Infrastructure & Operations

Jupiter Station

Ongoing

Eight-node homelab — designed, built, and operated solo

An 18U rack run as a real environment rather than a lab toy: high-availability virtualization, redundant storage, segmented networking with intrusion prevention, and roughly two dozen containerized services behind a reverse proxy with automated certificates. Everything is documented, monitored, and backed up, because the point of building it was to practice operating infrastructure the way it has to be operated when it matters.

  • 8Nodes
  • 80+CPU cores
  • 72 TBRaw storage
  • 5Segments
  • 18U~1.2 kW

Compute & virtualization

A three-node Proxmox VE cluster with quorum for high availability across HP ProLiant and Dell PowerEdge hardware, plus a separate bare-metal node reserved for security research so that work stays off the production cluster entirely.

Storage

TrueNAS Scale on a dedicated node, ~72 TB raw in RAID-Z2 with hot spares, serving NFS and SMB to the cluster — backing store for VM backups, container volumes, document archives, and media. Restores get tested, not assumed.

Network & security

A UniFi Dream Machine Pro gateway with five isolated networks separating management, production, guest, and security-research traffic. Intrusion prevention runs across all segments against the full Emerging Threats category set, with explicit stateful firewall rules enforcing isolation. Remote access is a zero-trust mesh VPN rather than an open port. Internal certificate management, DNS filtering, and IP address management all run in-house.

Services platform

Roughly two dozen containerized services on Docker Compose behind Nginx Proxy Manager with automated SSL and Cloudflare-managed DNS — a password manager, private cloud storage, a self-hosted Git server, a document management system, container management and log aggregation, and a full Prometheus/Grafana/Uptime Kuma monitoring stack with network discovery and asset inventory.

Maker space

Three 3D printers and a CNC router driven from the operations node through OctoPrint and CNCjs, so fabrication is queued and monitored from the same place as everything else.

Proxmox VETrueNAS ScaleZFS / RAID-Z2Docker ComposeUniFiVLAN segmentationIDS/IPSNginx Proxy ManagerCloudflareTailscalePrometheusGrafana

Internal Systems — MacForce / Rocket Squad

Apple Authorized Service Provider and managed IT firm, Portland OR, 2019–2026. Hired as a service technician; ended up building most of the software the shop ran on.

Donor-machine parts database

The shop tracked salvageable parts from donor machines in a spreadsheet, which meant nobody could answer "do we have one, and where is it" without walking the shelves. I designed and built a relational replacement: machines, standard part types, per-machine part status, bin/shelf/room locations, staff users, and a complete transaction history of every removal, reservation, install, and status change. Shipped with both a native LAMP path and a containerized one so it could run on whatever the shop already had.

PHPMariaDBSchema designDocker

Repair pricing calculators

Built and maintained the pricing tables and calculators behind every quote the shop gave — the iPhone repair pricing sheet and the Apple repair cost calculator. During the platform migration I mapped the whole model into the new system: markup tiers, labor rates, and mail-in flat fees.

Pricing modelFixably

RepairShopr → Fixably migration

Served as an internal lead on moving the entire service operation to a new ticketing platform, from kickoff through cutover, and became the shop's working reference point for it. Configured pricing, order statuses, product categories, system settings, OAuth2 clients, the booking app, and portal branding; built the product and consignment import datasets; and drove the open vendor threads to resolution — parts-to-GSX sync, dispatch handling, deposits and sales orders, cost estimates, AppleCare deductible configuration.

Wrote the multi-stage illustrated Fixably Ticketing Workflow Tutorial from the onboarding recordings, revised it through a second edition, and trained staff on the new system.

Platform migrationOAuth2Data importTechnical writingTraining

Endpoint security rollout

Completed a company-wide SentinelOne EDR rollout and an Addigy MDM switchover — endpoint onboarding, 2FA enrollment, and threat-detection monitoring — and supported the parallel CrowdStrike Falcon migration on the managed-services side.

SentinelOneAddigy MDMCrowdStrike FalconEndpoint hardening

Network segmentation

Designed and implemented the shop's network segmentation, isolating service, business, and guest traffic that had previously shared one flat network.

VLAN designFirewall policy

Intranet & workflow automation

Built and maintained the company intranet homepage used daily by shop staff, and wrote automation to remove manual work — including an RSS-to-CMS pipeline that pulled Apple industry news onto the company site without anyone hand-entering it. Also installed and configured the shop's label print server and drove the QZ Tray / Dymo integration with the vendor through to resolution.

AutomationRSS / CMSPrint infrastructure

Documentation & training

Wrote the company's Employee Onboarding SOP covering equipment assignment, access provisioning, standards, and training sequence. Produced a HaloPSA client-creation video tutorial and written procedure, internal knowledge-base articles on recurring service procedures, and rewrote the customer-facing service agreement.

SOP authoringKnowledge baseVideo tutorials

Software

Jupiter Station Command Center TypeScript · React · Express · SQLite

A single operations dashboard for the whole environment, because checking eight separate web UIs to answer "is anything broken" is not operating infrastructure. Aggregates live health from eight integrations — container management, uptime monitoring, DNS filtering, mesh VPN, metrics, networking, the password manager, and domain expiry tracking — on a 30-second poll behind session authentication. Containerized and deployed to a self-hosted node.

The domain-watch integration pulls inventory from a local database and verifies expiry against registry RDAP, falling back to port-43 WHOIS for the TLDs that publish no RDAP service, with alert thresholds at 30 and 14 days. It currently tracks 18 domains, all registry-verified.

TypeScriptReactExpressSQLiteREST integrationRDAP / WHOISDocker

Snoop Swift

A macOS security scanner that detects screen-sharing sessions, remote-access tooling, and stalkerware by sweeping running processes, listening ports, launch daemons and agents, and TCC permissions. It reports findings with a severity and a plain-English explanation rather than taking automatic action — the person running it should decide what to do, and should understand why something was flagged.

SwiftmacOS internalsTCCProcess & port analysis

CipherVault Swift / SwiftUI

A macOS encryption application implementing AES-256-GCM and ChaCha20-Poly1305 with a custom encrypted container format.

SwiftSwiftUIAES-256-GCMChaCha20-Poly1305