The trail

1. Moving a regulated financial platform to AWS

   Financial sector · 2026 · infrastructure, deployment, production cutover

   Before go-live I found 11 blockers in the vendor’s code, fixed infrastructure code that had never compiled, and on the night of 14 October 2026 ran the brokerage platform’s cutover to production on AWS.

   Blockers found before go-live

   11

   Resources in Pulumi

   59

   Data migration, 100% validated

   43 min

   RPO / point-in-time window

   ~5 min / 35 days

   Full stretch

   Starting point

   The original app on shared hosting. A vendor was building a new system for two brands in parallel, meant to replace half of the application. A regulated sector, so backups and audit are not optional. Infrastructure, deployment and the cutover were mine; the code was the vendor’s.

   Constraints

   The old app has to keep running until the new system is ready. The vendor’s infrastructure code had never compiled. The cutover had one night.

   Decision

   • The load balancer routes requests by domain and path, part to the old app and part to the new system. Three environments as separate Pulumi stacks, deployed through GitHub Actions with OIDC.

   Result

   Production has run on AWS since 14 Oct 2026. I checked the vendor’s claims against the actual code; the blockers ranged from missing authorization to personal data in logs. Rolling deploys with automatic rollback, documented RPO and RTO, and a gap analysis against DORA.

   What I would do differently today

   I would spend more time on preparation and thinking it through, and less on fixes.

   More stretches by route

   Whole trailCareerWork with me

2. A SharePoint intranet for a law firm

   Client project · 2026 · SPFx, Microsoft Graph, PowerShell

   A full-page dashboard in SharePoint Online replaced the old self-hosted intranet: phone directory with presence, seating maps, lunch menus, memoranda and a data room.

   Extra licences for presence

   $0

   Presence from the attendance system

   every 3–5 min

   Rooms on the seating maps

   55

   Recorded decisions

   ~15 ADRs

   Full stretch

   Starting point

   The firm wanted to see who is in the office right now. The original plan relied on Power Apps Premium.

   Constraints

   Licence cost, separate delegated and application permissions in Microsoft Graph, and SharePoint REST refusing app-only tokens.

   Decision

   • Presence from physical access cards. Every 3–5 minutes PowerShell reads the attendance system’s log, matches cards to Entra accounts and writes only the changed rows through Microsoft Graph.
   • Rejected: Power Apps Premium, roughly $20 per user per month
   • Rejected: Presence from Teams

   Result

   Presence with no extra licences. Lunch menus from three different sources are normalised into one schema and can be tested offline. Builds dropped from ~35 s to ~3 s.

3. Subscription management for domains and hosting

   Internal tool at an IT company · 2026 · TypeScript, React, MariaDB

   It tracks expiry dates and sends the offer, the reminder or the escalation on its own every day. Customers renew or cancel with one link, no login needed.

   Automated tests

   141

   Admin sign-in

   Microsoft Entra

   Deployment and monitoring

   GitLab CI, Zabbix

   Full stretch

   Decision

   • Customers decide through a signed link in the email, with no account or password. Admins sign in with Microsoft, and every change goes to an audit log.

   Result

   Running in production as a pilot. I build and run it alone, with AI.

4. A homelab run by an AI agent under supervision

   Homelab · 2026 · Proxmox, pfSense, backups

   A two-node Proxmox cluster with an off-site tiebreaker, separate VLANs and a mesh VPN. An AI agent acts as the operator, but hooks block destructive commands and every change is logged with how to undo it.

   Restore test from backups

   monthly, automated

   Off-site backups

   PBS and restic

   Destructive command without approval

   blocked

   Full stretch

   Decision

   • The AI agent may change the infrastructure, but only through hooks that block destructive commands and ask for my approval. Every change goes into a journal together with how to roll it back.

   Result

   Backups are test-restored automatically every month, not just created.

5. Fur-Minal: an SSH, SFTP and RDP connection manager

   Personal project · 2026 · Rust, Tauri, React

   A desktop app for managing connections that takes credentials straight from Bitwarden. Secrets never leave the Rust backend, and server keys are pinned on first connection.

   Rust tests

   53

   Recorded decisions

   12 ADRs

   Bitwarden cryptography

   own implementation

   Full stretch

   Decision

   • All work with secrets happens in Rust and the interface never receives them. Local data is encrypted, and host keys and TLS certificates are pinned on first connection.

   Result

   53 Rust tests. Fixed a bug where Argon2 memory was passed in MiB instead of KiB.

6. FuryAI: a local AI pipeline for short videos

   Personal project · 2026 · TypeScript, Ollama, whisper.cpp

   From idea to publishing: script, voice, footage, captions and render all run locally. Jobs go through a resumable queue, so interrupted work picks up where it stopped.

   Language model

   Qwen2.5 14B, local

   Voice and captions

   Kokoro, whisper.cpp

   Admin interface

   local only, CSRF-protected

   Full stretch

   Decision

   • Heavy compute runs in a separate process so it never blocks the web servers. The admin interface listens only on the local machine; only the public page goes out, through Cloudflare Tunnel.

   Result

   The whole pipeline from idea to publishing runs without cloud AI services.

Side paths

• Critical PHP vulnerabilities: within 5 days of disclosure I mapped 228 targets across 65 clients.
• Veeam: backups to off-site storage ~85% faster after I moved the proxy right next to it.
• A service desk for an IT company with 100+ clients, in progress with a colleague.
• A client portal in SharePoint Online for external guests through Entra B2B.
• A sharing audit for SharePoint and OneDrive with PowerShell and Microsoft Graph.
• Fiki: records of networks, devices and access for IT companies, a personal prototype.

End of the trail: CV, working together and contact