Projects
Personal lab project. AWS (EC2, VPC, load balancing, Auto Scaling, RDS, S3, IAM, CloudWatch), Terraform, Python, Docker. Built with AI assistance as a guided walkthrough; I ran every step on my own AWS account and fixed what broke.
The client portal of the same fictional 20-person company as my Windows homelab below, moved to AWS and built with Terraform: a private network
across two data centres, two Linux web servers behind a load balancer that replace themselves when one fails,
a PostgreSQL database with no internet access whose password never appears in the code, database backups to
S3 that the servers can write but never delete, and CloudWatch logs, dashboards and email alarms. A Python
script checks the account for risky settings, and the app also runs in a Docker container.
I built it on a new-style AWS account that only works in one Region and has guardrails set by AWS, so I hit
and fixed problems the guide didn’t expect: budget alerts that AWS’s own policy blocked, which I sent
through a notification topic instead; servers that failed to launch because a new permission hadn’t reached
every part of AWS yet; and a permissions test that wrongly reported “denied” until I traced it to the
account-wide Region rule. Every doc has screenshots from my account, and nothing is left running between
sessions.
Windows Active Directory homelab
Personal lab project. Windows Server 2025, Windows 11, PowerShell and VirtualBox. Built with AI assistance as a guided walkthrough; I studied, re-ran and documented every step myself.
The IT setup for a fictional 20-person company, built on my laptop: a Windows Server 2025 server that
handles everyone’s sign-ins, network addresses and shared folders, and a Windows 11 office PC joined to it.
Six departments each get a shared folder only they can open, and five company-wide policies set password and
lockout rules, lock idle screens, map network drives and block USB sticks for the sales team.
I then worked through six help desk tickets in the lab, including a real account lockout traced back to the
PC that caused it, a new starter, a leaver and a department move, and wrote PowerShell scripts for
onboarding, offboarding and creating accounts in bulk. Testing turned up real problems, the most serious
being that the help desk account could reset an administrator’s password. I moved the admin accounts
out of its reach and confirmed the fix. Every step is written up with screenshots.
Disaster preparedness game
Team capstone project, programmer. Unity, C#, Android, Supabase (PostgreSQL). Published on Google Play.
A 3D first-person Android game that teaches students what to do in a disaster, set on a recreation of the
Lyceum of the Philippines University – Cavite campus. Its 20 earthquake, typhoon, flood, fire and ashfall levels put the player
in one of four campus buildings and walk them through a real drill: duck, cover and hold during the shaking,
wait out aftershocks, find another way round a blocked exit, and evacuate with a crowd of classmates to the
assembly area. Touch controls, a mini-map, campus wall maps and a route guide keep players oriented.
Players pick a character, read safety guides for five disasters (earthquake, flood, typhoon, fire and
ashfall) and collect emergency items such as a flashlight, whistle and first-aid kit into an in-game almanac.
Students sign in with their school email and a one-time code; progress is saved to a Supabase database,
syncs between devices, keeps working offline after the first login, and an account can only be active on
one device at a time. I also built a Windows content manager that lets staff place 3D objects in levels and
publish content updates to every player without releasing a new version of the app.
Active Directory health report
Personal project, part of the Windows AD homelab. PowerShell, Active Directory, Group Policy. Built with AI assistance and tested against the lab’s domain controller.
A read-only PowerShell script that checks a Windows domain and saves the result as one HTML page, with
problems sorted to the top. It flags locked-out and expired accounts, passwords about to expire or set
never to expire, accounts nobody has used in 90 days, disabled users who still hold group memberships,
and the members of the built-in admin and operator groups. It also checks the server itself: core directory services, disk space,
failed sign-ins and lockouts from the Security log, a pending restart and how long since the last update.
On my homelab it flagged a real problem: a Group Policy for mapped drives whose only link was disabled,
so it applied to no one. Every threshold, such as how many days count as stale, is a parameter.
TikTok Video/Audio Downloader
Personal project, published. Version 1.4, 470 lines of vanilla JavaScript, zero dependencies, GPL-3.0.
A browser userscript that adds a download button to TikTok on the web. One click saves the video on screen
as an MP4 in the highest quality TikTok has for it, with no watermark, or saves just its audio as an MP3
(or M4A when the sound is AAC). Everything is saved locally; nothing goes through a third-party download site.
Earlier versions read each video’s data from its own page, until TikTok started answering those
direct loads with HTTP 403. The current version hooks the page’s own fetch and
XMLHttpRequest at document start and keeps every video object TikTok’s app loads for
itself, so a click downloads straight from that cache with no extra requests. It picks the best file by
resolution first and bitrate second, keeps backup links for when TikTok’s servers refuse one, moves
out of the way of the comment panel and hides itself during LIVE streams. Version 1.4 fixed audio downloads
for videos with an original sound, which TikTok serves from a host that blocks the page from reading it,
by falling back to the userscript manager’s own request API for that host.