Decoupled web application UI rendering from heavy CPU-bound tasks by building an asynchronous message bus system. Web nodes drop JSON payloads into a Redis queue, which are consumed by stateless, highly isolated C++ compute nodes. Processing occurs entirely in-memory via Linux RAM-disks (/dev/shm) and integrates directly with MinIO object storage, ensuring maximum read/write speeds with zero SSD wear and tear.
Developed and deployed a full-stack web application for the Wanyamapori Sanctuary. Integrated responsive frontend UI components using HTML, CSS, and React with a backend Python/Flask architecture. Managed the deployment pipeline and version control entirely through GitHub, demonstrating end-to-end development capabilities.
+1
AZURE AD | INTUNE | FORTICLIENT | JIRA | LANSWEEPER
Coordinated large-scale enterprise infrastructure initiatives, including the deployment and troubleshooting of secure VPN architectures. Executed critical VLAN security enhancements and managed endpoint lifecycles using Microsoft Intune and Azure Active Directory. Handled systematic PC replacements and automated ticket resolution workflows using JIRA.
Conducted in-office testing of complex network topologies to develop customized client solutions. Spearheaded the implementation of VMware virtualized environments, backup systems, and rigorous VLAN configurations. Bridged the gap between theory and real-world application by hosting practical networking labs for peers. Managed IT asset deployment and inventory tracking to optimize hardware resource allocation.
Architected a continuous integration and deployment (CI/CD) factory utilizing Gitea and Docker runners to build and push images to a private registry. Engineered reproducible, isolated developer workspaces via Coder and Terraform, dynamically injecting ephemeral, cryptographically secure secrets. Automated the end-to-end build lifecycle utilizing Bash scripting and Linux server management, achieving near-zero downtime deployments for stateless containers.
Unified operations dashboard evolving from the original Kadere observer into a full command-and-control surface. Network plane controls provide real-time visibility into mesh VPN topology and encrypted tunnel health. Intrusion detection feeds aggregate into a single threat timeline with one-click response actions. Architecture Decision Records (ADRs) drive every major change, ensuring the system evolves deliberately rather than reactively. Designed to coordinate across all RedCup products from a single pane of glass.
Content delivery API with a C++ compute backend for heavy media processing. Tiered caching across browser, application, and CDN layers reduces database queries by approximately 95%. Uploads queue to background workers where libvips handles image optimization and FFmpeg produces HLS-segmented video for adaptive bitrate streaming. Media streams directly from object storage to the client — the API never writes intermediate files to disk, keeping the application server stateless and memory-efficient.
Fully self-hosted CI/CD pipeline with zero external dependencies. Two-stage workflow: build on push (with BuildKit inline cache layers for sub-minute rebuilds), deploy on version tag via SSH. Runners stay dormant until repositories explicitly opt in with a workflow file. Production targets remain stateless — they pull containers from a private registry and never hold source code. The entire software delivery chain, from source control through container registry to deployment, runs on owned infrastructure.
Zero-trust mesh networking across distributed infrastructure. WireGuard encrypted tunnels provide node-to-node connectivity — no port forwarding, no dynamic DNS, no traffic through third-party relay servers. An identity-aware reverse proxy enforces SSO/OIDC authentication before any request reaches an application. CoreDNS handles internal service discovery with split-horizon resolution. Self-hosted remote desktop relay keeps interactive sessions fully private.
Symmetric encryption utility for directory-level file protection. Toggle operation: run once to encrypt, run again to decrypt. Auto-generates keys, detects encryption state, and protects its own key files from recursive encryption. Built for quick field use on sensitive directories where full-disk encryption is impractical.
Distributed infrastructure defined as code across four layers: gateway (reverse proxy with WAF and automatic TLS), application (event-sourced CMS with webhook-driven cache invalidation), data (relational database plus S3-compatible object storage), and observability (centralized logging, metrics collection, and alerting pipelines). Zero-trust access control via mesh VPN identity verification — no services are directly exposed to the public internet.
Ten-plane adversarial defense system that treats security as a living organism rather than a perimeter. Network, Control, Data, Application, Compute, Build, Bot, Security Operations, ML Pipeline, and Ops planes compose into layered defense-in-depth. The Bot plane runs red-team and blue-team agents driven by YAML profiles — attack scripts probe for weaknesses while defensive agents learn to detect and block them. An ML pipeline trains classifiers on behavioral signals (mouse dynamics, keystroke cadence, motor control jerk) to distinguish human users from automated traffic. Built on the philosophy of 'attack first, train from that.'
Shared microservice providing a two-token economic model across the entire RedCup ecosystem. A double-entry ledger ensures every token movement is an immutable debit-credit pair — balances are derived, never stored directly. Reputation tokens are soulbound (non-transferable, earned through contribution) while utility tokens are transferable between members. Three-layer architecture: Truth (immutable ledger), Policy (configurable rules engine), and Operations (human intervention for disputes and edge cases). Designed with negative programming — adversarial scenarios are the primary test suite.
Can scarcity pressure reveal bots? A behavioral biometrics platform that exploits cognitive load differences between humans and automated agents under time-limited auction conditions.
Dutch Auction endpoints create artificial scarcity, inducing cognitive load that exposes behavioral divergence between human users and bots. Three signal families drive classification: mouse dynamics (Fitts's Law compliance, overshoot correction), keystroke timing (digraph inter-key intervals), and motor control jerk (third-derivative smoothness of cursor paths). A Random Forest classifier trained on 47 features achieves strong human-bot separation without CAPTCHAs or explicit challenges. All signal processing is in-session — raw behavioral data is never stored as PII. FADP-compliant by design.
Behavioral BiometricsDutch AuctionFitts's LawShannon EntropyMotor Control JerkRandom ForestFADP
DOMAINCybersecurity
METHODML Classification
SIGNALS47 Features
STATUSActive
PLATFORM ENGINEERING
DSR ARTIFACT
REDCUP COOPERATIVE PLATFORM
A Design Science Research artifact: full-stack cooperative platform investigating fair-trade models for creative economies in East Africa.
RedCup is a 20-member creative cooperative built on entirely self-hosted infrastructure. The platform (Next.js 16, TypeScript, Tailwind) integrates a C++ media processing engine, event-sourced CMS, and a two-token economic model (soulbound reputation + transferable utility tokens on a double-entry ledger). Multiple products serve distinct markets: a music platform, a football scouting network, and community commerce tools. The entire ecosystem deploys through a sovereign GitOps pipeline with zero external CI/CD dependencies. As a DSR artifact, the platform tests the thesis that cooperative ownership structures can resist the extraction patterns documented in East African digital economies.
Design Science ResearchCooperative PlatformToken EconomicsSelf-HostedGitOpsEast Africa
FRONTENDNext.js 16 + React 19
BACKENDFlask + C++ Engine
TOKENSDouble-Entry Ledger
STATUSLive
DEVOPS & SOVEREIGNTY
CASE STUDY
PIPELINE SOVEREIGNTY FOR SMEs
How small teams can own their entire software delivery chain — from source control to production — without third-party dependencies or unpredictable SaaS billing.
Most SMEs depend on GitHub Actions, Vercel, or Netlify for deployment, creating vendor lock-in and exposing source code to external systems. This case study documents a production-proven alternative: private source control, private container registry, host-mode CI/CD runners with BuildKit caching, and SSH-based zero-downtime deployment. Two-stage pipeline design separates build (on push) from deploy (on version tag). Production servers remain stateless — they pull containers but never hold source code. The entire pipeline costs less than a single SaaS CI/CD subscription and operates independently of any external service availability.
Tracing extraction patterns from colonial commodity trade to modern platform economies in East Africa — and building cooperative alternatives.
The thesis traces a structural parallel between colonial-era commodity extraction (documented in Wakiaga's 1964 MBA thesis on Kenya's coffee trade) and modern platform extraction in East African digital economies. The core insight: 'high attention + low opportunity = highly monetizable populations.' Global platforms capture creative labor at near-zero marginal cost while returning minimal value to producers. Design Science Research methodology frames the RedCup cooperative platform as an artifact that tests whether self-hosted, member-owned infrastructure can break this extraction cycle. The research sits at the intersection of information systems, development economics, and platform governance.
Digital ColonialismPlatform EconomicsDesign Science ResearchCooperative ModelsEast AfricaWakiaga
FIELDInformation Systems
METHODDesign Science Research
ARTIFACTRedCup Platform
STATUSWriting
ADVERSARIAL SECURITY
R&D PROGRAM
TEN-PLANE DEFENSE ARCHITECTURE
Security as a living organism: ten specialized planes that compose into layered defense-in-depth with continuous adversarial pressure testing.
Traditional security architectures split into three layers (network, application, data) and leave critical surfaces undefended. This research program develops a ten-plane model: Network, Control, Data, Application, Compute, Build, Bot, Security Operations, ML Pipeline, and Ops. Each plane has defined responsibilities, interfaces, and failure modes codified in RCCP-SEC standards. The Bot plane is the primary innovation — YAML-driven red-team agents generate attack profiles that blue-team agents must learn to detect. An ML pipeline trains on behavioral signals (mouse dynamics, keystroke cadence, motor control jerk) for session-level bot classification. The architecture is designed to evolve under adversarial pressure rather than calcify behind static rules.
