My background is in IT/Multimedia with over 15 years of experience across design, digital production, web and software development. I build and maintain self-hosted infrastructure, automate deployment pipelines, and apply systems thinking from a production background to the infrastructure layer.
I started in graphic design where details matter because someone experiences them. Then spent over a decade as a Digital Producer, translating between human experience and technical execution. The infrastructure work is the same translation problem, just further down the stack.
┌─────────────────────────────┐
│ ABSTRACTION │
│ patterns · systems · │
│ architecture · strategy │
└──────────────┬──────────────┘
│
▼
┌─────────────────────────────┐
│ BRIDGE │
│ translation · context · │
│ documentation · empathy │
└──────────────┬──────────────┘
│
▼
┌─────────────────────────────┐
│ DETAIL │
│ precision · execution · │
│ implementation · craft │
└──────────────┬──────────────┘
│
└──────────────────────────────┐
│
┌─────────────────────────────┐ │
│ ABSTRACTION │◄──────────────┘
│ informed by detail · │
│ grounded · accurate │
└─────────────────────────────┘
Live Translator — a self-hosted web app for real-time Korean↔English translation and structured Korean language learning, built for live video calls with Korean-speaking family and for practising between calls.
The problem: every common translation app (Google Translate, Papago, Microsoft Translator) stops transcribing on silence. Natural conversation — especially with an elder speaker — has 3–5 second pauses between thoughts. Every pause kills the transcript and breaks the flow. This app captures continuously using silence-boundary segmentation instead of fixed intervals, so utterances aren't cut mid-sentence and context carries across the conversation.
The constraint that shaped everything: the target phone runs GrapheneOS, which blocks Google Play Services. The browser-native Web Speech API depends on Google's speech recognition — blocked entirely. That pushed the whole STT/translation/TTS layer off-device onto edge compute and ruled out browser-native speech recognition across the entire app.
┌──────────────────────────────────┐
│ Mac (BlackHole virtual audio) │
│ captures call audio digitally │
└────────────┬─────────────────────┘
│ 1. clean audio, no re-recording
▼
┌──────────────────────────────────┐
│ Browser — React SPA │
│ AudioWorklet, silence-boundary │
│ VAD segments per utterance │
└────────────┬─────────────────────┘
│ 2. WAV per utterance
▼
┌──────────────────────────────────┐
│ Cloudflare Workers AI │
│ Whisper large-v3-turbo → STT │
│ Gemma 4 → translation (both │
│ directions, rolling context) │
└────────────┬─────────────────────┘
│ 3. static build served by
▼
┌──────────────────────────────────┐
│ Pi (self-hosted) │
│ nginx + Cloudflare Tunnel │
│ (no inbound ports required) │
└──────────────────────────────────┘
Audio capture via AudioWorklet (replaced an earlier MediaRecorder approach — Whisper rejects WebM outright, and fixed-interval chunking cut Korean's subject-object-verb sentences mid-utterance). Streamed to Cloudflare Workers AI: Whisper handles Korean STT with a forced language hint, Gemma 4 handles translation in both directions with a rolling context window for coherence and correct pronoun resolution across turns. A companion Study tab (spaced curriculum, tile-arrangement practice, pronunciation scoring via Azure Speech) turns the same conversational data into a structured learning tool. Self-hosted on the same Raspberry Pi running the rest of the home lab — nginx serves the static build, no backend proxy needed since the browser talks to Workers AI directly. Security layered across Cloudflare Access (email-allowlisted PIN gate on the subdomain), API keys living only in the Worker's environment, and nginx rate limiting as a backstop.
React Cloudflare Workers AI Whisper Gemma 4 Azure Speech nginx systemd Let's Encrypt Cloudflare
Privacy-first workout tracking app for Android. No ads, no account required, all data stored on-device. Features custom workout creation, guided session mode, stats and insights, reminders, and QR code workout sharing. Built in React Native / Expo with a custom Material Design-inspired design system. Currently in closed testing on the Google Play Store.
CI/CD pipeline: GitHub Actions test → build → submit on version tag push. Jest unit test suite. EAS Build produces AAB artifact; EAS Submit delivers to Play Store internal track via Google Service Account (least-privilege permissions). Actions pinned to immutable commit SHAs with permissions: contents: read at workflow level. Lefthook + gitleaks for pre-commit secret scanning.
 |
 |
 |
 |
 |
 |
 |
React Native Expo GitHub Actions EAS Build Jest Android
WordPress plugin built at Ironbark Marketing that generates a branded link directory page at yourdomain.com/quicklinks/. Customisable profile image, background and button colours, drag-and-drop link reordering. Tested up to WordPress 7.0.1 / PHP 8.3.
Key implementation decisions: virtual page architecture (rewrite rule + template_redirect) replaces the original auto-created WordPress page — nothing exists to accidentally delete or conflict with; per-version upgrade routine trashes the legacy page on overwrite-install. Self-hosted update pipeline via WordPress's native update_plugins_ironbarkmarketing.com filter (WP 5.8+) — token-gated JSON manifest on the Ironbark server feeds the standard wp-admin update UI and Dashboard → Updates, so clients update Quicklinks like any other plugin. CI/CD pipeline via GitHub Actions: PHPCS + WordPress-Extra ruleset, zip packaging, GitHub Release, and automated FTPS deploy of the zip and regenerated manifest to the update server on every version tag.
 |
 |
 |
WordPress PHP GitHub Actions PHPCS
Self-hosted centralised management dashboard for over 10 production WordPress client sites, built on MainWP and deployed to a dedicated subdomain. Replaces a manual, site-by-site update workflow with a single control plane covering bulk updates, uptime monitoring, and security visibility across all managed sites.
Key implementation decisions: real server-level cron over WP-Cron (unreliable on a low-traffic dashboard-only subdomain); per-site OpenSSL key pairs with Unique Security IDs replacing password authentication; maintenance mode for frontend obscurity after directory password protection was evaluated and rejected (intercepts WordPress core HTTP requests). Backup strategy layered across UpdraftPlus per-site (weekly) and VentraIP server-level hourly snapshots.
MainWP WordPress Apache MariaDB Linux Cron
Self-hosted NAS on a Raspberry Pi 4B, replacing an end-of-life Netgear ReadyNAS. Two 1TB NVMe SSDs in a software RAID 1 array via mdadm, served through FileBrowser Quantum over the local network. Daily incremental backup of selected folders from connected devices via rsync over SSH, managed by anacron.
Key implementation decisions: OMV rejected to avoid conflicts with existing Pi services; Time Machine rejected (all-or-nothing system backup); cron replaced with anacron for missed-run tolerance; FileBrowser original replaced with Quantum fork after diagnosing a routing bug in v2.63.4; powered USB hub added after diagnosing Pi 4B USB power budget limitation via dmesg. CVE patched same session as release.
Monitoring stack: Node Exporter on the Pi, Prometheus + Grafana on a separate host. Custom textfile collector metrics for backup job success (backup_last_success) and RAID array health (raid_health). Alert rules fire to email on backup failure or array degradation.
External access via Cloudflare Tunnel — replaces port forwarding after ISP change blocked inbound ports on residential plan. Pi static IP configured via systemd-networkd for stability across router reboots.
mdadm ext4 rsync anacron systemd Linux SSH Prometheus Grafana Node Exporter Cloudflare Tunnel
Network-wide DNS-based ad/tracker filtering for the home lab, deployed on the same Raspberry Pi 4B already running Pi NAS and Aersia. No application code in this repo — the deliverable is the architecture, the security review process, and two debugging case studies, written up as a standalone documentation repo rather than a thing to clone and run.
Key implementation decisions: four-category security review applied to the install script before execution (external fetches, obfuscation, excessive permissions, rogue persistence) rather than trusting curl | bash on faith; failure-domain analysis rejecting a second Pi-hole as DNS2 fallback since it would share the same host/power/storage as the primary; DNS-01 (not HTTP-01) certificate challenge for an intentionally internet-unreachable admin subdomain. Diagnosed and resolved a live incident where a port-binding conflict silently broke an unrelated service's IPv6 traffic, and separately ruled out a false alarm that looked like a filtering failure but traced to an unrelated browser privacy setting.
LAN device ──▶ Filtering host ──▶ Matches blocklist?
│ │
yes no
│ │
▼ ▼
0.0.0.0 / NXDOMAIN Forward to
(blocked locally) upstream resolver
Linux DNS Nginx systemd Let's Encrypt Security Review Raspberry Pi
Self-hosted video game music player running on a Raspberry Pi 4B. Forked and significantly extended from an upstream HTML5 player: migrated playlist parsing from XML to JSON (vipvgm.net API), added sequential playback mode, Source playlist with CDN fallback logic, and Omni playlist (client-side merge of VIP, Mellow, and Exiled sorted A-Z). Full localStorage persistence across sessions with sequential position restoration fix.
Infrastructure: Nginx, Let's Encrypt TLS (DNS-01 challenge via Cloudflare plugin), Cloudflare Tunnel for external access (replaces dynamic DNS + port forwarding), CORS resolved via local Pi proxy serving roster files refreshed weekly by cron.
Nginx Let's Encrypt Cloudflare Cloudflare Tunnel Bash Linux Cron
Native Android companion app to the self-hosted web player, built as a fork of VidyaMusic by MateusRodCosta. The web player originally shipped a PWA for mobile use, but background audio proved unreliable on Android due to OS power management — a native app was the correct solution.
Extended from upstream to achieve full playlist parity with the web player: XML/XSPF roster support for WAP and CPP playlists, Source playlist with source-file filtering, and Omni (concurrent fetch of all six playlists, merged and sorted A-Z). Per-playlist position memory with atomic snapshot persistence, shuffle state persistence, and Bluetooth auto-launch notification support.
CI/CD pipeline: GitHub Actions assembleDebug on version tag push, APK attached to GitHub Release. Actions pinned to immutable commit SHAs. Licensed AGPLv3.
 |
 |
 |
 |
Kotlin Jetpack Compose Media3 GitHub Actions Gradle Android
Infrastructure & DevOps Linux · Nginx · Docker · Docker Compose · GitHub Actions · Bash · Cron · Anacron · UFW · SSH · mdadm · ext4 · rsync · systemd · DNS · Cloudflare · Cloudflare Tunnel · Cloudflare Workers AI · Let's Encrypt · Certbot · EAS CLI · Prometheus · Grafana · Node Exporter · Ansible
Cloud AWS · IAM · VPC · EC2 · S3 · RDS · Lambda · API Gateway · AWS CLI · Secrets Manager · Terraform
Development React Native · Expo · React · Kotlin · JavaScript · PHP · HTML · CSS
Tools Git · Jest · Lefthook · EAS Build · PHPCS · Composer · gitleaks · VS Code
7+ years as a Digital Producer at Ironbark Marketing, spanning UI/UX design, front-end development, WordPress plugin development, and multimedia production. That background shapes how I approach infrastructure: documentation, system design, and the gap between what developers build and what operations teams maintain.
