27 years
Germany

I build systems that scale,
end to end.

Infrastructure, security, backend, frontend.
Built and run on infrastructure I operate myself.

Main projects

Dylaris

in development
413k LOC · 3 reposdylaris.com

Minecraft server hosting platform, self-hosted or multi-tenant. MC servers and proxies that stay invisible.
The gateway handles every packet, every file, every connection.

Portless NodesGame nodes expose zero public ports – every connection arrives through edge gateways over persistent TLS tunnels
Beam File RelayServer files, world data, backups all flow through the gateway too. No exposed SFTP, no direct disk access
Yamux MultiplexingOne persistent TLS tunnel per edge–node link carries N concurrent player sessions with 256KB stream windows
Transparent FailoverSplice sidecars survive edge restarts. Player connections persist through gateway rollouts and updates
Kernel DDoS DropeBPF/XDP firewall at the edge – malicious packets die in kernel space, never reach userspace
Built-in ToolingBackups to S3/R2, Modrinth browser + modpack builder, live server migration between nodes, per-server RBAC, file browser, multi-node clustering. Docker-native throughout
BYONBring Your Own Node. Customers run the game node on their own hardware while Dylaris hosts the control plane, DDoS-protected edges and billing. Multi-tenant by owner, single-use enroll tokens, WireGuard bridge for nodes behind NAT. Sold and provisioned through the dylaris.com store.
platformopen sourcePanel, control plane and node agent – anyone can run the whole thing themselves
gatewayclosed sourceEdge, tunnels and the protected address – the half that is sold
websitestoreMarketing site and the Stripe front that provisions a tenant
dylaris.comcommercial layer
19k LOC · own repo

The paid front for BYON. A customer subscribes here, then connects their own node into the hosted control plane. Stripe bills per node plus metered traffic; checkout and cancel events provision or suspend the tenant over a shared-secret API.

BillingPer-node subscriptions plus metered overage, webhook as source of truth
Account linkPasswordless store account links to a platform user via single-use token
ProvisioningCheckout and cancel drive activate, past_due and suspend on the node
Written inGo 1.26 · TypeScript · C
BackendgRPC · eBPF / XDP · Yamux · WireGuard · Redis Streams · GORM
FrontendNext.js 16 · React 19 · Tailwind v4 · SSE · CodeMirror
InfraDocker Swarm · PostgreSQL · TimescaleDB · Valkey · S3 / R2 · Traefik · XFS quotas
StoreFiber · Stripe · Resend
3,465 Go test functions527 API routes78 permission capabilities549 design documents
ArchitectureDylaris
Traffic Flow
Player / Beam clientOnly point of contact with the internet. Reaches the gateway tier on game ports, HTTP/HTTPS, or the Beam file-transfer listener
EdgePublic-facing ingress. XDP firewall drops malicious packets in kernel space, then SNI / MC protocol parsing routes the rest into the tunnel
Yamux / TLS tunnelOne persistent encrypted tunnel per edge–node pair, multiplexed into N concurrent streams. 256KB stream windows for high throughput
Link → ContainerLink demuxes streams on the node host and forwards them via Docker overlay net. The node host itself never exposes a public port
Control plane (out of band)Core ↔ Node via gRPC for container lifecycle. Hub coordinates Edges through a Redis lease-based leader election
Communication Layers
Public ingressTCP, UDP, Minecraft 774, HTTP/HTTPS, Beam
Edge ↔ NodeTLS 1.3 + Yamux multiplexing, one tunnel per pair
Control planegRPC (Core ↔ Node), Redis pub/sub (Hub ↔ Edges)
NAT bridgeWireGuard (Warp) terminates home / off-site nodes
HA leaderRedis lease (30s TTL) + race-free BLMove queue
Data planePostgreSQL (TimescaleDB), Valkey (Redis-compat)
Topology & Security
Edge-only public surface, nothing else talks to the internetNode hosts run Docker overlay net, zero exposed ports, no public SSHTLS-tunneled inter-tier links + JWT-authenticated Beam clientsKernel-level XDP firewall as additional packet-drop layerBYON nodes tenant-isolated by owner; enroll tokens are single-use
Decisions with a consequence
FailoverOne byte decidesAn edge dying mid-game lands the player on a sibling edge, and the link replays exactly the gap from a 1 MB ring buffer. A partial replay is refused rather than sent: one byte off kills the session.
Root causeZero meant unlimitedLimits were integers where 0 meant no limit – exactly what arithmetic produces for a tenant without a quota. Four defects later they are pointers, so nil, zero and n differ.
ReleaseTwo green rounds before a pushA git hook blocks the push until every repo with unpushed commits has two clean verification runs on the same commit. Any fix in between resets the counter.
OperationsThe interface is dylaris-wg0, not wg0Only dylaris-prefixed interfaces get adopted – adopting a stranger's wg0 replaces its key and drops every peer on it. Peer changes apply as deltas, never replace-all.
Deliberately not built
No Bedrockthe edge is TCP-only
No DDoS-proof claimthe gateway moves the attack surface, it does not scrub
No telemetrya panel that phones home is not self-hosted
No SLA numberone region with two edges has not earned one

letterhop

in developmentpre-production

Microsoft is retiring SMTP basic auth. The day it goes, every printer, scanner and ERP box that has been mailing for a decade falls silent. letterhop sits in between: a relay on the customer's network takes classic SMTP from the device and delivers through OAuth2 to Microsoft 365, or through an ordinary mail server. Built for managed service providers running many customer sites.

Go · Next.js 16 · TypeScript
PostgreSQL · SQLite · OAuth2 · Docker
83k LOC · 41k of it tests
  • Accepts mail on 587 STARTTLS, 465 TLS and, only when enabled, plain port 25 – whatever the old device still speaks
  • Writes every message to disk before it answers 250 OK, then retries and dead-letters – a scan is never silently lost
  • Switches to an upload session by itself when a scan is too large for a normal send
  • Installs as a Windows service; the multi-tenant cloud manages the fleet, and mail never passes through it
  • An enrolled relay always delivers: a lapsed licence locks its configuration, never the mail
  • Signed licences, single-use enrolment tokens, TOTP and Cloudflare Turnstile on the platform

Background

I spent two years as an IT field technician and two more as an IT consultant at a managed service provider. I ran Linux servers, built homelabs, and learned what happens when infrastructure fails at 2am.

That background is why I design systems the way I do – I know what runs underneath them. For the past three years I've been building tools and analysing architectures; for the last year, large-scale systems like Dylaris.

Built in Go. Efficient by design, not by coincidence.

How I work

I build everything with Claude Code. I don't write code by hand and I don't read it line by line. I'm the architect; Claude writes the code. I work from the explanation of the code, not from the code itself.

What that leaves to me is most of the engineering:

DesignArchitecture, scope and constraints: which parts exist, what talks to what, where the trust boundaries sit
SpecifyLarger changes start as a written design. Dylaris alone has 549 of them
ReviewClaude explains what it built and why; I challenge the security and scaling calls until the explanation holds
VerifyNothing is done until it runs: tests first, and on Dylaris a push hook that wants two clean verification rounds on the same commit
OperateI deploy and run it myself on Hetzner and Docker Swarm, and I root-cause it when it breaks

It filters in both directions. Teams that hire through live-coding whiteboards won't find what they test for here. Teams that build AI-first will find someone who already works that way.

Stack & capabilities

Go on the backend, TypeScript on the front. Everything below runs in production somewhere, not just in a sandbox.

GoGoTypeScriptTypeScriptNext.jsNext.jsReactReactTailwindTailwindPostgreSQLPostgreSQLSQLiteSQLiteRedisRedis / ValkeyLinuxLinuxDockerDocker SwarmTraefikTraefikActionsGitHub CI/CDCloudflareCloudflareWireGuardWireGuardeBPF / CiliumeBPF / XDPStripeStripe
BackendFiber · Chi · gRPC · GORM · goose migrations · Redis Streams · cron scheduling
RealtimeSSE · WebSocket · Yamux multiplexing · TLS tunnels
Auth & securityOAuth2 · JWT · Argon2id · TOTP 2FA · CSRF · rate limiting · Cloudflare Turnstile
Storage & billingS3 / R2 · MinIO · XFS quotas · Stripe metered billing · Resend
Ways of workingDistributed systems · leader election · table-driven tests · design docs before code
MobileSmaller apps I build myself in React Native; polished mobile UX and full native iOS / Android come via @isthaltdave. Full end-to-end delivery including mobile is possible.

Other projects

LabExtend

in beta

Swarm-native infrastructure monitoring as a single Go binary that runs as a global service. Source on github.com/Bartis-Dev/LabExtend.

Go · React 19 · TypeScript
SQLite · gRPC · SSE · Argon2id · Docker Swarm
24k LOC
  • One node becomes leader and serves the UI, the rest run as agents over bidirectional gRPC
  • Container logs stream live from a SQLite ring buffer, five thousand lines per container
  • Alerts carry hysteresis, so a flapping container does not become a wall of notifications
  • Restart-loop detection: three restarts inside sixty seconds
  • Accounts on the large video and streaming platforms connect over OAuth2, each with its own token lifetime
  • Background workers keep statistics fresh without the creator touching anything
  • Agency-facing sharing with magic links and password-protected profiles
  • Drag-and-drop kit builder on the front, rate limiting at the edge of the API

Creator analytics platform

in developmentname unannounced

Verified media kits for creators – the numbers on a profile were fetched by the platform, not pasted in as screenshots.

Go · Next.js · TypeScript
PostgreSQL · OAuth2 · Stripe · background workers
29k LOC

reclaim

in development454 green tests

A voxel survival game, and the one project here that is not a web service. The only thing I have built where the budget is frame time rather than requests.

C# · Godot 4.7 · .NET 8
C++ GDExtension · procedural generation
29k LOC
  • Procedural world generation: noise fields for forests and meadows, rule-grown trees, ore-bearing rock
  • Voxel mining with the core written as a GDExtension in C++
  • Multiplayer that works across two real processes, not two windows of one
  • The overlay reports 1% lows rather than an average frame rate, because the average hides the stutter

Work together

Got a project that needs solid backend work – or a complete product, from the servers up?

Backend systems, distributed architecture, full product delivery – or a tool that just needs to actually perform. Open to projects and to a permanent role. Let's talk.

bartis · Darius Achilles
ContactImprintPrivacyTerms