ENGINEERING DOMAIN
Networks
Routing, DNS, transport protocols, secure connectivity and packet behavior.
Routing, DNS, transport protocols, secure connectivity and packet behavior.
8 projects · 4 pieces of writing
Caddy Gateway & Secure IngressCanonical L7 ingress joining Cloudflare Tunnel, Caddy, Authelia and Tailscale with per-service sessions, server-side credentials and private/public routes.
Central Secret Lifecycle / OpenBaoTwo-tier OpenBao secret authority with Raft state, Transit auto-unseal, TLS, AppRole and a migration path away from filesystem secrets.
Distributed Compute & Build FabricNomad-based compute path across multiple machines with deterministic build execution and fallback capacity rather than tying jobs to one workstation.
Fimi AccessBrowser infrastructure workspace built from a pinned Termix base with a custom Fimi brand layer, reproducible patch set, SSH agent integration and gateway access.
Khulna Satellite WeatherLive Khulna weather dashboard combining Himawari-9 South Asia imagery, local forecast data and a six-hour satellite animation.
Network Flow VisualizationInteractive topology and packet-path view that maps hosts, DNS, ingress, services and observed flows into drill-down network views.
Network Payload Capture PipelineMinimal capability-bounded packet capture path that parses a live tcpdump stream into bounded payload snapshots consumed by the operations UI.
Private Alert DeliverySelf-hosted ntfy alert path from Alertmanager to a private Tailscale HTTPS endpoint with isolated publisher/subscriber identities and no public push dependency.
eBPF/XDP: The Verifier Passing Does Not Mean Your Network Program Is SafeThe verifier proves classes of memory and control-flow safety. It does not prove that returning the wrong XDP action, updating the wrong map, or attaching at the wrong hook will preserve network connectivity.
HTTP/3 in Enterprise Networks: QUIC Broke the Old Inspection AssumptionsBlocking UDP/443 is not merely a firewall rule. QUIC moves transport, security, streams, and connection identity into a model that old TCP/TLS inspection architectures were not designed around.
Kubernetes Gateway API Is Not Just a New Ingress YAMLGateway API changes who owns the network boundary, how routes attach, and what a migration has to prove. Treating it as an Ingress syntax upgrade misses the important part.
Split-Horizon DNS: One Hostname, Two Network Paths, and a Lot of TLS ConfusionThe same hostname can resolve to a local reverse proxy on LAN and a Cloudflare Tunnel externally. That is clean when DNS, SNI, certificates, and origin routing agree—and maddening when one layer quietly takes the other path.