~> whoami

Ahmad Syamim (syamxm).

Final-year CS student at UiTM Shah Alam, DevSecOps specialisation. I self-host everything I ship — the code, the pipeline, and the server it runs on. Mostly because I want to know how it all actually works.

role student · devsecops host self-hosted / tailscale shell fish status all systems green

Projects

~> ls ~/projects # 7 dirs · sorted by importance
drwxr-xr-x BeanThere/ ★ flagship cd →

Coffee-shop platform in plain PHP — online ordering, loyalty tiers, and a drink recommender backed by a local Ollama model on a 4 GB GPU. CSRF tokens, rate limiting, and prepared statements throughout; every deploy gated by a six-gate DevSecOps pipeline.

php-8.2 mariadb local-llm csrf rate-limit trivy tailscale
# ci.yml — every push, fail-closed · gitleaks also runs a weekly full-history scan 
php -l    ✓ pass─┐
semgrep   ✓ pass─┼──▶ docker build ──▶ trivy fs + image ──▶ deploy
gitleaks  ✓ pass─┘    ✓ pass       ✓ pass           ✓ live
                                                                tailscale ssh — fires only when main is green
drwxr-xr-x taskflow/ cd →

MERN task manager with a security-gated CI/CD pipeline: five scanners (Semgrep SAST, Gitleaks secrets, and Trivy across SCA, image, and IaC) block deploy on HIGH or CRITICAL findings.

merngithub-actionssemgrepgitleakstrivyjwt
drwxr-xr-x homeserver-dashboard/ cd →

Grafana + Prometheus + Loki observability for the Debian homeserver — metrics, auth and fail2ban logs — behind Cloudflare Access (email OTP) with no published host port.

grafanaprometheuslokicloudflare-access
drwxr-xr-x student_reminder_system/ cd →

Flutter timetable + deadline reminders for UiTM students. Firebase, plus a FastAPI backend with bcrypt auth and Redis rate-limited login, Dockerised on the homeserver.

flutterfirebasefastapiredisbcrypt
drwxr-xr-x cipher-agent/ cd →

RSA spy game in a fake browser terminal — solo cipher missions plus a two-player one-time-pad channel. pytest suite, hardened non-root container.

fastapirsaotppytestnon-root
drwxr-xr-x cipher-forge/ cd →

Interactive RSA teaching game — prime selection through decryption, solved by hand stage by stage. React + FastAPI + MongoDB with JWT auth.

reactfastapimongodbjwt
drwxr-xr-x cv-api/ cd →

My CV as data — Node + Postgres REST API serving resume JSON. GitHub Actions deploys over Tailscale SSH; published through a Cloudflare Tunnel, zero open inbound ports.

nodeexpresspostgresgithub-actionstailscale

Stack

~> skills ps --all # 42 units · depth = how much of the stack leans on it
infra/6 units
dockerrunning7 projects
debian 13runningevery service
nginxrunningreverse proxy
cloudflare tunnelrunning6 public hosts
tailscalerunning4 projects
bashrunningops scripts
ci-cd/4 units
github actionspassing4 pipelines
gitclean7 projects
docker composerunning7 projects
ssh deployover tailscale4 pipelines
security/9 units
gitleaksgate ok3 pipelines
semgrepgate ok2 pipelines
trivygate ok2 pipelines
ufwenforcinghomeserver
fail2banenforcinghomeserver
crowdsecenforcinghomeserver
jwt + bcryptenforcing4 projects
csrf + rate limitenforcing3 projects
nmapon demandrecon labs
observability/4 units
prometheusscrapinghomeserver
grafanarunninghomeserver
lokiingestingauth + fail2ban logs
umamirunningsyamxm.com
backend/7 units
fastapilistening3 projects
node + expresslistening2 projects
rest api designshipped5 projects
postgresqlrunningcv-api
mongodbrunning2 projects
mariadbrunningbeanthere
redisrunningrate-limited login
frontend/5 units
reactbuilt2 projects
vanilla js + cssbuiltthis site
tailwind cssbuilt2 projects
fluttershippedstudent reminder
android · kotlinbuildingfinal year project
languages/7 units
javascriptfluent4 projects
pythonfluent3 projects
sqlfluent4 projects
bashfluentops scripts
phpworkingbeanthere
javaworkingenigma-java
kotlin · dartworking2 mobile apps

Security posture

~> cat security.txt # security posture — facts, not marketing
CSPdefault-src 'self' — no third-party origins, no inline eval
passwordsbcrypt — salted, work-factor tuned, never reversible
queriesprepared statements only — zero string-built SQL
SASTsemgrep gate — build fails on new findings
secretsgitleaks gate — no key reaches a commit
imagestrivy scan — deploy blocked on known CVEs
transportdeploys over Tailscale SSH; public traffic via Cloudflare Tunnel — zero open inbound ports
requestsCSRF tokens + per-route rate limiting on every mutating path

Contact

~> cat contact.txt

If you're building something similar or just want to talk shop, reach out.

email[email protected] githubgithub.com/syamxm projectsls ~/projects
~>
syamxm@homeserver — built by hand, deployed over tailscale 6/6 gates · fail-closed