Work With Me
Your coding agent has root, your NixOS host has drifted, or your MCP servers are running with the same permissions as you are. I fix that class of problem for a living — the same class this whole site is field notes about.
Note
Currently taking on new engagements. The fastest way to find out whether I’m the right person is one email describing what you’re running and what’s in the way — I’ll tell you straight if it isn’t my territory.
Three things people hire me for
Stateless NixOS build-out
A declarative, reproducible workstation or server on an ephemeral root — tmpfs or otherwise — with a persistence layout that survives real use instead of only surviving a demo. Includes the bind-mount and symlink traps I've already walked into so you don't.
Deliverable: a working flake you own, plus the reasoning behind every persisted path
Agent containment review
An audit of what your coding agents and MCP servers can actually reach: credentials, keys, cloud config, the rest of the filesystem. Then the boundary that makes the blast radius small — container isolation, scoped permissions, per-tool sandboxes.
Deliverable: a written findings list ranked by blast radius, and the isolation applied
Reproducibility rescue
The host that "works on my machine" and nowhere else. Config drift, undeclared state, a dev environment nobody can rebuild. Pull it back into something declarative, then keep it there.
Deliverable: a rebuild that produces the same machine twice, and a test that proves it
How an engagement runs
- You email me what you’re running and what’s getting in the way. Rough is fine. The actual error output is better than a description of the error.
- A call, or a thread. Whichever you prefer. The goal is one thing: agree on what “done” means, in writing, before any work starts. If we can’t state it in a sentence, the scope isn’t ready.
- Scoped work, reviewable in pieces. Fixed price where the scope is fixed; a day rate where the job is genuinely open-ended debugging. You get a quote before I start, never after.
- Handover that outlives me. Commented configuration, the reasoning behind the decisions, and a written record of what changed. You should be able to maintain it without me. That’s the point.
How I actually work
Evidence first. If I tell you something is broken, there’s a reproduction. If I tell you something got faster, there’s a number and the method behind it. Where I’m uncertain, I say uncertain — I’d rather flag a gap than fill it with a confident guess.
Smallest change that solves it. I’d rather fix the specific thing that’s broken than sell you a rewrite. If a rewrite genuinely is the answer, I’ll say so and explain why, and you decide.
Direct communication. You’ll hear about problems while they’re still small, including the ones I caused.
What I don’t do
Saying this up front saves us both a call:
- Frontend and app development. Not my territory. This site is about as far as I go.
- Managed hosting or on-call. I build and hand over; I don’t operate your infrastructure indefinitely.
- “Make it secure” with no scope. Security work needs a threat model. If you don’t have one, defining it can be the first engagement — but it has to be an engagement, not an adjective.
- Compliance sign-off. I can harden a system and document exactly what I did. I’m not an auditor and won’t pretend to be one.
Questions people ask first
What does it cost? Depends entirely on scope, so I quote after we’ve agreed what “done” means — fixed price for defined work, day rate for open-ended debugging. Any number I gave you before that would be theatre.
Do you work remotely? Yes, exclusively.
Will you sign an NDA? Yes.
Can you work on non-NixOS Linux? Yes. NixOS is where I’m sharpest, but the sandboxing, isolation and agent-containment work applies to any Linux host.
How do I know you can do this? Read the field notes. They are the portfolio: real problems, real error messages, real resolutions, including the ones where I was wrong first.
Get in touch
Include, if you have it: what you’re running, what you’ve already tried, and what “fixed” would look like to you. That’s enough for me to tell you whether I can help and roughly what it would take.