Self-Hosting Frappe HRMS: A Production-Grade Docker Compose Deployment
How I deployed Frappe HRMS on my own infrastructure using Docker Compose, Caddy, Cloudflare, and WireGuard — with automated backups, user access control, and a rollback strategy.
Writing
Blog.
Technical writing on backend engineering, debugging, and system design
Profiling and Optimizing an AI Agent's Resource Usage
A deep dive into analyzing a deployed Hermes agent's RAM and disk footprint, the five changes that cut its memory reservation in half, and the SQLite performance tuning that made it snappier.
A Loose Cable, a Slow WSL Boot, and a Shell That Kept Losing My PATH
A debugging story about running WSL Ubuntu off a flaky external HDD — a slow, fragile .zshrc that lost opencode from PATH, ext4 journal recovery eating the first boot, and 71 crash-orphaned junk files quietly piling up in $HOME.
Telegram MTProto Proxy
Running an MTProto proxy on a VPS so I can connect when Telegram is blocked.
Self-Hosted WireGuard VPN
Running a WireGuard VPN server in Docker on a VPS for personal use.
Migrating an AI Agent from Incus to Docker: A Security Retrospective
Why I moved my autonomous AI agent (Hermes) from an Incus container to a hardened Docker Compose stack — seccomp, read-only rootfs, dropped capabilities, network segmentation, and the tradeoffs I made along the way.
How 10 Orphaned AI Processes Ate My Server's RAM (And How I Fixed It)
A debugging story about orphaned processes, memory pressure, and the simple fixes that prevent long-running AI agents from silently consuming your server's RAM.
Hardening a Linux Server: A Practical Journey
A real-world walkthrough of securing a production Ubuntu server — SSH hardening, fail2ban, firewalls, kernel tuning, Docker security, and the gaps I'm still fixing.
The Day I Thought My VPS Was Compromised
SSH stopped working. Telegram revoked my bot token. My AI assistant froze. It looked like an attack. The logs told a different story.
Inside Wraft: How We Built Digital Signing, PDF Analysis, and the Elixir-Rust-Java Bridge
A deep architectural walkthrough of Wraft's digital signing pipeline — from Rust NIFs that parse PDF geometry, through Java signing JARs, to Elixir/Oban workflow orchestration — and how every piece connects.