A portfolio of projects at their actual stage. Not everything is a public product, and nothing is presented as complete unless it is complete.
Active MVP
Sindri
A self-hosted script catalog with AI generation, a sandbox, and remote execution.
Problem
Scripts and automation tools on homelab servers tend to scatter across dozens of folders over time, with no real overview, description, or change history.
Solution
Sindri catalogs scripts with full-text search that includes content, optional AI generation/review, isolated sandbox testing, and remote execution over SSH.
What this proves
Security thinking — sandboxing, isolation, and controlled remote code execution.
Main capabilities
full-text search across script content, import from the filesystem and remote machines over SSH, optional AI generation and review, isolated sandbox testing, content history with rollback, ~119 built-in scripts and reference cheatsheets, Slovak and English
Current status
Actively used self-hosted tool with source code public on GitHub.
Self-hosted
FastAPI
React
SQLite
Docker
Technology and architecture: Self-hosted, FastAPI, React, SQLite, Docker.
A Galaxy S20 Ultra turned into a full Linux/pentesting handheld — a custom kernel port and native Android desktop mode.
Problem
This phone (Exynos S20 Ultra, z3s) has no official NetHunter support, and the only older community kernel for this chip is from 2023, targets Android 13, and is only partially functional — a working kernel for the current LineageOS 23/Android 16 branch was missing.
Solution
A custom kernel port with fixed Bluetooth/USB/networking bugs, a native Kali NetHunter chroot, and a working native Android desktop mode on an external monitor — not Samsung DeX, actual AOSP windowing.
What this proves
Kernel-level Linux/Android engineering with no existing documentation to lean on — cross-compilation, boot image patching, SELinux/Magisk, blind systems diagnostics.
Main capabilities
custom kernel with fixed BT/USB/NCM bugs, native Kali chroot with SSH access, Android desktop mode on an external monitor, permanent USB HID/ADB/serial gadget, a complete field manual
Current status
Actively used personal handheld, source code and build environment public on GitHub.
Linux kernel
Android
NetHunter
Reverse engineering
Technology and architecture: Linux kernel, Android, NetHunter, Reverse engineering.
Remote sudo approval over WebAuthn/FIDO2 — a physical key, Face ID, or Touch ID instead of a TOTP code.
Problem
Approving sudo remotely (from an iPad/iPhone) usually means reading and typing a TOTP code by hand. Commercial SSH clients with FIDO2 agent-forwarding support are either paid or not reliably documented for this.
Solution
A self-hosted WebAuthn backend that Safari on iOS/iPadOS can talk to natively — no app, no subscription. A push notification with a direct link starts the WebAuthn ceremony automatically on open; a PAM script on the server waits for approval and always falls back to TOTP on any failure or timeout.
What this proves
Working with WebAuthn/FIDO2 cryptography, PAM integration, and security tradeoffs (graceful fallback, authenticating the registration endpoint itself) instead of a weaker bearer-token approach.
Main capabilities
approve via physical FIDO2 key, Face ID, or Touch ID, push notification with a direct link via ntfy, PAM sufficient/fallback to TOTP on any failure, no app or subscription — plain WebAuthn in Safari
Current status
Actively used across two machines in the homelab, source code public on GitHub.
FastAPI
python-fido2
WebAuthn
PAM
Docker
Technology and architecture: FastAPI, python-fido2, WebAuthn, PAM, Docker.
