Projects

Line-card-style BFD offload for plain Linux, with the RFC 5880/5881 fast path in XDP.

• Parsing, liveness detection, and transmission run in the kernel, so a dead peer is still detected when userspace is fully starved of CPU.
• Under SCHED_FIFO stress that made FRR bfdd flap continuously with transmit gaps up to 960ms, the XDP path recorded 0 flaps and a 12.5ms maximum gap.
• Offloads sessions from an unmodified FRR bfdd over its distributed BFD dataplane protocol, so normal configuration and counters keep working.
• Dual-stack IPv4 and IPv6 on one shared session map, validated at the 64-session cap with a mixed 32 plus 32 family split.
• RFC 5880 echo mode with an XDP reflector, RFC 5883 multihop with per-session minimum TTL, GTSM TTL-255 enforcement, and your_disc demux validation.
• Every performance and correctness claim in the repository is backed by a packet capture.

A two-node Proxmox cluster running everything I use.

• Local ZFS on each node plus a shared multi-terabyte volume group on external block storage, reached over four independent iSCSI paths with ALUA multipathing, so guests can live migrate between nodes.
• OPNsense at the edge routes five separate segments with tagged VLANs on top, enforcing around 100 firewall rules and terminating WireGuard.
• One containerized NGINX reverse proxy fronts more than 30 services with per-service vhosts, TLS 1.2 and 1.3 only, and Let’s Encrypt certificates renewed through DNS validation.
• The proxy runs a custom NGINX build carrying the JWT authentication module I contribute to upstream, with geo and map blocks deciding per request whether authentication applies.
• Layered DNS: separate internal and public Pi-hole instances behind three dnsdist frontends, two DNS-over-HTTPS endpoints, DNS-over-TLS through stunnel, and unbound for recursive resolution.
• Around 25 workloads in production, including Matrix Synapse with coturn, a full Mailcow stack, Immich, Vaultwarden, Guacamole, and this site.

APNIC-funded dual-stack rollout across the NITK Surathkal campus network.

• Led a dual-stack rollout (SLAAC and DHCPv6) across campus VLANs, starting with production use in a hostel.
• Configured DHCPv6 snooping and IPv6 firewall rules to block unauthorized addresses and isolate internal networks.
• Diagnosed and mitigated rogue RA flooding using port-based RA filtering and strict ACLs.
• Resolved Android SLAAC and DNS failures by adjusting prefix allocation and RDNSS advertisements.

Deploys Dockerized apps into isolated staging environments straight from a Git URL.

• Dynamic subdomains with automated NGINX configuration per deployment.
• Support for volumes, environment variables, and auxiliary services such as Redis and Celery.
• Real-time log viewer, browser-based terminal, and lifecycle controls with scripting hooks.

Centralized JWT authentication gateway for NGINX, backed by Google OAuth 2.0.

• Secures internal dashboards and self-hosted services behind Google OAuth 2.0 and signed JWTs.
• Group-based access control, multiple JWT cookies, dynamic claims, and role-specific flows.
• Return-URL preservation, session persistence, and hardened cookie policies across subdomains.