Frontend
Vue 3 (Composition API) Built 40+ reusable components and composables across the dashboards.Nuxt 4 The whole platform — pages, SSR, and server routes — runs on one Nuxt 4 app.TypeScript End-to-end types shared across the frontend, server routes, and data layer.Tailwind CSS v4 Token-based theming so each role’s dashboard has its own consistent look.Nuxt UI Accessible base components for forms, modals, and data tables.Vite Fast HMR in dev and optimized, code-split bundles in production.PWA (Workbox) Offline shell and install prompts via @vite-pwa/nuxt.Service Workers Cache the app shell and assets so dashboards load offline.IndexedDB Pending-queue for GPS fixes so no lesson route is lost on a crash.Geolocation API watchPosition powers live trip tracking in the browser runtime.Wake Lock API Keeps the screen awake while an instructor records a route.SSR / hybrid rendering Server-render marketing pages for SEO; hydrate dashboards behind auth.
Backend
Nitro server routes Every API — auth, payments, document ingest — is a Nitro server route.Node.js Server runtime for APIs, cron jobs, and the IMAP poller.REST APIs Designed the platform’s REST endpoints with role-based guards.Cron jobs Schedule the inbound-email poller and routine maintenance tasks.Webhooks Handle Resend Inbound and Moneris callbacks as server webhooks.Server middleware Adds security headers and CSRF before every request.PL/pgSQL functions & triggers Audit-ledger trigger mirrors every transaction into a tamper-evident table.Realtime / WebSockets Stream live trip playback and notifications to clients.PDF extraction (unpdf) Pull text from forwarded receipts and certificates for ingest.Email parsing (mailparser) Normalise inbound emails into one shape for the pipeline.Image processing (sharp) Resize and compress avatars and uploaded documents.Idempotency keys Stop double-clicks and retries from recording a payment twice.CSV export Admin data exports for reporting and bookkeeping.
Database
Postgres Primary datastore — schema, triggers, indexes, and JSONB columns.Supabase Managed Postgres + Auth + Storage + Realtime backing the platform.Row-Level Security Per-role RLS policies so the database itself enforces access.JWT custom claims A claims hook injects the user’s role into every token for RLS.SQL migrations 60+ versioned migrations run through the Supabase CLI workflow.Postgres triggers Immutable audit trail and derived-balance maintenance.Supabase Storage Holds avatars and student documents with scoped access.Supabase Realtime Publications and channels drive live trip and notification streams.GRANT / least-privilege Revoke anon/authenticated on admin-only tables beyond RLS.node-postgres (pg) Direct Postgres access for scripts and migration tooling.Schema design Modelled enrolments, ledgers, documents, and lesson data.MySQL Data management during my early work at Lynx ERP Solutions.
Auth & Security
Supabase Auth Sign-up, login, sessions, and password reset for all roles.CSP + nonce Per-request nonce CSP emitted by nuxt-security.strict-dynamic Only scripts the app loads can execute, even if markup is injected.CSRF Custom double-submit CSRF on every mutating request.Rate-limiting IP + session limits on public and auth endpoints.reCAPTCHA v3 Server-verified bot scoring on public forms.Role-based access Student / parent / instructor / admin enforced in three layers.HSTS / security headers HSTS preload, nosniff, framing, and Permissions-Policy locked down.Honeypot + dwell-time Catch bots that fill hidden fields or submit suspiciously fast.IDOR prevention Ownership checks so an ID can’t be guessed to reach another account.Account lifecycle / soft-delete Archived/deleted accounts are rejected even with a valid token.Least-privilege credentials Scoped, non-root tokens for automation — a token can never exceed its user.Network segmentation Lab behind its own firewall; the household stays upstream of it, unaffected.Internal PKI Ran a private certificate authority so internal services get real TLS.DNS filtering Network-level blocking as a layer that covers devices I don’t administer.Secure Boot / UEFI Nodes and guests boot with Secure Boot rather than in legacy BIOS mode.Credential hygiene Cleared inherited BIOS passwords; rotate any secret that touches a screenshot.
Integrations
Moneris Checkout Hosted Checkout with server-to-server verify and an audit ledger.Resend Transactional email for verification, receipts, and notifications.Resend Inbound Webhook transport that feeds the document-ingest pipeline.IMAP (imapflow) Polls a mailbox to ingest forwarded registrations and receipts.Leaflet Live trip map with animated polyline playback over Realtime.OpenStreetMap / CARTO Basemap tiles for the trip map, with OSM as fallback.Interac e-Transfer Claim and reconciliation workflow for non-card payments.
Mobile / Native
Capacitor 6 Wraps the same Nuxt app as an Android GPS lesson tracker.Android Shipped the single codebase as an installable Android APK.Java Native glue for the Android foreground-service integration.Gradle Android build configuration and dependency management.Foreground service Keeps GPS tracking alive with the screen off in a moving car.Background geolocation @capacitor-community/background-geolocation for field recording.Offline-first sync Buffer fixes locally and replay them once the network returns.
DevOps / Quality
Git Version control for everything I ship.Supabase CLI Runs migrations and the local Postgres stack for safe changes.Docker Runs the local Supabase stack for sandboxed development.Playwright (E2E) Regression harness covering auth, role gating, and payments.ESLint Enforces consistent style and catches issues before commit.Sandbox / prod env switching One command flips between local sandbox and cloud, with guard rails.SEO (Schema.org · Sitemaps · OG) Structured data, sitemaps, and social cards for the public site.WebP optimization Compressed, responsive images for fast page loads.Self-hosting Run the services I depend on — DNS, proxy, backups — on hardware I own.Disaster recovery Restore drills, and rollback snapshots taken before irreversible changes.Runbook documentation A build log recording 29 diagnosed problems with the reasoning, not just the fix.Root-cause diagnosis Read the error that names the failing layer before changing anything.Capacity planning Match workloads to the resource that actually binds them, and leave the rest alone.
Virtualisation
Proxmox VE Five hypervisor nodes running every VM and container in the homelab.KVM / QEMU Full VMs for the router, the backup server and the management plane.LXC containers Lightweight guests for the resolver and the reverse proxy.Datacenter Manager One dashboard across standalone nodes over the API — no cluster quorum.Snapshots & rollback Pre/post snapshots around the router cutover, taken with the guest agent live.virtio / q35 / UEFI Paravirtualised NICs and disks on a modern machine type with Secure Boot.IOMMU / PCIe passthrough Verified VT-d groups so the NICs can be passed through directly if needed.Guest boot ordering Start-at-boot and start order so the router comes up before what depends on it.Storage layout (LVM-thin) Hypervisor on its own disk, guests on a separate NVMe thinpool.
Networking & Firewall
OPNsense Router VM holding the LAN gateway, replacing the ISP box as the edge.WAN / LAN separation Two physically separate NICs rather than one trunked interface.Linux bridging (vmbr) Bridges mapping each physical NIC to the right virtual interface.Subnetting & static addressing A node and service address plan kept clear of every DHCP pool.Kea DHCP Serves the lab, handing out the gateway and the lab’s own resolver.DNS (AdGuard Home) Filtering resolver for the whole LAN, forwarding upstream over DoH.DNS-over-HTTPS Encrypts the upstream hop, where the ISP would otherwise read every query.Caddy reverse proxy Routes every service by name, so nothing is reached by host and port.Internal CA / TLS Issues certificates for internal names — trusted HTTPS with no public DNS.Tailscale Subnet router giving remote access to the lab without an inbound port.Wake-on-LAN Nodes sleep by default and wake on demand, verified end to end.Network cutover planning Sequenced the gateway swap so no address, route or rewrite had to change.
Backup & Recovery
Proxmox Backup Server Deduplicating datastore on a dedicated node, off the machines it protects.Restore testing Restored a container to a throwaway ID and verified it — a backup, not an assumption.Prune & garbage collection Retention held as datastore policy, so individual jobs cannot drift apart.Verify jobs / bit rot Scheduled verification catches a corrupt chunk before a restore needs it.Scoped API tokens Nodes authenticate with datastore-only rights instead of root.Off-node copies Backups target a different physical machine from the one being backed up.Config-level backups Firewall configuration exported separately as the fast recovery path.
Linux & Systems
Debian Every node, VM and container in the lab, built and administered from the shell.Bash Node administration, diagnostics, and the wake-on-LAN tooling.systemd / journalctl Where the specific error lives when a web UI only offers a vague one.apt / deb822 repos Signed-By keyrings and archive keys — fixed a repo failing its signature check.SMART / smartctl Audited five disks before use; two were degrading and were retired.ethtool One-shot check for link speed, duplex, and wake-on-LAN arming.lspci / dmesg Confirmed a transplanted NIC by driver binding and its MAC, not by assumption.ip / iproute2 Interface state, addressing, and bridges applied without dropping the session.BIOS / firmware flashing Brought five machines to a common firmware baseline with no OS installed.Hardware diagnostics Traced dead boards, wrong-voltage RAM, and unseated cables to root cause.
Tooling & WordPress
Elementor Built the original Driving Headquarters WordPress site.Divi Designed Tamil Heritage Month end-to-end in the Divi builder.WP Rocket Caching + CDN for WordPress performance tuning.Wordfence Security hardening and login lockdown on WordPress sites.UpdraftPlus Scheduled backups and restores for WordPress clients.All-in-One SEO On-page SEO, sitemaps, and meta management in WordPress.
