Projects

BFD for plain Linux, with the fast path in XDP so timing holds when userspace is starved.

• Replies are sent from XDP by rewriting the peer’s own packet, so they keep going even when userspace gets no CPU at all.
• Under SCHED_FIFO stress that made FRR bfdd flap nonstop with 960ms gaps, xdp-bfd had 0 flaps and a 12.5ms worst gap.
• On bare metal, it held 1022 sessions with 0 flaps through the real-time stress that made stock bfdd flap 18,910 times, with the engine on a SCHED_DEADLINE reservation so no real-time priority can starve it.
• Works as the data plane for an unmodified FRR bfdd, so normal FRR config and show commands keep working.
• 1024 sessions by default and up to 8192, at 6.2% of a core for 4096 sessions with 0 flaps.
• IPv4 and IPv6, single-hop and multihop, echo, demand mode, and keyed SHA1 auth computed inside XDP.
• Hitless restarts and upgrades: the engine hands its sessions to a new process with 0 flaps across 1024 sessions. Ships as Debian and RPM packages that run without root.

A two-node Proxmox cluster running everything I use.

• Local ZFS on each node plus a shared multi-terabyte volume group on external block storage, reached over four independent iSCSI paths with ALUA multipathing, so guests can live migrate between nodes.
• OPNsense at the edge routes five separate segments with tagged VLANs on top, enforcing around 100 firewall rules and terminating WireGuard.
• One containerized NGINX reverse proxy fronts more than 30 services with per-service vhosts, TLS 1.2 and 1.3 only, and Let’s Encrypt certificates renewed through DNS validation.
• The proxy runs a custom NGINX build carrying the JWT authentication module I contribute to upstream, with geo and map blocks deciding per request whether authentication applies.
• Layered DNS: separate internal and public Pi-hole instances behind three dnsdist frontends, two DNS-over-HTTPS endpoints, DNS-over-TLS through stunnel, and unbound for recursive resolution.
• Around 25 workloads in production, including Matrix Synapse with coturn, a full Mailcow stack, Immich, Vaultwarden, Guacamole, and this site.

APNIC-funded dual-stack rollout across the NITK Surathkal campus network.

• Led a dual-stack rollout (SLAAC and DHCPv6) across campus VLANs, starting with production use in a hostel.
• Configured DHCPv6 snooping and IPv6 firewall rules to block unauthorized addresses and isolate internal networks.
• Diagnosed and mitigated rogue RA flooding using port-based RA filtering and strict ACLs.
• Resolved Android SLAAC and DNS failures by adjusting prefix allocation and RDNSS advertisements.

Deploys Dockerized apps into isolated staging environments straight from a Git URL.

• Dynamic subdomains with automated NGINX configuration per deployment.
• Support for volumes, environment variables, and auxiliary services such as Redis and Celery.
• Real-time log viewer, browser-based terminal, and lifecycle controls with scripting hooks.

Centralized JWT authentication gateway for NGINX, backed by Google OAuth 2.0.

• Secures internal dashboards and self-hosted services behind Google OAuth 2.0 and signed JWTs.
• Group-based access control, multiple JWT cookies, dynamic claims, and role-specific flows.
• Return-URL preservation, session persistence, and hardened cookie policies across subdomains.