Projects

Replacement for a live 1,800-user emergency communications platform, architected for global scalability at church HQ's request — replacing a legacy ColdFusion system across 65 active nets in four regions

Ground-up rewrite of a regional LDS Emergency Response Communications net management platform, replacing a legacy ColdFusion/MS SQL system currently serving 1,800 amateur and GMRS radio operators across Idaho, Montana, Oregon, and Canada. Initiated after church HQ expressed interest in expanding the program nationally and requested a scalable replacement — and after every other volunteer dropped out, leaving the build entirely solo. Features a real-time net session operational view with optimistic UI and client-side command queue, multi-level recursive RBAC hierarchy spanning ward through global organizational levels, participant pool management, traffic queue with precedence tracking, and coverage area mapping via Leaflet.js. Built with deliberate use of AI-assisted tooling — GitHub Copilot, Claude, and OpenCode — as a demonstration of how modern engineering velocity looks when the right tools are applied effectively.

Automated server provisioning and production-ready configuration — including a custom Ansible-driven Namecheap certificate pipeline deploying across up to 10 servers with zero manual file handling

Ansible-based infrastructure automation suite built for a 150-server environment, covering new server provisioning, software configuration, update management with audit logging, and SSL certificate lifecycle. The provisioning playbook took an unorthodox interactive approach — posing configuration questions to the sysadmin before execution, then gating each Ansible role based on the collected input, including spinning up new Linode VMs before logging in to complete the setup. Update playbooks persisted all output to the Ansible controller's disk, providing an audit log for investigating failures. The most technically complex component was a custom Namecheap certificate pipeline: no existing Ansible role supported the Namecheap API, so HTTP requests and XML processing were implemented from scratch to handle the full validation and issuance workflow, with the playbook managing file formatting, naming conventions, deployment across all affected servers, and Apache reloads. One or two DNS steps requiring manual intervention were surfaced explicitly to the sysadmin rather than silently skipped.

Shrinks a 5-minute grading workflow to under 30 seconds — local LLM inference via Ollama automates rubric-to-submission matching

Chrome extension redesigning the Canvas SpeedGrader workflow from manual opt-in interactions to automatic opt-out progression, with the user intercepting only when needed. Implements three-tier rubric matching: exact string match, normalized regex, and Levenshtein distance — applied via a local Ollama instance so student data never leaves the grader's machine, satisfying FERPA constraints without a hosted backend. The extension queries Ollama for installed models and lets the grader choose, with instruction-tuned models (e.g. Llama-instruct, Mistral-instruct) producing the best rubric-matching results. An adapter architecture normalizes different student submission formats — text, file uploads, URLs — into a unified internal API for the matching pipeline. Built initially as a personal productivity tool, it was later encouraged by supervisors and adopted by at least one colleague.

Cinnamon desktop applet with real-time Tailscale state monitoring — rebuilt to update UI only on actual state change, and hardened against shell injection via argv-based CLI invocation

Cinnamon panel applet monitoring Tailscale connection state via CLI polling, with a state-driven icon (grey/down, green/up, blue/exit-node-active), one-line tooltip summary, and a context menu for connection control and exit node selection. Initial implementation was AI-directed from my written spec; two subsequent changes were driven independently — redesigning the UI update logic to only rebuild the icon, tooltip, and menu on an actual underlying state change rather than unconditionally on every poll, and converting CLI interactions to async calls invoked via argv rather than shell interpretation, closing a shell injection risk.

Full event registration platform, including a custom Directus extension handling email operations and print-ready rosters via a JWT-secured cross-app bridge

Full-stack event management platform built for a retreat business targeting women's wellness experiences. Built on Directus, Astro, and Coolify with Docker. The platform handles marketing, event publishing, tiered registration with early-bird pricing and per-option capacity limits, photo gallery, and a mini-blog. A custom Directus extension provides operational tooling for the business: email blast to event participants, newsletter broadcast to subscribers, and printer-friendly event rosters. The roster feature involved an intentional architectural decision — rather than rebuilding Bootstrap-styled layouts inside the extension, a JWT-based bridge redirects the browser from Directus to the Astro frontend, which verifies the token, and renders the roster while keeping PII private. Email sending uses Gmail deep-link construction to pre-populate recipients (via BCC to protect privacy), subject, and an unsubscribe footer — keeping the workflow entirely within tools the client already uses, with a manual fallback for edge cases.

21 npm downloads per week, with apparent organic backend implementations by third parties — the JS package adopted independently of the PHP reference implementation

Multi-package offline caching layer for Inertia.js applications, enabling PWA-style service worker support with framework-agnostic architecture. Prototyped entirely within Box Beacon first — deliberately avoiding premature abstraction until the concepts were proven — then extracted into three coordinated packages: a framework-agnostic PHP base defining the full offline protocol, a Mako-specific adapter, and a JavaScript package with subpath exports for the service worker layer, Vue composable, and core utilities. The agnostic PHP design was a deliberate choice given Mako's niche adoption — the protocol is specified thoroughly enough for any PHP framework or non-PHP backend to implement independently. Third-party npm adoption without the reference PHP backend suggests that's already happening.

Detailed bug report and investigation contributed to a merged upstream fix in Docker/Moby — discovered via the boilerplate's novel loopback IP separation technique for concurrent local project isolation

Full-stack boilerplate wiring together PHP Mako, Vue 3, Inertia.js, and a comprehensive Docker development environment — consolidating my own ecosystem packages (inertia-mako, mako-csrf, mako-template-pp, mako-mailer) into a ready-to-clone starting point. The Docker configuration uses the full 127.0.0.0/8 loopback range to assign distinct IPs to concurrent projects, allowing multiple local projects to share ports 80 and 443 without port remapping or a reverse proxy. This technique incidentally exposed a bug in rootless Docker's port allocator — the investigation was detailed enough that an upstream contributor used it to author and merge a fix into Docker/Moby. Development environment includes Xdebug with VSCode integration, Caddy for local HTTPS via mkcert, Mailpit for email testing, and Adminer for database management — all optional and dev-only.

The only community package extending Mako's template filter system — adds a FilterRegistry for registering custom filters in one line, plus five production-ready built-in filters

Template extension package for the Mako PHP framework that adds five built-in filters — route URL generation, DateTime formatting with configurable defaults, string pluralization, template component inclusion, and an "up" filter for passing dynamic PHP values into template tag parameters. More significantly, exposes a FilterRegistry singleton allowing developers to register custom filters with a single callback, or via lower-level methods for advanced configuration.

The only actively maintained email package for Mako v10+

Adapter-based email package for the Mako PHP framework, providing a consistent sending API regardless of the underlying delivery mechanism. Ships with a PHPMailer adapter as the default — pre-configured via Mako's config system for server settings, credentials, and default sender — and exposes a clean interface for implementing additional adapters. The registered Mailer class provides send() and sendTemplate() methods, with the latter integrating directly with Mako's View Factory for template rendering. Includes an EmailUser convenience class that wraps Mako's built-in user object to automatically supply name and address to the mailer. The only actively maintained email solution for Mako v10+; both existing alternatives target versions so old their repos are partially missing.

Touch-free QR-code move-in portal routing movers to correct rooms without app access

Box-centric moving inventory app built after evaluating and rejecting existing solutions that didn't fit real moving workflows. Features QR-code box labeling, dual from/to room assignment, multi-user move sharing, and a touch-free move-in portal for scanning boxes without requiring mover accounts. Also served as the primary real-world testbed for the inertia-mako open-source adapter.

Eliminated all manual drop-ship order processing, and automated distributor catalog sync

OpenCart extension replacing a brittle WP EasyCart implementation for a defense equipment retailer. Manages store inventory automatically from distributor FTP catalog files and forwards qualifying orders to the distributor's SOAP drop-ship API, eliminating manual order processing entirely. The OpenCart recommendation itself was a strategic architectural decision — the previous platform required eval-ing modified plugin source code to achieve basic customization, creating unsustainable maintenance risk.

Fully automated screen deployment via projector IR detection — zero manual intervention required, with hardware failure safeguards

Motorized projector screen controller built around an Arduino Nano, automating screen deployment and retraction by mirroring the projector's IR signal. The motor came from a junkyard car window assembly — chosen deliberately for its integrated housing and worm gear, 12V compatibility, and vehicle-grade durability under high-force conditions. The limit switch mechanism is entirely custom: a 3D-printed assembly with a screw rod attached to the screen axle, a flange kept rotationally fixed by a paperclip, and adjustable-position limit switches that the flange contacts when the screen reaches fully open or closed. Software includes PWM speed ramping, travel-time tracking for proactive ramp-down ahead of the anticipated stop point, and a timer-based cutoff as a failsafe against limit switch failure.

Reduces Mako CSRF implementation from a 4-step manual process across controller, DI, and template layers to a single template helper call — the only published CSRF package for Mako's 172k-install ecosystem

CSRF protection middleware for the Mako PHP framework that eliminates the manual multi-step implementation Mako developers would otherwise assemble themselves — wiring DI, controller validation, and template token injection by hand. This package moves validation into middleware and exposes token helpers directly in the View Factory, reducing the developer's responsibility to a single template call. The only published CSRF solution for Mako's ecosystem of 172k+ installs.

Implemented the full Inertia.js protocol from scratch — no prior adapter to reference — powering multiple shipped projects including ERC Connect and Box Beacon

Published Composer package implementing the Inertia.js adapter protocol for the PHP Mako framework, enabling Vue.js single-page application patterns with server-side routing on a backend that previously had no path to modern frontend tooling. Built after finding no existing adapter, requiring deep implementation of the Inertia.js protocol from scratch and integration with Vite for asset bundling. Used as the foundation across multiple personal projects.

Original ergonomic input device concept — vertical-plane joystick positioning with shifted exponential response curve and angular calibration, operating via BTLE on ESP32-C3

Custom BTLE mouse attachment for the MoErgo Glove80 split keyboard, designed after evaluating and rejecting existing DIY approaches that required subpar thumb stretching or hand movement. The core insight was working in a vertical plane rather than horizontal — the fin-shaped mount arches over the thumb cluster so the joystick sits above the natural thumb position, requiring only a vertical lift to engage. Firmware implements a shifted exponential response curve (linear speed increase up to a configurable threshold, then exponential) for comfortable cross-monitor travel, and angular calibration using trigonometry to align joystick direction with natural hand orientation. BTLE on the ESP32-C3 introduced processing constraints that required throttling to larger infrequent moves rather than smaller frequent ones — a documented hardware tradeoff with a clear upgrade path to a dedicated ADC and improved BTLE stack. All motion parameters are user-configurable. CAD model published on OnShape.

Coordinated 100+ emergency operators across 58 local units across 4 regional districts, simulating and assigning 236 resource needs in a single exercise

Web app facilitating emergency communications drills for a regional LDS ERC group, simulating community resource needs and operator response capabilities across a multi-level organizational hierarchy. Implements a weighted random assignment algorithm distributing simulated needs across jurisdictions according to configured spread profiles. Supports real-time coordination via PocketBase and auto-generates post-exercise statistical reports for performance review and recognition. Scaled from an initial deployment to coordinating 100+ operators managing 236 simulated resource assignments across 58 local units.

Published Cinnamon applet cloned by another developer to support WakaPi

Cinnamon desktop applet displaying daily coding time from the WakaTime API, configurable with API key and refresh interval. Simple by design — polls on interval and updates the panel display — but published and adopted enough that another developer forked it to support WakaPi, a self-hosted WakaTime-compatible alternative.

Real-time transaction sync across connected financial accounts via Plaid API

Web implementation of a friend's flow-based budgeting methodology, upgraded from a manual spreadsheet with real-time transaction ingestion via the Plaid API. Originally built with vanilla JavaScript as a deliberate exercise in fundamentals before modern frameworks.

90%+ song identification accuracy via custom Levenshtein-based fuzzy matching algorithm against the Genius API

Personal toolset extending Spotify with features the platform doesn't natively offer. The technical centerpiece is a custom song-matching algorithm — combining Levenshtein distance, difference ratios, and score inflation — to identify tracks against the Genius API, which provides no structured search endpoint. Built to flag potentially inappropriate lyrics and album art by chaining Genius lyric lookup with a content evaluation API.

Stateless form-sharing via client-side LZ-compressed JSON URLs, enabling spouse handoff without server storage or authentication

Mobile-friendly digital intake form replacing a paper process for new congregation members, with completed forms rendered to PDF and automatically emailed to leadership for printing and filing. The technically notable feature is stateless partial-form sharing — a URL encodes in-progress form state using client-side LZ compression to stay within URL length limits, allowing one spouse to start the form and share a link for the other to continue without server-side session or storage.

Recognized as a 'hero' contributor in the official release for adding Google Assistant support and refactoring the voice assistant integration to a modular architecture enabling future platform expansion

Open source contributor to Nightscout, the web app at the heart of DIY artificial pancreas systems. As a T1 diabetic and engineer, I refactored the existing Alexa integration — which was outdated and read-only — into a modular architecture supporting multiple virtual assistant platforms, added full Google Assistant support via Dialogflow, and enabled bidirectional communication so assistants could accept input in addition to reporting data. Recognized as a 'hero' in the release notes.

Eliminated 30-60 minutes of daily manual IP blacklisting

Security automation pipeline built on top of Graylog at a SOC2-audited IT firm, replacing a daily manual process where a team member spent up to an hour reviewing fail2ban logs and hand-adding repeat offenders to a permanent blocklist. The pipeline used a Graylog rolling time-window query to count per-IP appearances across log streams. When a threshold was crossed, an HTTP alert fired a webhook to a custom PHP script maintaining an internal IP blacklist. The script also exposed the blacklist as a plain-text endpoint that pfSense firewalls at both the office and datacenter polled automatically, escalating blocks from the application layer to the network perimeter. The result was repeat offenders getting firewall-level blocked without any human involvement, and the morning manual review becoming unnecessary.

Transmitted clock-in data from mobile devices to a network-isolated desktop via morse code audio encoding over a headphone jack — zero network access required

Tutor time-clock system built around a network-restricted college computer, featuring barcode ID scanning, timesheet PDF auto-generation, and a mobile companion web app. The network isolation constraint produced the most interesting engineering decision: mobile clock-in data is encoded as compressed morse code audio, played through the phone's speaker into the desktop computer's audio input — no network required. Led a small team of tutors to build and deploy the system.