I build and run things end to end: backends, bots, and the servers they live on. Right now I'm deep in TradeProwl, a full-stack trading platform, and I've spent years building plugins, addons, and core systems for the Minecraft server ecosystem under Void-Realms.
📈 TradeProwl (private) Full-stack trading & investing platform: a FastAPI web app, Discord bot, and background worker sharing one Python codebase. AI-assisted trade suggestions, autonomous paper trading, brokerage sync via Plaid, insider-trading disclosures, price alerts, and more.
⭐ VoidLeveling (Minecraft plugin, private) Player leveling/skill progression system.
💎 VoidGems (Minecraft plugin, private) Gem-based economy/currency plugin.
🌀 VoidWarps (Minecraft plugin, private) Warp and teleportation management plugin.
Everything I build runs on a Minisforum MS-A2 mini PC packed with 128GB of RAM, running Proxmox VE: over 20 LXC containers plus a dedicated mail VM, each one running a single service instead of piling everything onto one box, organized under a consistent internal naming and numbering scheme so the layout stays readable without a separate inventory doc.
Networking: the LAN runs on a TP-Link Omada SDN stack (a 10G core switch feeding a 2.5G switch, a WiFi 7 access point, and a dedicated gateway router), all managed from a self-hosted Omada controller rather than the cloud-hosted version. The gateway runs dual WAN, a primary 5Gbps connection with a 5G cellular line as automatic backup, so the house stays online if the primary ISP drops. Nginx Proxy Manager sits in front of every internal service and handles Let's Encrypt certs, with Cloudflare handling DNS. Outbound traffic can route through a self-hosted WireGuard tunnel to a VPN provider, with automatic port-forward renewal so the tunnel repairs itself if the upstream server rotates. AdGuard Home handles DNS resolution and ad blocking for every device on the network. The WiFi 7 AP runs Multi-Link Operation across bands, with Protected Management Frames tuned per SSID, mandatory on the MLO network and optional where older devices need to connect, so legacy clients keep working without weakening security on the network that supports them. I've chased down and fixed real throughput issues on the 10G backbone (turned out to be a flow control setting, not a bad switch) rather than just throwing hardware at it.
Storage: two 2TB NVMe drives in a ZFS mirror for the boot/services tier, with scrubs running on a schedule, plus a QNAP NAS over NFS for bulk media. The whole rack sits behind a UPS so short outages don't take anything down.
Mail: a full self-hosted mail server (mailcow, running as its own VM) handling real inbound and outbound mail for my domains, including routing the Proxmox host's own system mail through it over authenticated SMTP, untangling SASL auth, TLS, and spam-reputation scoring across the stack to get it working end to end.
Media stack: Jellyfin plus the full *arr suite (Radarr, Sonarr, Lidarr, Prowlarr, Bazarr, and a custom Sonarr fork for sports content), each running as its own container. Several of these import files as root with no shared permission model between them, so I automated per-app ownership and permission fixes through each one's own API or database rather than patching it by hand every time.
Monitoring and alerting: a Grafana and InfluxDB stack tracks time-series metrics across the host and containers for long-term trend visibility, backed by a set of Python watchers on top of systemd timers that push real-time events to Discord: container and VM state changes, CPU/memory/storage thresholds, uptime checks across every public-facing domain, ZFS pool health, and SSL certificate expiry. On top of that there's a layered update-checking pipeline that watches for new packages and app versions across the Proxmox host itself, every container's OS packages, individual app versions, and the mail VM, all notify-only so nothing updates itself without me approving it first.
Resilience: my own apps have boot-order retry logic built in, since a database or cache container isn't guaranteed to finish booting before the service that depends on it does after a host reboot. Between the UPS, dual WAN, mirrored ZFS, self-healing VPN tunnel, and the monitoring stack watching all of it, the goal is that no single failure takes the whole thing down.
Security: administrative access is SSH key based, firewall rules at the network edge keep every internal service off the open internet by default, and nothing gets a direct port-forward, only what's explicitly reverse-proxied is reachable from outside. Containers run unprivileged with UID and GID remapping so root inside a container isn't root on the host, even for nested Docker workloads. The NAS mount respects proper NFS trust boundaries instead of just disabling them, and file ownership across the media stack is handled through least-privilege automation rather than broad permissions.
Languages
Backend & bots
Minecraft server dev
Databases & infra
Networking & ops
AI / ML
