Personal Engineering Portfolio
Building, breaking,
and fixing things
A collection of hands-on engineering work: self-hosted infrastructure, machine-learning experiments, and the troubleshooting notes that come with running real systems. Everything here is public-facing and harmless — no proprietary code, no sensitive data.
Things I've built
A collection of tools, builds, and systems — each with a full write-up. The highlights are here; the complete project repository has every one of them.
Browse the complete project repository —>
Every tool, build, and system I've documented, grouped by category, with full descriptions and source links.
Recipe Library
A self-hosted recipe collector. Shared social media recipe links (Instagram, TikTok, Facebook Reels, YouTube Shorts) are watched from an inbox, cleaned into structured recipes by a local LLM, scrubbed of personal data, and published as a searchable section here. Search by the ingredients you have on hand or filter by category.
Handwriting Recognition Pipeline
A multi-engine OCR system that combines several open-source recognition models (PaddleOCR, Surya, EasyOCR, TrOCR) into a consensus layer. When engines disagree, results are escalated to a heavier model for a second opinion. Includes a human-in-the-loop review step for ambiguous output.
AI Inference Sandbox
A hardened, unprivileged container environment for local open-weight models whose weights were never fully trusted. The inference server runs with zero Linux capabilities, a read-only model store, and no route off the local bridge — the host reaches the API at a static container IP, with no published ports at all. A twelve-point audit gate verifies the live container against the policy before any request is routed.
Docker silently disabled published ports on an internal network
An API configured as "loopback only" on an internal bridge didn't exist at all — Docker accepts the port mapping and never publishes it, and nothing says so. The real fix was dropping published ports entirely: the host reaches the container at its static bridge address, and the endpoint is host-local by construction.
Recursive Language Model HTR Layer
Wrapped the handwriting pipeline's correction stage in a Recursive Language Model (RLM) scaffold. Instead of correcting each page in isolation, the RLM loads an entire document's OCR output into a REPL environment, decomposes it into per-page sub-calls, and cross-references names, dates, and formatting across pages for consistent corrections. A second RLM stage performs document-level understanding — entity graphs, structure, and summaries — feeding the memory layer.
Self-Hosted Service Stack
A Docker Compose stack running a vector database, a graph-memory service, a private search engine, and a media server — all behind an encrypted mesh network. Everything is reachable only over WireGuard and Tailscale, with no ports exposed to the public internet.
Encrypted Mesh Networking
Set up a WireGuard hub-and-spoke mesh with split-tunnel clients, plus Tailscale as a fallback path. Documented the onboarding workflow so new machines can join the mesh in a few commands.
Local LLM Tooling
Set up local, CPU-only LLM inference with custom model configurations for different workloads — a general-purpose model, a long-context model, and a lightweight worker model. All running on commodity hardware.
Codebase Refactoring & Maintenance
Ran a systematic over-engineering audit across several Python projects. Deduplicated shared helpers, removed dead stub functions, consolidated repeated error-handling patterns into a single decorator, and dropped an unused dependency. Net result: ~200 fewer lines, same behavior, verified by clean imports and a full pipeline dry-run.
Document Search Wrapper
A Google-style search page over a self-hosted RAG stack — AnythingLLM with Qdrant for vectors and local Ollama for embeddings and answers. Documents are moved into a repository where an AI suggests a title, then the files are converted and ingested automatically. End users search plain English and get answers with cited sources.
Lab as Code (Terraform)
A slice of the lab server's operations expressed as code: a Terraform module (docker provider) manages a small, additive monitoring footprint — a dedicated network, a volume for stateful data, and an uptime dashboard — while the pre-existing compose-managed stack stays untouched. Reachable over the encrypted mesh only; no public IPs, no open ports.
Problems I've solved
Running real systems means hitting real problems. These are write-ups of issues I've debugged — the kind of notes I wish I'd had when I started.
Open the full troubleshooting log —>
Every problem, investigation, and fix — written up the way I'd have wanted them documented when I hit each one.
WireGuard full-tunnel hijacking the default route
Setting AllowedIPs = 0.0.0.0/0 on a client silently hijacked the default route and killed Tailscale connectivity. Fix: use split-tunnel (AllowedIPs = 10.10.0.0/24) so only the mesh subnet is routed.
OCR engines disagreeing on the same word
Different OCR engines produce different readings for the same handwriting. Solution: run multiple engines in parallel and only trust tokens where a majority agree. Escalate the rest to a heavier model for adjudication.
Port conflicts in a Docker stack
Two services wanted the same host port. Resolved by auditing docker ps for port bindings and reassigning one service to a free port, then updating the reverse-proxy config to match.
Hardening a headless server
Locked down a headless box: disabled password SSH auth, restricted root login, enabled fail2ban, and set a default-deny firewall that only allows trusted subnets and specific service ports.
Exposing a service without opening ports
Used a Cloudflare Tunnel to serve a website from a machine with no public IP and no open inbound ports. The tunnel makes an outbound connection to Cloudflare, which handles TLS and routing.
Running LLMs on CPU-only hardware
No GPU available, so inference runs on CPU. Learned to pick quantized models (Q4_K_M, Q2_K) and tune context windows to fit within available RAM while keeping latency acceptable.
Illegal instruction crash from a native vector DB module
AnythingLLM crashed with Illegal instruction (core dumped) on every embed — the default LanceDB native module uses AVX2, which a 2013 Xeon lacks. Switched to Qdrant (a separate HTTP service) and the crash disappeared.
Docker containers couldn't reach a host service
Containers timed out reaching Ollama on the host's own tunnel IP. The packet is routed as local (INPUT chain, not FORWARD), so Docker's FORWARD rules never applied — the fix was allowing the docker subnets through ufw.
Tools I work with
The technologies I reach for most often, across infrastructure, machine learning, and automation.
Infrastructure
Machine Learning
Languages & Tools
About this site
This is a personal portfolio documenting public-facing engineering work. It's a place to share code, troubleshooting notes, and lessons learned — nothing more.
What you'll find here
Public-facing code, general infrastructure write-ups, and troubleshooting notes. No proprietary code, no sensitive data, no business details.
What you won't find
No private infrastructure details, no credentials, no client or customer information, and nothing that could be used to compromise a system.