Projects
Client work, rescues and the tools we run ourselves, on the same open, documented building blocks we offer you.
Work
AI · Sustainability
We rebuilt an abandoned low-code prototype as a self-hosted application. A rule engine rates a garment's supply chain on a traffic-light scale from Tier 4 to Tier 0, and every verdict cites its source. A local language model on our own GPUs writes the explanation, but may never change a rating.
Incident response · Microsoft 365
A partner's Microsoft 365 account started mailing phishing links to every contact. We proved from the mail headers that the account itself was taken over (not spoofed) and traced the lure chain. Sign-in logs over 24 hours and seven days showed that a neighbouring organisation, where someone had clicked, stayed clean. The owner got a step-by-step remediation plan, including the GDPR angle, the same afternoon.
Open instead of expensive · Network
Instead of costly enterprise gear and licences, the campus runs on MikroTik routers and switches. Every tenant gets its own isolated network with fair bandwidth (QoS), firewall separation and monitoring, and the whole configuration lives in Ansible, so a change is reviewed, repeatable and rolled out everywhere at once.
Open instead of expensive · Printing
Laptops without printer drivers (new ARM machines included) print to the shared office printer through our gateway. Every job lands in the right person's secure-print queue and is released with their card at the device. New people are onboarded in a small admin application; the shared guest login could finally be switched off.
Rescue · Monitoring
The network monitoring looked healthy, but a permissions mix-up after a migration had frozen 8,176 of 21,908 data files. We found the root cause, fixed it, recovered almost three years of history and brought eleven more servers under watch, in one session.
Incident response · Web
Their WordPress site was serving someone else's code. We took a forensic snapshot first, found the injected sideloaders and infected files, removed them and brought the site back clean, and kept the evidence, so the question “how did they get in?” still has an answer.
Open instead of expensive · Signage
Proprietary signage players and their subscriptions replaced by Raspberry Pis behind every screen. A small manager we built (FastHTML) handles it all: drag and drop what is live, keep an archive, images resized automatically. Every display just opens one URL.
In progress · Meeting rooms
We are building e-paper displays (TRMNL) beside each meeting room that show today's reservations at a glance, plus an easy NFC reader on site: tap your card, and the room is yours for an ad-hoc meeting, booked straight into the calendar.
Showcase · Screw ID
Which screw is this? A guided tool for the workshop: no camera, no training data. A few taps or a caliper, and the bin label prints on the spot.
Choose head and drive from pictures: tap, tap.
Usually two caliper measurements are enough; the tool only asks what narrows it down.
20 screw families by DIN/EN standard; the match comes with its norm and size.
The bin label prints straight from the browser on a receipt printer, from phone or desktop.
No app store, no account: it runs in the browser.
Our own tooling
Our own operation runs on tools we built ourselves, on the same platform our clients get.
Twenty years of mail, notes and documents in one searchable brain. Answers come with sources, and it runs entirely on our own GPUs.
Reverse proxy and tunnels with single sign-on (Pangolin): puts any self-hosted application online without opening a port in your firewall.
A personal briefing (calendar, tasks, weather) printed on a receipt printer at six every morning. Facts are checked before a language model may phrase them.
Around a hundred heartbeats across clusters, storage, services and remote sites. Silence becomes an alert.
One front door for every alert and event: inspect, replay, route to chat, applications and logs, and it watches itself.
Bitwarden-compatible and self-hosted, with encrypted off-site backups and a separate inbox where automations store secrets without seeing anyone's vault.
Our own remote-support infrastructure (RustDesk): no third-party relay in the middle of a support session.
Our own command-line tools for hosting, git and logs: deploying or diagnosing an application is one scripted step.
A whole exam curriculum modelled as a dependency graph: the application tells you what to train next. In German and English.
Any video channel as a private podcast feed: normalised audio, chapters, a player that remembers where you were.
A store-and-forward proxy so logs survive flaky networks without losing a line.
Also on the menu
Licences as a Microsoft CSP partner, tenant setup, security hardening and day-to-day care.
Getting data from software A to application B, without a vendor lock-in.
Devices installed, updated and looked after remotely, with a real person to call.