IT consultant based in Berlin. Infrastructure, networking, automation, and the tools that make daily work faster — preferably from a terminal, preferably self-hosted, increasingly built together with a coding agent.

Two Colemak-DH layouts for small split boards, sharing one layer architecture: Tap-Dance Home Row Mods, Frequency+Strength symbol ranking, bilateral layer access, no lateral stretches, NEIO = ←↓↑→ on every directional layer. Both Vial/QMK.

• Cadence — 34-key Ferris Sweep, the daily driver and primary project. Tap-Dance carrier patterns on Spc/Tab solve the HRM-blocking issues that surface in conventional Miryoku-style layouts. Colemak-DH · Tap Dance HRM · International layer with direct umlaut Tap Dances · Code & CLI layer · Tiling WM layer · Firmware safety layer. 34 keys. Two thumbs less. Same rhythm.
• Cadenza (predecessor) — 36-key Corne Choc. The original layout that established the design philosophy: Colemak-DH base, Tap Dance HRM, Frequency+Strength symbol ranking. Kept available for users of 36-key Corne hardware.

• ifwatchdog — interface health watchdog for OpenWrt. Detects interfaces that stay administratively "up" but silently stall (interface-bound ping and/or WireGuard handshake age) and restarts them — with debounce, circuit breaker and protected networks. Ships with a LuCI app and a ~200-check regression harness that runs without a router. Born from a ProtonVPN tunnel behind CGNAT that went quiet for half an hour. Submitted upstream: packages#30593 · luci#9068
• fw4 multi-ipset — multiple ipset references per rule/redirect in the nftables firewall, plus the matching LuCI change. firewall4#109 · luci#9158

Segmented home network on an OpenWrt One (VLANs, AdGuard Home, WireGuard to a hardened Debian VPS), Home Assistant with a fully local voice pipeline (Whisper / Piper / openWakeWord, Zigbee via ZHA), and a Proxmox/Ceph lab next to an Ollama box for local LLM work. Documentation and scripts are being moved into public repos:

• home-networking — router, VLAN and hardening docs + scripts (in progress)
• vibecode-auditor — reproducible security-audit pipeline for Docker stacks: SBOM, dependency CVEs, container checks, SAST, secret scan (syft · grype · osv-scanner · trivy · hadolint · dockle · semgrep · gitleaks), orchestrated via Makefile. For checking agent-written code before it goes anywhere near production. (in progress)

• kompakt-tui — terminal UI for the Mudita Kompakt, the E-Ink phone that keeps me off the feed. Does from a shell what the stripped-down MuditaOS K leaves out.
• wristpull — pulls data from a Garmin fēnix and an Amazfit Helio Strap without touching either vendor's cloud (FIT files straight off the watch, Gadgetbridge's SQLite for the strap) and analyses it locally. (local for now)

• my-qubes — personal Qubes OS documentation, dom0 scripts and setup notes (incl. the Mirage firewall recipe)

All original work MIT licensed.

Interests: Linux · Wayland tiling (Niri) · self-hosted infrastructure · OpenWrt · Home Assistant · containerization · local LLMs · agentic workflows · privacy & security · GrapheneOS · QubesOS · mechanical keyboards · Colemak-DH · specialty coffee · running

Berlin, Germany