Work

Things I’ve actually shipped.

Each one ran in production at some point. The format below is simple — the problem, what I did about it, and what came out the other end.

  • Confidential Computing

    IBM Confidential Computing — Contract Tooling

    contract-gocontract-cliterraform-provider-hpcrautomation-samples

    A Go SDK, a CLI, and a Terraform provider for generating signed and encrypted contracts for IBM Confidential Computing workloads.

    Problem

    Hand-rolling signature, attestation, and encryption for every contract is slow, error-prone, and impossible to scale across an enterprise team.

    What I did
    • Built contract-go, a Go SDK that handles signing, attestation, and encryption end-to-end.
    • Wrote contract-cli on top of it so platform teams can generate contracts without touching the cryptography.
    • Redesigned the Terraform provider against the SDK and the latest Terraform plugin framework.
    • Took the lead on contract-go, contract-cli, and terraform-provider-hpcr across the open source roadmap.
    Outcome
    • Adopted across every IBM Confidential Computing product line.
    • Recognised as IBM TCAP Significant Contributor in 2025.
    • Recognised as IBM TCAP Leader in 2026.
    Stack
    IBM Confidential ComputingOpenSSLGoTerraform Provider
    Read the story
  • Web

    Portfolio Website — Self-Hosted

    AppComposeTerraformSSL Generator

    An open source portfolio site I host myself — Python on the back, Docker Compose for the runtime, Terraform and Ansible for the cloud, and automated SSL.

    Problem

    Most engineers either skip a portfolio or rent one from a template host. I wanted something I could fully own — code, infrastructure, certificates, and all.

    What I did
    • Built the portfolio app in Python and packaged it for Docker Compose.
    • Wrote Terraform and Ansible to provision AWS, issue SSL certificates, and deploy the stack reproducibly.
    Outcome

    A fully self-hosted, open source portfolio that I can rebuild from scratch with a single pipeline run.

    Stack
    PythonDocker ComposeTerraformAnsibleAWSCloudflare
  • Hardware

    sash-pi — Lightweight OS for Raspberry Pi

    GitHub

    A stripped-down Debian image for the Raspberry Pi 4, with a custom kernel built only for what the board actually needs.

    Problem

    The default Pi images carry far more than most embedded use-cases need — slower boots, bigger images, more attack surface.

    What I did
    • Stripped the base image down to the kernel modules and userland the target hardware actually uses.
    • Compiled a custom kernel and verified boot reliability across Pi 4 revisions.
    Outcome

    A small, fast-booting OS — and a much sharper mental model of Linux from the bootloader up.

    Stack
    Linux KernelDebianARMBash
  • Hardware

    ATmega328P Production-Ready Board

    GitHub

    An Arduino-compatible PCB built for production — SMD/DIP, designed in EDA, brought up by hand.

    Problem

    Off-the-shelf dev boards are great for prototyping, but they're not laid out for a real production run.

    What I did
    • Designed the schematic and PCB layout in EDA, optimised for SMD assembly.
    • Brought up the first batch by hand and validated it against the reference design.
    Outcome

    A clean, manufacturable board — and a first-hand walk through the full path from idea to physical hardware.

    Stack
    PCB DesignATmega328PEmbeddedArduino