes.
- CI/CD deployment pipeline: GitHub Actions building and deploying on every push to main, with rollback on a failed health check.
- Containerized reverse-proxy platform: one Compose stack routing every subdomain, with auto-renewing HTTPS.
- Mini intrusion-detection dashboard: parsing fail2ban logs into a live blocked-IP view of attack attempts over time.
- Automated backup & DR pipeline: versioned restic backups to S3 with a tested, documented restore runbook.
Coursework
MIT Missing Semester Completed
Worked through the syllabus and exercises from MIT's "Missing Semester of Your CS Education": the practical, tool-focused skills that tie a CS education together.
- Shell fundamentals and the command-line environment
- Development environment and tooling setup
- Debugging, profiling, and version control with Git
- Packaging, shipping code, and code quality practices
Student Record CRUD Completed
A small plain-PHP + MySQL practice project: the fundamentals of a secure CRUD app without a framework to lean on.
- Parameterized queries throughout (no string-interpolated SQL, including on delete/update)
- Hashed passwords (bcrypt via
password_hash), never stored or shown in plain text - Session-based auth with CSRF tokens on every state-changing form