Scripts, tooling, experiments and implementation patterns that turn architecture and operational requirements into repeatable engineering.
Current implementation write-up
Turning an undocumented Raspberry Pi media box into something that can be rebuilt from a written kit: a full configuration survey, systemd-managed networking with a fail-closed tunnel, and a verification checklist that tests the failure path.
Current and completed work
Four scheduled agent runs that read a calendar, mailbox, chat workspace and ticket system and write structured sections into two Obsidian vaults — governed by one rules file, a read-only tool allowlist, and capture routes from laptop, phone and paper.
A Cloudflare Worker that turns an Access denial into a support-friendly diagnostic page with identity, device, posture, WARP, network and recent-access context.
A Cloudflare Worker that provides a narrow, Access-protected workflow for validated Gateway allow-list changes with DNS/HTTP targeting and Workers KV backup.
A Terraform project that consumes remote domain feeds, normalizes them into Cloudflare Zero Trust lists and builds a Gateway DNS blocking policy from the generated data.
A Cloudflare Worker that enriches Gateway blocks with rule names, request category, user, device, Cloudflare One Client addresses and support correlation data.
A Terraform-managed Zero Trust engineering lab spanning AWS, Azure and Google Cloud with Cloudflare Access, Gateway, WARP routing, device posture and optional Worker integrations.
An Access External Evaluation Worker that uses D1-backed training state to require mandatory training completion before protected applications can be opened.
An end-to-end learning project covering a minimal Node.js service, containerisation, local testing, registry publishing, managed deployment and GitLab CI/CD automation.
