Projects

Hamnkapten

Sauna booking system I'm building for Killingsholmens Varv, the Gothenburg boatyard where I work. Guests book in a web app, and staff run the schedule, phone bookings and payments from a desktop or web admin. Closed source, in development.

Problem Statement

The boatyard's sauna bookings all went through the harbour captain, who wanted to stop handling them himself. I offered to build a system that takes the job off his hands.

Key Features

• Guests book three-hour sessions on a 15-minute grid in a Leptos web app that installs as a PWA
• Staff manage the schedule, enter phone bookings and mark Swish payments as paid, in a Slint desktop app or a web admin
• A PostgreSQL exclusion constraint makes double bookings impossible in the database itself
• Admin sign-in with Argon2id passwords and single-use TOTP codes, plus rate limits and lockout
• Hash-chained, insert-only audit log and live schedule updates over Server-Sent Events
• Operator CLI with GDPR data export and anonymisation per customer
• 14-crate Rust workspace around an axum API, with the booking rules in a crate that does no I/O
• 1,100+ tests, with integration tests against a throwaway PostgreSQL. CI runs clippy in pedantic mode with warnings as errors

Tech Stack

Constraint Engine

Closed-source constraint-satisfaction engine in Rust, with a web service in front. AC-3 propagation, MRV and LCV heuristics, and parallel backtracking over bitset domains. Median solve time cut from 42 seconds to 140 milliseconds, with 1,000+ tests.

Key Features

• AC-3 arc consistency with MRV variable ordering and LCV value ordering
• Bitset domains with an incremental undo trail, so backtracking restores only what it changed
• A second solver using min-conflicts local search
• Parallel search with rayon, where the first thread to find a solution wins
• A precomputed result pool answers in under 5 ms
• Median solve time on mid-size instances down from 42-67 s to about 140 ms, and on the largest from up to 70 s to 1-3 s
• Actix-web service with HTMX and SQLite, covered by Playwright end-to-end tests
• 1,000+ Rust tests. CI runs fmt, cargo audit, clippy, the tests and Playwright

Tech Stack

Raven Nest MCP

A pentesting toolkit that runs as an MCP server. It wraps 22 security tools behind a 6-layer safety architecture and gives AI assistants 46 MCP tools in total, with an opt-in Metasploit Framework integration, output sanitisation, and session-aware context budgeting for local AI models.

Key Features

• Wraps 22 security tools and exposes 46 MCP tools in total
• Recon and crawling: nmap, masscan, whatweb, httpx, subfinder, dnsx, dnsrecon, katana
• Vulnerability scanning and web fuzzing: nuclei, nikto, wpscan, dalfox, feroxbuster, ffuf
• Exploitation, cracking and enumeration: sqlmap, hydra, john, enum4linux-ng, netexec
• Secret scanning and TLS checks: gitleaks, trufflehog, testssl.sh
• Opt-in Metasploit Framework integration with its own safety gates: off by default, per-tool allowlist, module blocklist, a confirmation step before any exploit runs
• 6-layer safety: allowlist, input validation, preset args, timeouts, output sanitisation, quality assessment
• Session-aware context budget tracker with three modes for local AI models: full, compact and minimal
• Findings mapped to the OWASP Top 10, with reports in Markdown, JSON, SARIF and HTML
• Listed in the official MCP Registry and published as a container image on GitHub's registry
• 380+ unit and integration tests across the raven-core, raven-report and raven-server crates

Tech Stack

Raven Nest Client

TypeScript MCP client for the Raven Nest pentesting server. Communicates via JSON-RPC 2.0 over stdio, providing tool discovery, inspection, and execution through both an interactive REPL and one-shot CLI commands.

Key Features

• JSON-RPC 2.0 transport over stdio to the Rust MCP server and its 46 tools
• Interactive REPL with tab completion and persistent command history
• One-shot CLI mode for scripting and automation
• Typed wrappers for finding CRUD, scan management, and report generation
• 42 integration tests that run without Docker
• 70 E2E tests covering 36 of the server's tools against Juice Shop and bWAPP, plus file fixtures for the secret scanners
• Configurable server binary path and config via environment variables

Tech Stack

Linux Hardener

Automation for securing Linux systems. Scans for misconfigurations, applies hardening recommendations, maps findings to ten compliance frameworks, and rolls changes back safely. Ships as a CLI and a Tauri desktop app. Published on the Arch User Repository (AUR).

Problem Statement

Securing Linux systems requires expertise across kernel parameters, SSH, firewalls, PAM, and more. Manual hardening is error-prone and hard to reverse. Existing tools either cover only part of that or offer no safe rollback.

Solution Approach

Built a plugin-based hardening framework with checkpoint-based rollback using Ed25519-signed SQLite snapshots. Eight security plugins cover kernel hardening, SSH, firewalls (nftables/firewalld/ufw), PAM, services, auditd, file permissions, and MAC frameworks (SELinux/AppArmor).

Key Features

• Security scanning to identify configuration weaknesses
• Automated hardening with dry-run capabilities
• Checkpoint-based rollback with Ed25519-signed SQLite snapshots
• Hash-chain audit logging for tamper-evident change history
• Tested in containers on six distributions: Ubuntu, Debian, Fedora, RHEL, Arch and openSUSE
• Compliance reports against ten frameworks, including CIS Benchmarks
• CLI and Tauri desktop app. The Leptos front end also builds for the browser through Trunk, for interface work
• Scheduled scanning via systemd timers
• 2300+ Rust tests across the workspace (cargo nextest, 0 failed), plus the Playwright web, desktop and Node.js GUI suites
• Available on AUR for Arch Linux users

Security Plugins

Tech Stack

Hyprland Keybind Manager

GTK4 keybinding manager for Hyprland with conflict detection, security validation, and automatic backups. Published on the Arch User Repository (AUR).

Key Features

• Conflict detection for keybindings
• Security validation
• Automatic backup system
• GTK4-based user interface
• Available on AUR for Arch Linux users

Tech Stack

Security Toolkit

Problem Statement

Checking a password, hashing a file and scanning a few ports usually means three separate tools, or an online service you have to trust with the data. I wanted one offline binary that does all of it and explains its results.

Solution Approach

Built a command-line security toolkit in Rust. Everything runs offline in a single binary, and the output explains the "why" behind each result.

• Password strength checks through zxcvbn, with estimated crack times for online and offline attacks
• Password generator
• File hashing with SHA-256, SHA-512, SHA3-256 and MD5
• TCP port scanner with timeouts and common service names
• File analysis: type detection, Shannon entropy, and flags for secrets such as private keys, API keys and connection strings
• Output that explains the security concept behind each result

Tech Stack

System Monitor

Problem Statement

Wanted a real-time view of one machine without installing a metrics database and dashboard stack first. The usual monitoring tools are built for fleets of servers, not a single laptop or dev box.

Solution Approach

Developed a Rust-based system monitoring dashboard using Server-Sent Events (SSE) for real-time updates. The backend collects system metrics (CPU, memory, disk, network) and streams them to the frontend via SSE. HTMX handles dynamic updates without writing custom JavaScript.

• Server-Sent Events for efficient real-time streaming
• sysinfo crate for cross-platform system metrics
• HTMX for declarative real-time UI updates

Key Challenges

• SSE Connection Management: Handling clients that disconnect without leaking work. Each client gets its own async stream, so when the browser goes away, Actix drops the stream and its timer with it.
• Cross-Platform Metrics: Linux, macOS and Windows expose metrics through different APIs. The sysinfo crate hides those differences behind one interface.
• Update Frequency Balance: Updating too often wastes resources, too rarely shows stale data. Settled on one update per second.

Learning Outcomes

SSE fits this better than WebSockets. The data only flows one way, and the browser reconnects on its own. Collecting system metrics in Rust and managing the async tasks around them was the part I had to learn properly. HTMX then handled every live update, so there was no JavaScript framework to add.

Tech Stack

Rust Chess GUI

Desktop chess GUI and terminal CLI in Rust that play and analyse with Stockfish over UCI. Three crates keep the game rules, the engine client and the egui interface apart. Move generation comes from the chess crate and the search is Stockfish's, so there is no engine of its own.

Key Features

• Analysis draws up to five Stockfish lines as arrows on the board, with an evaluation bar, depth and node count
• Play Stockfish as either colour or watch it play itself, at full strength or held to an Elo from 1320 to 3190
• Move by click, drag or typed notation such as Nf3, with undo, redo and a move history you can click through
• Load and save PGN, read and copy FEN, and see the opening named with its ECO code from the Lichess table
• Optional clock with presets from 1+0 to 15+10, and draws by repetition, the fifty-move rule and insufficient material
• Async UCI client on Tokio in its own crate, which the GUI's engine thread drives with tagged requests

Tech Stack

Repository Exporter

Problem Statement

Reading or archiving a GitHub repository's source offline normally means cloning it and browsing file by file. I wanted the whole codebase as one readable document, for reviewing it or feeding it to other tools.

Solution Approach

Built a CLI tool that walks a repository through GitHub's REST API and exports every source file into a single Markdown document.

• GitHub REST API access with a personal access token, so private repos work too
• Accepts a GitHub URL, owner/repo, or an interactive prompt
• Skips binaries, build artefacts and commonly ignored paths
• Markdown output with fenced code blocks per file
• Clear errors when the GitHub API rate limit is hit

Tech Stack

BitNet Toy

A hand-rolled BitNet b1.58 implementation in pure Rust. Every component written from scratch as a learning exercise: tensor type with AVX-512/AVX2 SIMD matmul, tape-based autograd, ternary quantisation with straight-through estimator, transformer block (RMSNorm, multi-head attention with RoPE, SwiGLU FFN), training loop, KV-cached inference, and a CUDA back-end with cuBLAS int8 GEMM on tensor cores. No third-party ML dependencies.

Problem Statement

Wanted to genuinely understand BitNet b1.58 (ternary weights with INT8 activations, trained via straight-through estimator) by writing every layer from scratch in Rust with no third-party machine learning dependencies.

Solution Approach

Built a single-crate implementation: tensor + autograd + quantisers + transformer + training + inference + binary export, plus an optional CUDA back-end behind a feature flag for tensor-core int8 training.

Key Features

• Trains end-to-end on TinyShakespeare in 8-15 min on CPU. Best model so far reaches 2.28 bits per character on the complete works of Shakespeare
• Three on-disk formats: f32 with masters (lossless resume), ternary i8 (2.92x), base-3 packed (6.02x)
• Runtime-detected matmul: AVX-512 (16 f32/step), AVX2 (8 f32/step), scalar fallback; multi-threaded across output rows
• CUDA back-end via cudarc 0.19: cuBLAS sgemm + 9 hand-rolled NVRTC kernels + per-op trait abstraction
• Real BitNet ternary training on Ada tensor cores via cublasGemmEx int8 GEMM (cuBLAS_GEMM_DEFAULT_TENSOR_OP)
• KV-cached inference around 50 to 100 times faster per token than the full forward path
• 174 tests on the default build, 217 with --features cuda, and zero warnings on cargo build --release

Tech Stack

TV-Tabla

Desktop TV guide for Swedish television. Fetches programme schedules from tv24.se, caches them locally in SQLite, and presents them in a clean timeline grid. Designed for people who just want to see what's on: large text, simple navigation, no account required.

Key Features

• Now view: horizontal timeline grid with a live now-marker, channels as rows, programmes as time-proportional blocks
• Favourites: star programmes by title and see all upcoming airings across channels and days
• Week planner: browse schedules up to 5 weeks ahead, day by day per channel
• Offline-first: cached data displays instantly, background refresh keeps it current
• Multilingual UI: Swedish (default), English, Portuguese
• Channel management: toggle visibility and reorder to your preference
• Privacy-respecting: no accounts, no tracking, all data stays local

Tech Stack

Game Project

A 2D pixel-art game in Rust on the Bevy engine, in early development. Closed source, and quiet about the story until there is something to play.

Key Features

• Bevy 0.19, one plugin per domain, and a main.rs that only registers them
• Pixel-perfect rendering: the world draws to a small off-screen canvas that a second camera scales to the window
• Lighting in a custom WGSL post-process pass

Tech Stack

Lanner

Spotlight region video recorder for wlroots Wayland compositors. Draw a rectangle and record only that area: everything outside dims like a spotlight while you select, then the dim lifts to a single bright border so the rest of the screen stays usable while the region records. The overlay never appears in the recording.

Key Features

• Spotlight selection: every monitor dims with a live rubber-band rectangle and a true transparent hole
• Border-only recording: pointer and keyboard pass through, so the rest of the system stays usable
• Stop via on-overlay button or a global keybind toggle; Esc cancels before recording starts
• Records to crash-safe MKV through wf-recorder, finalised cleanly so the file is always playable
• Never films its own UI: dim, border, and control bar all sit outside the captured geometry
• Built and tested on Hyprland; designed for any wlroots compositor (Sway, river, Wayfire)

Tech Stack

Web Scraper

A Rust CLI tool for extracting page titles, links, headers, and meta tags from web pages. Supports an interactive prompt or scripted invocation via flags. Outputs plain text, JSON, or HTML.

Key Features

• Interactive URL prompt when no argument is supplied
• Extracts title, links (with duplicate detection), h1 to h6 headers, and meta tags (name, OpenGraph, http-equiv)
• Output formats: plain text, JSON, HTML
• Configurable delay flag for rate-limit respect
• Timeout handling and error recovery
• Installable globally via cargo install --path .

Tech Stack

Security-First Portfolio

Problem Statement

Most portfolio websites focus on aesthetics over security. I wanted mine to practise the security work I write about - and to document every measure openly so it can be reviewed.

Solution Approach

Built the site in Rust and Actix-web and applied the controls listed below from the start. Then I ran an eight-phase penetration test against it myself, first on a local build and then on the live site.

• JWT authentication with refresh token rotation
• Argon2id password hashing (OWASP recommended)
• 12 OWASP security headers (CSP, HSTS, COOP, etc.)
• Rate limiting with account lockout protection
• PostgreSQL through one least-privilege role, every query parameterised
• Request tracing with unique IDs for audit correlation

Tech Stack