Major projects from my degree.

Engineering Highlights

• —End-to-end TypeScript in a pnpm + Turborepo monorepo: Next.js 16 / React 19 frontend, NestJS API, Drizzle + PostgreSQL 17 / PostGIS, and a Valkey cache — a single Drizzle schema is the source of truth, with types flowing into both API and UI.
• —Secure auth (better-auth): Argon2id hashing, OAuth-ready social login, HIBP breached-password rejection, Postgres-backed sessions, and a BFF pattern where Next.js holds the httpOnly cookie and talks to the API server-to-server.
• —OWASP-aware hardening: strict CSP + security-header suite (HSTS, X-Frame), CSRF Origin allow-list backing SameSite cookies, Valkey-backed rate limiting, server-side ownership checks (no IDOR), and AES-256-GCM encryption of OAuth tokens at rest.
• —Database performance audit with EXPLAIN (ANALYZE, BUFFERS) against ~145k synthetic rows; partial, trigram (GIN), and GiST indexes, Valkey cache-aside, and keyset pagination — every hot query verified sub-millisecond.
• —Peer-conferred "Cred" reputation system: readers attach weighted assessments to posts; cred rolls up per-sport and globally into a 5-tier ladder, monotonic by design so it can't be farmed. PostGIS geography + GiST powers "near me" facility ranking.
• —Self-hosted on Linux via Docker Compose (separate dev/staging/prod stacks) behind an outbound-only Cloudflare Tunnel — no inbound ports, no exposed IP — with multi-stage non-root images, Pino structured logging, GlitchTip/Sentry, and health/readiness probes.

Engineering Highlights

• —Layer-2/3 design across UDMP, dual USW Pro Max distribution switches, a USW Flex 2.5G edge switch, 5× U6 Mesh APs, and a 10G SFP+ backbone with seamless roaming.
• —60TB Btrfs RAID 6 array on a Synology DS1525+ — chose RAID 6 over RAID 5 for two-drive fault tolerance on the long-life storage tier.
• —STP root-bridge priority intentionally assigned with explicit tiers across distribution and edge switches for deterministic failover.
• —Cloudflare API-token DDNS against the zone directly — eliminated reliance on third-party DDNS providers.
• —Nginx reverse proxy fronting multiple self-built web apps (GolfTracker, TrainingQuest, TodoList) with a catch-all default_server returning 444 to harden against unintended host headers.
• —WireGuard VPN with per-user configs, QR-code provisioning, and multi-user access — migrated from OpenVPN for better cellular performance and lower overhead.
• —DNS-level filtering via AdGuard Home (Docker on Synology) with Quad9 + Cloudflare DoH upstream; 2FA on Ubiquiti and DSM admin; UPnP disabled; hardened SSH.
• —Roadmap: VLAN segmentation (Trusted / IoT / Camera) with inter-VLAN firewall rules, UniFi Protect camera deployment, 10GbE direct NAS-to-workstation link, multi-site VPN to a secondary BC↔Mexico property.