Infrastructure, maintained in public.

Immutable webmail for Stalwart

Mail, calendars, contacts, files and Sieve filters in one client that speaks only JMAP — no IMAP, no SMTP, no database of its own. With IMMUTABLE=1 the container has no writable filesystem either, so there is nothing on the client side to back up.

TypeScriptJMAPAGPL-3.0

Site (opens in a new tab)Docs (opens in a new tab)Source (opens in a new tab)

Kubernetes-native log aggregation

Open-core observability built to match Splunk on capability and beat it on cost-per-GB, with multi-tenant RBAC that is honest about what it isolates. AGPLv3 throughout, enterprise directory included — there is no feature gate.

GoKubernetesAGPL-3.0

Site (opens in a new tab)Source (opens in a new tab)

In-place Stalwart upgrades

Takes a Stalwart Mail Server from 0.15.5 to current without data loss, checkpointing every step so an interrupted run resumes rather than restarts. Go, standard library only. It has moved a live nine-domain server with eight seconds of downtime.

GoGPL-3.0

Source (opens in a new tab)

Bash for the jobs that recur

Fifteen distribution-agnostic scripts for backups, logs, monitoring, users, services and updates, using only base utilities. Everything destructive takes --dry-run and confirms first — and with no terminal to ask on it refuses rather than guessing, which is what makes them safe in cron.

BashShellCheckGPL-3.0

Source (opens in a new tab)

Ubuntu to Mint, in place

Adds the Mint repositories and desktop to a running Ubuntu system, then prunes what GNOME left behind — in that order, because pruning before you have booted a working Mint session is how you end up with no desktop at all. Best-effort and high-risk by design: it is for admins who know what repo pinning is.

BashGPL-3.0

Source (opens in a new tab)