~> whoami

Ahmad Syamim (syamxm).

Final-year CS student at UiTM Shah Alam, DevSecOps specialisation. I self-host everything I ship — the code, the pipeline, and the server it runs on. Mostly because I want to know how it all actually works.

role student · devsecops host self-hosted / tailscale shell fish status all systems green

Projects

~> ls ~/projects # 7 dirs · sorted by importance
drwxr-xr-x BeanThere/ ★ flagship cd →

Coffee-shop platform in plain PHP — online ordering, loyalty tiers, and a drink recommender backed by a local Ollama model on a 4 GB GPU. CSRF tokens, rate limiting, and prepared statements throughout; every deploy gated by a six-gate DevSecOps pipeline.

php-8.2 mariadb local-llm csrf rate-limit trivy tailscale
# ci.yml — every push, fail-closed · gitleaks also runs a weekly full-history scan 
php -l    ✓ pass─┐
semgrep   ✓ pass─┼──▶ docker build ──▶ trivy fs + image ──▶ deploy
gitleaks  ✓ pass─┘    ✓ pass       ✓ pass           ✓ live
                                                                tailscale ssh — fires only when main is green
drwxr-xr-x taskflow/ cd →

MERN task manager with a security-gated CI/CD pipeline: five scanners (Semgrep SAST, Gitleaks secrets, and Trivy across SCA, image, and IaC) block deploy on HIGH or CRITICAL findings.

merngithub-actionssemgrepgitleakstrivyjwt
drwxr-xr-x homeserver-dashboard/ cd →

Grafana + Prometheus + Loki observability for the Debian homeserver — metrics, auth and fail2ban logs — behind Cloudflare Access (email OTP) with no published host port.

grafanaprometheuslokicloudflare-access
drwxr-xr-x student_reminder_system/ cd →

Flutter timetable + deadline reminders for UiTM students. Firebase, plus a FastAPI backend with bcrypt auth and Redis rate-limited login, Dockerised on the homeserver.

flutterfirebasefastapiredisbcrypt
drwxr-xr-x cipher-agent/ cd →

RSA spy game in a fake browser terminal — solo cipher missions plus a two-player one-time-pad channel. pytest suite, hardened non-root container.

fastapirsaotppytestnon-root
drwxr-xr-x cipher-forge/ cd →

Interactive RSA teaching game — prime selection through decryption, solved by hand stage by stage. React + FastAPI + MongoDB with JWT auth.

reactfastapimongodbjwt
drwxr-xr-x cv-api/ cd →

My CV as data — Node + Postgres REST API serving resume JSON. GitHub Actions deploys over Tailscale SSH; published through a Cloudflare Tunnel, zero open inbound ports.

nodeexpresspostgresgithub-actionstailscale

Security posture

~> cat security.txt # security posture — facts, not marketing
CSPdefault-src 'self' — no third-party origins, no inline eval
passwordsbcrypt — salted, work-factor tuned, never reversible
queriesprepared statements only — zero string-built SQL
SASTsemgrep gate — build fails on new findings
secretsgitleaks gate — no key reaches a commit
imagestrivy scan — deploy blocked on known CVEs
transportdeploys over Tailscale SSH; public traffic via Cloudflare Tunnel — zero open inbound ports
requestsCSRF tokens + per-route rate limiting on every mutating path

Contact

~> cat contact.txt

If you're building something similar or just want to talk shop, reach out.

email[email protected] githubgithub.com/syamxm projectsls ~/projects
~>
syamxm@homeserver — built by hand, deployed over tailscale 6/6 gates · fail-closed