References

Thirteen years, nineteen industries, around 37,500 commits. This is what was built, in which industry, and which part of it was mine.

How to read this page

No client name and no product name appears on this page, not even my own. Industry and country instead, and it stays that way until I have a written release. Who exactly it was I will tell you in conversation. You only get near work like this on that condition.

Every sheet also says which part was mine. Some of these systems are entirely my own code, on others I led and carried the responsibility, and a few parts — a mobile app, a frontend, a visual appearance — are explicitly not my work.

The figures are rounded counts from the source archives: commits, hand-written lines, years. Dependencies, generated code and build output are not counted. A line count is not a measure of quality; it only says how big the thing under discussion is.

The extent

Four measurements across everything on this page.

13+ years, documented work, 2013 to today
19 industries
~37,500 commits, across the documented archives
~1 million lines, hand-written code, mostly TypeScript

Where this work has been done

No logos. Logos need a release, and a wall of marks does not say what was built there anyway. What this does say is: I have seen these industries from the inside.

  • Healthcare and pharmacies
  • Energy and climate tech
  • Occupational safety and IoT
  • Public sector and statutory bodies
  • Transport infrastructure
  • Furniture manufacturing
  • IT security
  • Cultural heritage
  • Humanitarian and emergency services
  • Rail transport and simulation
  • Regulated measuring instruments
  • Industrial equipment
  • Public broadcasting
  • Professional sports
  • Creative industries
  • Consumer e-commerce
  • Consumer social and geo
  • Higher education
  • Hospitality

What with

Not everything I have ever touched, but what these systems actually run on. In case somebody technical in your company is reading along.

Backend

  • TypeScript
  • Node.js
  • NestJS
  • PHP
  • Java

Frontend and mobile

  • Angular
  • Flutter
  • Ionic
  • Electron
  • Three.js
  • Mapbox GL

Data

  • MongoDB
  • PostgreSQL
  • ClickHouse
  • Redis
  • Couchbase
  • Oracle
  • IBM DB2

Interfaces

  • REST
  • gRPC
  • GraphQL
  • WebSockets
  • BLE
  • Modbus
  • Exchange Web Services

Operations

  • Docker
  • Kubernetes
  • Helm
  • GitLab CI
  • Prometheus
  • Grafana
  • Loki

Models

  • OpenAI
  • Anthropic Claude
  • agentic systems

Six sheets in detail

The six engagements with the most on file. Each with its extent on dimension lines and with the attribution of whose work which part was.

01

From the chip through the cloud to the end of the production line

Industry Energy and climate tech · European scale-up

A European scale-up builds electric heaters and boilers whose heat comes from bitcoin-mining chips; the mining revenue offsets the electricity cost. I am the lead engineer on this system and carry the technical side of product leadership.

Carrying it means: the daemon that runs on the device, the drivers for the mining hardware, the cloud broker between device and app, the Kubernetes platform, the PKI for device identity, and the test bench at the end of the line. A unit coming off that line has an hour of continuous running against versioned thresholds behind it, and the result sits in a tamper-evident journal.

The whole system is being handed over to the client's in-house team at the end of 2026, following a roadmap that included recruiting and onboarding an internal engineering lead. That is what the role is for: embed, build, hand over.

~20 repositories
~11,500 commits
~270,000 lines, hand-written code
~400 test files
On the device
An ARM64 computer inside the heater: fan, temperature, GPIO and Modbus, Bluetooth, network configuration over D-Bus, a hardened network, a token-protected local interface, signed system packages with a watchdog, and a custom OS image. Across several product generations, from two heater variants through a multi-board model to a boiler.
Drivers
A driver layer over HTTP, gRPC and GraphQL, with adapters for several miner firmwares, for smart meters and for test devices.
Cloud
A WebSocket broker that joins devices and app: token pairing, enrolment, an event bus, Redis to route messages across instances, MongoDB for state, ClickHouse for telemetry. Scaled horizontally.
Mobile app
Led and architected, not written by me: the Flutter app, with Bluetooth onboarding and automated publishing. Before it, an earlier generation in a different technology.
Device identity
A PKI of its own with root and intermediate certificates, an issuance service, secured remote access for support — and the migration of the already-shipped fleet onto that identity.
Test bench
A gateway on the factory floor drives each unit over the network, the stability run is judged against versioned thresholds, the result goes into a tamper-evident journal, and the station itself runs as a bilingual tablet application with label printing. Delivered in six documented steps and signed off on a live bench.
Operations
A highly available Kubernetes cluster on European cloud, ingress moved onto the Gateway API with no downtime, CI pipelines and a registry I run myself, Prometheus, Grafana, Loki, vulnerability scanning, and a package mirror for device updates.
Evidence
A gap analysis against Annex I of the EU Cyber Resilience Act with an evidence register, a data-protection impact assessment including a telemetry review, and an analysis of the Bluetooth channel.
My part
Lead engineer, technically responsible for the whole stack. Part of the implementation, above all the mobile app, is not my own code; I led and carried that part rather than writing it.
Period
Proof of concept January 2024, continuous engagement since April 2024. Hand-over to the in-house team at the end of 2026.
02

Four point-of-sale systems behind one interface, all in production

Industry Healthcare · community pharmacies in Austria

A licensed platform of my own that connects pharmacies directly with their customers: write to them under encryption, send prescriptions, pre-order, and then collect at the counter, at the around-the-clock pickup terminal, or straight out of the picking robot. Staff work in a portal that runs inside the pharmacy and hangs off the existing point-of-sale and inventory system, so stock, customer terms and order status flow through without being typed twice.

Behind that sits a read-only interface with pluggable drivers for four different point-of-sale and inventory systems, all four in production: Oracle SQL, partly reverse-engineered from the database schema. IBM DB2 over ODBC, debugged on site in the pharmacy. A vendor REST interface and a vendor web service. Four technologies, one model on top.

The central backend of this platform I wrote myself, from the first line to the last.

12 repositories
~5,000 commits
~70,000 lines, hand-written code
4 POS systems, in production
~7 years, continuous engagement, from the 2019 concept
Portal in the pharmacy
A desktop application with an embedded backend running inside the pharmacy network, plus the interface and a headless engine for order workflows, notifications, licensing and automatic updates.
Central backend
A relay for end-to-end encrypted messages: message gateway, device pairing via time-based one-time passwords, hybrid encryption, licensing, administration, push, and product modules for pickup, robot callbacks, payment confirmation and licence-gated downloads. Monitored with Prometheus and Loki, deployed to four environments. Around 1,170 commits and around 495 releases, all mine.
Terminals and robots
The pickup-terminal workflow with slot allocation, QR unlock and prescription check; a pharmacy-automation vendor's interface; and hand-off to the picking robot with stock reservation, an unlock code to the phone, and a retry when it fails.
Customer app
What comes from me is the side the app talks to: the protocol, the message types, the versioned shared specification with 30 typed classes, and the workflows in the portal. Not the app itself — that is not mine, and I do not list it as my work.
First generation
The 2020 portal, with the first Oracle connector and automatic answers on stock and pre-orders by drug code. It was later replaced by the current architecture.
Commercial plumbing
Per-site licensing, paid add-ons that can be switched on without a release, signed installers, automatic updates, payment-provider integration.
On site
Database recovery, server migrations, diagnostic bundles, licence moves.
My part
My own product. The central backend is entirely mine. The customer-side app is explicitly not my work; the figures above do not include it.
Period
Concept from November 2019, build from May 2020, in production ever since and still being extended in 2026. In design: a bridge from webshops for non-prescription products.
03

The cloud backbone of a wearable a life depends on

Industry Occupational safety · connected protective equipment, DACH

A start-up builds a connected wearable for people working in hazardous electrical environments; it is sold commercially across the DACH market. I designed and built the cloud backend, the user portal, the admin console and the SMS gateway behind it. When the device detects an accident, the hardware authenticates against the backend, the incident is recorded and handed to an emergency-response centre with the last known location; from there escalation timers and redundant notifications run.

In a system like this the hard part is not the normal case, it is the failure case. What happens when the centre does not answer or the device reports twice. When a timer expires mid-deployment. Those questions are why I sat inside the client's building for three and a half years and wrote the interfaces together with the people responsible for the hardware, the app and the ERP.

It started as a JavaScript prototype; what stood at the end was a fully typed, tested and measurable platform across five environments.

4 repositories
~3,800 commits
~55,000 lines, hand-written code
88 spec suites, in the backend alone
3.5 years, embedded with the client
Backend
A REST interface with challenge-response login per hardware hub, incidents, an emergency-centre interface, escalating check-in timers, diagnostic upload, versioned service configuration, subscriptions and activation codes, plus twelve scheduled processing jobs.
Hardening
A delay on repeated login attempts, time-limited challenges, encrypted environment files with a purpose-built command-line tool, TLS all the way to the database.
Integration
The client's ERP interface for contacts, hubs and the company-to-employee-to-device links. The SMS gateway as its own service, so an outage there does not take the alerting path with it.
Portals
A user portal, multilingual and with international phone validation, carried across several Angular generations, plus an admin console.
Measurability
Prometheus metrics, Loki, endpoints for latency and memory, a CI pipeline with audit, versioning, coverage, end-to-end and interface tests, five environments.
My part
The cloud side was designed and built by me. Hardware, mobile app and ERP were not mine; the interfaces between them were written jointly.
Period
June 2019 to December 2022, about three and a half years.
04

Craft rules that come out as machine data

Industry Furniture manufacturing · Austrian solid-wood supplier

Two products for the same manufacturer, which sells across Europe through dealers and also direct. The first is a 3D configurator inside their online shop: dealers, carpenters and end customers use it to design made-to-measure wardrobes, including corner units, roof pitches and sliding doors. Every configuration is checked against the real production range and the construction rules, priced live, and then translated into production data: one machine project per carcass, cut lists, XML.

A configurator that shows a pretty picture is marketing. One that emits a project for the machine is manufacturing software. In between sits a parametric construction model that splits an overall dimension into carcasses that are actually producible, structurally and on the machine — across twelve and more cabinet types. Those rules previously lived in people's heads and in spreadsheets.

The second product is a kitchen planner: draw the room in 2D with sloped walls, doors, windows and utility connections, furnish it in 3D, configure worktops and interiors, price the result, and send PDF plans into the order process. Plus a backend and a separate administration system, so the manufacturer maintains products, decors and translations without developers.

~5,000 commits, across both products
~155,000 lines, hand-written code
12+ cabinet types, parametrically constructed
Construction model
Twelve and more cabinet types, split under structural and machining constraints. Not every split that works arithmetically can also be clamped and milled; that is the part you can only build with the people on the shop floor.
Pricing engine
A rule-based pricing engine, fed from the manufacturer's price matrices through purpose-built converters and carried through several price revisions over the years.
Production output
32 part handlers and five project schemas, plus cut lists as CSV, bundled into one file. Since 2024 and 2025 the XML output also carries the 3D position of every component, so downstream systems can rebuild the exact assembly.
Kitchen planner
2D room logic with slopes and connections, a 3D planner in which furniture snaps to walls, a worktop module with material-specific rules, PDF plans, OBJ export, save and restore, six languages.
Maintenance, not a project
The administration system is why the partnership became a long one. Someone who can maintain their own catalogue does not call about every new decor. It costs me follow-up work.
Migrated in production
The configurator was carried through several Angular generations over the years without the shop standing still.
My part
Carried and delivered: construction model, pricing engine, production output, planner, backend and administration system.
Period
Configurator 2017 to 2022, XML extension 2024 and 2025. Kitchen planner 2018 to 2020. Both live in production.
05

AI in production, not in a slide deck

Industry Consumer social and geo · own product

A location-based social network on a full-screen 3D map. You follow timelines tied to physical places; posting requires being there, enforced by a cryptographically secured position trail. Eight languages with translation at runtime, plus subscriptions.

This platform is the counterpart to the client work on this page: here I run what I built myself, on-call included. An AI pipeline fills every place automatically with historical, cultural and current content from more than ten open data and event sources — queued, rate-limit aware, behind a model layer that keeps the provider interchangeable.

In rollout is an AI agent for operations: monitoring, triage of incidents, a daily brief. On its security design I deliberately say only the general part here — strict separation of duties, least privilege, isolation, several layers of defence, and a settled way of handling input that cannot be trusted.

~6,700 commits
~360,000 lines, hand-written code
~580 spec files
10+ open data sources
Frontend
An installable web application with a 3D map, computation moved into web workers off the main thread, a service worker for running without a connection, plus a native iOS wrapper.
Backend
Real time over WebSockets, access control across four tiers, image processing, billing including a customer portal and payment-provider callbacks.
Enrichment
A dedicated service that combines a language model with structured queries against open knowledge and map data, a historical newspaper archive and event interfaces. Behind it a crawler on worker threads.
Map tiles
A caching proxy in front: the access key stays on the server, an allowlist applies, and when the upstream fails the map keeps serving from cache.
Deployment
Kubernetes with rollouts that run against a smoke test and roll themselves back on failure, plus end-to-end tests across the whole stack.
My part
My own product. Design, code and operations are mine.
Period
Since July 2023, in production.
06

A protocol of my own for end-to-end encrypted messages

Industry Secure communication · own technology platform

A protocol of my own for end-to-end encrypted messages, with client SDKs and a relay server. A product can use it to build encrypted device-to-device communication without writing cryptography itself. Messages are encrypted on the device, the relay only ever sees ciphertext, and anyone offline receives their messages later. The pharmacy platform on sheet 02 runs on it.

The design provides hybrid encryption per message and password-less device authentication. What it does not provide is forward secrecy, and there is no external audit on record.

The first generation, from 2016, was a mailbox server with no knowledge of its contents: folders, drafts, attachments, chunked encrypted bodies, and on the server only public keys and client-wrapped private ones. Around 890 commits and around 22,000 lines, every line mine. The same job has since been rebuilt across three technology generations.

~1,575 commits, relay
~22,000 lines, around 10,000 of them tests
~790 releases, automated
10 years, on one platform
Encryption
Hybrid and in the browser: every message gets a fresh AES-256 key, which is wrapped with a 4096-bit RSA key. The key pairs are generated on the device.
Authentication
No password and no session: every request carries a time-based one-time token belonging to that device.
Contacts
Pairing through a two-step token and challenge handshake, with permissions between the paired parties.
Relay
A WebSocket relay with store-and-forward for recipients who are not there, a push wake-up, and connection ownership designed for several server replicas.
Modules
Application modules on the server, so a product brings its own message types and workflows without touching the protocol. That is exactly how the pharmacy platform hangs off it.
Clients
An SDK for web applications that also runs inside a web worker, an iOS app, an administration portal and a command-line tool.
Operations
Automated releases, and a declaratively managed cluster of my own on European cloud with three control-plane nodes and worker pools in two regions.
Tooling around it
Automated certificate management over the DNS challenge with provider hooks, in use from 2018 to 2024, and a service skeleton of my own that every further backend starts from.
My part
My own platform. Protocol, relay, SDK and cluster are mine; the first generation entirely so.
Period
Concept and first generation from 2016, the current generation in production behind my own products since 2020.

Further work

Fifteen shorter cases, in the same form: industry, what was built, which part was mine, when.

Public sector · statutory representative body, Austria

Period July 2023 to 2026, with ongoing feedback rounds and hand-over. Around 450 commits, around 12,000 lines of backend.

The backend and rules engine behind an education grant

Paper applications for several education-funding programmes were replaced by an application in which case workers capture, check, calculate, request missing documents, approve and book. At its core is a funding computation that translates the existing calculation sheets and stored parameters one for one: ten income types, threshold rules, per-qualification calculations — configurable rather than hard-coded, because the rates change every year. Plus roles and case history, PDF decisions, scheduled reminder e-mails and export.

My part What comes from me is the backend and the rules engine, not the frontend. Which is why this does not say "everything from one hand".

Transport infrastructure · toll-road operator

Period 2023 to 2026.

An online shop wired into the national video toll

Single trips, annual passes, coupons and discounted tickets are sold online and bound to a licence plate through the national video-toll system. For that I built a connector covering six toll operations — fetch ticket, validate plate, place order, confirm only after successful payment, cancel, credit — together with a custom checkout with plate validation and separate test and production environments. Plus a backend that publishes road status, closures and announcements. The basis was a formal three-party interface specification, across several versions.

My part The shop's visual appearance is not mine. What comes from me is the toll connector, the checkout logic and the road-status backend.

IT security · joint product

Period July 2022 to May 2023. Around 190 commits.

Sending passwords without sending them

An app for iOS and Android with which two paired people exchange passwords and secrets: pairing by QR code or contact request, retrieval triggered by push, messages that can be deleted again, biometric unlock, an encrypted local store. Encryption happens on the device, on the messaging protocol from sheet 06. From proof of concept to App Store-ready in about ten months.

Consumer e-commerce · media production

Period December 2018 to August 2020, about 18 months from concept to a running print pipeline. Around 670 commits across 6 repositories, around 25,000 lines.

From nine phone photos to a print-ready canvas

A web application for the phone turned 9 to 64 photos into a collage printed on canvas: mosaic, Voronoi tessellation, stripes and further layouts, with filters and per-cell editing. Orders went through a shop, rendering happened server-side at print resolution. The trick was a shared filter library for preview and render, so the printed picture matches the one on screen — otherwise the canvas comes back. A feasibility study came before the build. The product is no longer on the market.

My part The project ran with a team of around five. I led, and largely built myself, the backend and render pipeline and the web application.

IT security · independent test lab

Period 2015 to 2016. Around 18,000 lines of custom code.

Raw measurements turned into a public comparison

A public portal turns a test lab's raw data into interactive product and vendor comparisons. Behind it sit a charting engine with progress, cluster and comparison views, and an interface with six endpoints resting on pre-aggregated cache tables — so a multi-year comparison stays fast instead of being recomputed on every request. When a result is published, the award graphics for it are generated server-side by themselves.

Cultural heritage · university literature archive

Period 2016 to 2017.

Slow research databases, searchable in milliseconds

Several research databases — an author encyclopedia of around 1,000 entries, a georeferenced literary map, a review magazine — were brought together in one public portal. At its core is a data connector with 29 endpoints that mirrors and indexes the slow academic back ends, syncs on a schedule and watches itself. Searches answer in milliseconds without anything being changed in the source systems. The requirements were gathered in a workshop on site with the researchers.

My part What comes from me is the data connector — around 285 commits, about 93 per cent of them my own — and the application logic. Not the visual appearance.

Humanitarian and emergency services · district branch

Period 2015 to 2018.

A course calendar that reconciles with a national system

Public first-aid and training courses are imported from the national organisation's central course-management system: web services over CSV, five entity types, full reconciliation with insert, update and delete. Citizens register online and the registrations are exported back on a schedule. Built against a written interface specification, kept in production for years and carried forward in three versioned releases.

My part The visual appearance is not mine. What comes from me is the integration and the registration logic.

Creative industries · independent type foundry

Period 2016 to 2019/20. Around 140 commits on the connector.

A shop that lists its own new releases

A direct-to-customer font shop. My connector watches the foundry's release folder and creates everything itself: products from font families and styles, the licence options for them, and the download package per order. A new release goes live without anybody setting up products. Plus the licensing logic across licence types, packages and styles, seven interfaces including one for the live type tester, a scheduled order notification, a customised checkout, and invoicing that satisfies EU VAT rules.

My part The visual appearance is not mine. What comes from me is the connector, the licensing logic and the checkout.

Enterprise integration · consumer-goods brand and a physicians chamber

Period 2018 and 2019.

Exchange calendars outwards, without opening Exchange outwards

A headless service reads calendars over Exchange Web Services, normalises the appointments and delivers them as CSV to downstream web platforms every few minutes. Those platforms never get direct access to Exchange — that was the point. The hard parts were throttling on the Exchange side, solved with a serialised request queue, timezones, directory name resolution, and a change of delivery protocol partway through. For the second client the same connector ran against a different Exchange generation after about ten days.

Rail transport and simulation · master thesis

Period Around 2013 to 2015. Around 190 Java source files, around 42,000 lines across about 25 modules, plus the written thesis.

A rulebook that runs as a simulation

My master thesis was a simulator of mainline railway operations on a national network: tracks, points, signals, stations and line systems, timetables and train runs under realistic driving physics. Time-stepped and event-driven models alone do not make independently acting actors behave credibly, so it became a hybrid engine: every train its own thread, cooperating with interlocking and timetable logic through shared lock objects. Plus driving dynamics from tractive effort, running resistance and braking-weight percentages with a brake-curve assistant, a model of the applicable regulations including train protection, and a data pipeline of around 20 import modules that turns raw infrastructure and timetable data into a computable network — points, for instance, detected by a geometric touch-point search.

The thesis concludes it is suitable for introductory training of train dispatchers.

Regulated measuring instruments · manufacturer in the DACH region

Period 2016 to 2017. Around 470 commits, around 15,000 lines in the live version.

A metrology regulation as software, with a valid certificate at the end

A database application runs the legally required conformity assessment of taximeter installations. Wizards take the technician through the assessment, compare the measured values against the permitted tolerances of ±1 and ±1.5 per cent, enforce the compatibility rules between components, and produce the official certificate and type plate at the end. What comes from me is the service layer, the data model, the rule and tolerance engine, report generation and the interface. The code was then handed over in a structured way to the client's own developers, who carried it on.

Industrial equipment · UV disinfection and water treatment

Period 2016 to 2017. Around 590 commits, around 7,000 lines.

The field and the office in one portal

A customer portal for a manufacturer's installed base: customer and fleet administration, a document browser, deep links into a remote-access gateway for servicing a machine, and the import of zipped data-logger files from the plants into a database so they can be analysed. The release process is documented in its own manual.

My part Carried and delivered.

Public broadcasting · regional studio

Period Mid-2010s. Around 3,000 lines.

A tool that has to work on election night

A tool for election night: it pulls the official results continuously over a secured file transfer, converts them, and pushes them into the programme's on-air graphics system. Between the two rounds a dedicated run-off mode was added. Small, unspectacular, and with exactly one date on which it must not fail.

Professional sports · football club

Period 2014 to 2016. Around 8,000 lines.

Tactics board and line-up graphics in the browser

Browser-based drawing tools for tactics boards and line-up graphics. Each tool is its own module, plus image export and versioned releases. A coaching staff makes the graphics itself instead of ordering them.

Consumer e-commerce · gift retail

Period November to December 2021, about six weeks from start to launch.

A second canvas product, delivered in six weeks

A web application for the phone in which customers build a photo mosaic on canvas from occasion templates — birth, birthday, communion, wedding, Christmas — pay, and trigger a finished print file. The order interface runs in three phases: upload, checkout, cancel. Because payment runs asynchronously, a failed upload can cleanly reverse the payment instead of leaving an order with no picture. Behind it a separate render service producing print files with crop marks and notifying both customer and operator. Six weeks was possible because the knowledge from the collage project was already there.

My part My project and my responsibility. Led and delivered; somebody else wrote the code.

Which of these cases comes closest to your company can be settled in twenty minutes on the phone. The start is the same either way: one day, one process, and a results briefing with the figures and the prices.

Method Request a walkthrough