Projects
Open-source tools, automation scripts, and technical documentation. Professional projects built at Twingate, and personal projects for my homelab and infrastructure.
Professional Projects
Twingate Assistant
Claude Code plugin that embeds Twingate ZTNA expertise into the IDE - 10 context-aware skills and 5 end-to-end agents covering architecture, connector deployment, identity integration, and multi-cloud IaC generation. Published under Twingate-Solutions.
MDM Connector
Middleware that automatically marks devices as trusted in Twingate by cross-referencing 10 MDM/EDR providers (NinjaOne, Sophos, JumpCloud, etc.) on a configurable schedule.
Fleet Commander
Containerized control plane that automatically provisions, auto-scales, and self-heals a fleet of Twingate Connectors across Docker, AWS ECS, or Azure - minting tokens dynamically with no pre-configured seed connectors. Published under Twingate-Solutions.
Gatorcast
Self-hosted service that captures, reassembles, and replays privileged session recordings from Twingate Identity Firewall Gateways, with pattern-based threat detection and fully air-gapped, on-premises storage. Published under Twingate-Solutions.
Custom Connector Container
Custom Docker image wrapping the Twingate Linux Connector with shell access, a pluggable health check framework, and structured JSON resource metrics for log aggregation.
Custom Client Container
Custom Docker image extending the Twingate headless client with shell access, utilities, and a pluggable health check framework. Forked by Twingate's official Solutions org.
IdP Migrator
Desktop GUI tool for migrating group-to-resource access mappings when switching identity providers, with fuzzy matching, mandatory dry run, and one-click rollback.
Headless Client Gateway
Script that configures a Linux host as a network gateway, routing IoT device traffic through a Twingate headless client for zero trust access without per-device agents.
Windows Client Installer
PowerShell script for deploying the Twingate client across Windows fleets via MDM, with prerequisites checking, scheduled updates, and notification support.
macOS Client Installer
Bash deployment script for pushing the Twingate standalone client to macOS devices via MDM, mirroring the Windows installer feature set.
Hyper-V Connector
PowerShell automation that provisions Ubuntu 24.04 VMs on Hyper-V via cloud-init, creates Twingate connector records through the API, and manages the full Deploy/Remove/Update lifecycle - for Windows-only environments without Linux infrastructure.
Janus Updater Service
Label-driven Docker container updater that watches running containers, pulls updated images on schedule, and safely recreates containers in-place with automatic rollback on failure.
Wayfinder
Location-aware routing service that automatically switches Twingate users between office-LAN and remote-connector paths based on where they are, pairing an unprivileged PowerShell signal agent with a single token-holding FastAPI service. Published under Twingate-Solutions.
Technical Documentation
Deploying Twingate on Proxmox
Step-by-step guide for deploying a Twingate connector in a Proxmox LXC container.
Headless Client Gateway for IoT
Companion guide for the IoT headless client script with use cases, architecture, and deployment instructions.
SaaS Application Gating
Guides on combining Twingate with enterprise identity providers (Okta, Entra ID, JumpCloud) to protect public SaaS applications.
Local Peer-to-Peer Best Practices
Network design best practices for protecting local resources with Twingate in office environments.
Evaluating Twingate Performance
Testing methodology for validating Twingate deployments with performance comparisons against open-source VPN services.
Twingate Troubleshooting Guides
Collection of troubleshooting guides covering common Twingate deployment and connectivity issues, diagnostic steps, and resolution workflows.
Stolen Keys, Locked Doors: The LiteLLM Supply Chain Attack
Analysis of the March 2026 LiteLLM supply chain attack, examining how least-privilege access, identity-aware policies, outbound-only architecture, and audit visibility can limit damage when credentials are compromised.
Personal Projects
ROMulus
Cross-console ROM library manager - scans, identifies, enriches with metadata and cover art, organizes, and syncs collections to Anbernic, Batocera, MiSTer, Analogue Pocket, RetroPie, muOS, Onion OS, and ES-DE.
Twingate Linux GUI
PyQt6 system tray application that wraps the official Twingate Linux CLI - connection management, resource listing, account switching, and exit node routing for desktop Linux users on KDE, GNOME, Cinnamon, and XFCE.
Container Watcher
Python service running in Docker that monitors and automatically restarts other containers on a configurable schedule, solving intermittent container failures.
Container Health Watcher
Stateless Python service that watches Docker health status and automatically restarts unhealthy containers after a configurable grace period - opt-in via labels, no database. The health-driven successor to Container Watcher.
Price Tracker
Self-hosted price monitor that fingerprints a product page's price and rechecks it daily, using a layered 8-stage fetch chain and 6-stage extraction chain to get past bot protection and varied markup. HTMX dashboard, local SQLite history.
Jellifinflix
Dockerized Jellyfin media library maintenance framework - drop custom scripts into a scripts.d folder to automate cleanup tasks like subtitle removal, empty folder handling, and file renaming.
RSS Aggregator
Lightweight self-hosted service that pulls multiple RSS feeds, applies keyword and regex filters, deduplicates, and serves a unified RSS 2.0 feed over HTTP with a built-in status page.
Email to SMS Gateway
Python service that checks a mailbox via POP3 and converts incoming emails to SMS alerts, with keyword-based routing to different endpoints.
Proxmox Shutdown Script
UPS-triggered shutdown script for Proxmox that intelligently suspends or shuts down VMs and containers based on tags, with multi-pass safety.
Linux Backup Script
Simple dd-based backup script that snapshots a Linux partition to a remote NFS share with rotation and mount checking.
Discord Jailer
Discord bot that times out users with an annoying twist - briefly releases them at random intervals before re-jailing them until the timer expires.
sphexi.com v1
The previous version of this site - a single-page application that loaded Markdown files via base64-encoded URL parameters and converted them to HTML client-side using custom JavaScript. Ran as the main site for several years.