~> whoami

Ahmad Syamim (syamxm).

ahmad syamim · contact

Final-year CS student at UiTM Shah Alam, DevSecOps specialisation. I run projects and pipelines on my home server; this page lives on GitHub Pages. Mostly because I want to know how it all actually works.

role student · devops intern host github pages / projects at home shell fish status checking homeserver… internship placed · 7 sep 2026 – 5 mar 2027

Projects

~> ls ~/projects # 11 dirs · sorted by importance

checking project availability…

drwxr-xr-x BeanThere/ ★ flagship cd →

Coffee-shop platform in plain PHP — online ordering, loyalty tiers, and a drink recommender backed by a local Ollama model on a 4 GB GPU. CSRF tokens, rate limiting, and prepared statements throughout; every deploy gated by a six-gate DevSecOps pipeline.

php-8.2 mariadb local-llm csrf rate-limit trivy tailscale
# ci.yml — pipeline illustration, not live status · fail-closed · weekly secret scan 
php -l    ✓ pass─┐
semgrep   ✓ pass─┼──▶ docker build ──▶ trivy fs + image ──▶ deploy
gitleaks  ✓ pass─┘    ✓ pass       ✓ pass           ✓ live
                                                                tailscale ssh — fires only when main is green
drwxr-xr-x taskflow/ cd →

MERN task manager with a security-gated CI/CD pipeline: five scanners (Semgrep SAST, Gitleaks secrets, and Trivy across SCA, image, and IaC) block deploy on HIGH or CRITICAL findings.

merngithub-actionssemgrepgitleakstrivyjwt
drwxr-xr-x debian-watch/ cd →

Go monitoring dashboard for the homeserver — per-core CPU, memory, disks, network, temperatures and Docker containers, rendered server-side with html/template and HTMX. It never mounts the Docker socket: it reads through an nginx allowlist that forwards two endpoints and 403s everything else. Each collector degrades alone, so a missing sensor hides a panel instead of taking the app down.

gohtmxdockercodeqltrivygovulncheck
drwxr-xr-x mustxrdjar/ cd →

Art portfolio built for a friend — 22 painted and sketched works on scattered sticker plates, with a keyboard-driven lightbox. Astro static output, plain CSS custom properties, two dependencies. Artworks are globbed at build time, so adding a file to art/ is the whole publishing step; a build integration deletes the ~7 MB of images Vite emits but nothing references. Self-hosted fonts, AVIF gated to production, GitHub Pages on its own subdomain.

astrosharpvanilla-jsavifgithub-pages
drwxr-xr-x homeserver-dashboard/ cd →

Grafana + Prometheus + Loki observability for the Debian homeserver — metrics, auth and fail2ban logs — behind Cloudflare Access (email OTP) with no published host port.

grafanaprometheuslokicloudflare-access
drwxr-xr-x student_reminder_system/ cd →

Flutter timetable + deadline reminders for UiTM students. Firebase, plus a FastAPI backend with bcrypt auth and Redis rate-limited login, Dockerised on the homeserver.

flutterfirebasefastapiredisbcrypt
drwxr-xr-x cipher-agent/ cd →

RSA spy game in a fake browser terminal — solo cipher missions plus a two-player one-time-pad channel. pytest suite, hardened non-root container.

fastapirsaotppytestnon-root
drwxr-xr-x cipher-forge/ cd →

Interactive RSA teaching game — prime selection through decryption, solved by hand stage by stage. React + FastAPI + MongoDB with JWT auth.

reactfastapimongodbjwt
drwxr-xr-x cv-api-spring/ cd →

The same CV, rebuilt on Spring Boot 3.5 and Java 21 to learn the ecosystem properly — Postgres with Flyway, JSON byte-for-byte identical to the Node API so the two can be diffed. One Thymeleaf definition of the ATS resume renders the page, the PDF and its A4 previews. 55 tests, Postgres via Testcontainers.

java-21spring-bootpostgresflywaytestcontainersthymeleaf
drwxr-xr-x cv-api/ cd →

My CV as data — Node + Postgres REST API serving resume JSON. GitHub Actions deploys over Tailscale SSH; published through a Cloudflare Tunnel, zero open inbound ports.

nodeexpresspostgresgithub-actionstailscale
drwxr-xr-x c-aegis-landing/ cd →

Landing page for C-Aegis, my final-year Android project — features, how it works, screenshots, and the APK straight off GitHub Releases. Plain HTML, CSS and vanilla JS: no framework, no build step, with the download URL and screenshot list in a single config file. Served from GitHub Pages on its own subdomain.

htmlcssvanilla-jsgithub-pages

Stack

~> skills ps --all # 50 units · configured roles, not live service status · depth = usage
infra/6 units
dockerrunning9 projects
debian 13runningevery service
nginxrunningreverse proxy
cloudflare tunnelrunning8 public hosts
tailscalerunning5 projects
bashrunningops scripts
ci-cd/4 units
github actionspassing6 pipelines
gitclean11 projects
docker composerunning9 projects
ssh deployover tailscale5 pipelines
security/11 units
gitleaksgate ok4 pipelines
semgrepgate ok2 pipelines
trivygate ok3 pipelines
codeqlgate okdebian-watch
govulncheckgate okdebian-watch
ufwenforcinghomeserver
fail2banenforcinghomeserver
crowdsecenforcinghomeserver
jwt + bcryptenforcing4 projects
csrf + rate limitenforcing3 projects
nmapon demandrecon labs
observability/4 units
prometheusscrapinghomeserver · cv-spring
grafanarunninghomeserver
lokiingestingauth + fail2ban logs
umamirunningsyamxm.com
backend/10 units
fastapilistening3 projects
node + expresslistening2 projects
spring bootlisteningcv-api-spring
go net/httplisteningdebian-watch
rest api designshipped5 projects
postgresqlrunning2 projects
mongodbrunning2 projects
mariadbrunningbeanthere
postmanon demandapi testing
redisrunningrate-limited login
frontend/6 units
reactbuilt2 projects
vanilla js + cssbuiltthis site
htmxbuiltdebian-watch
tailwind cssbuilt2 projects
fluttershippedstudent reminder
android · kotlinbuildingfinal year project
languages/9 units
javascriptfluent4 projects
pythonfluent3 projects
sqlfluent4 projects
bashfluentops scripts
phpworkingbeanthere
javaworking2 projects
goworkingdebian-watch
c++courseworkuitm units
kotlin · dartworking2 mobile apps

Uses

~> cat ~/uses # the machine everything on this page runs on
# homeserver traffic path · configured architecture, not live status · portfolio hosted on GitHub Pages 
            internet
                │
       ╭────────┴────────╮
       │ cloudflare tunnel │  zero inbound ports
       ╰────────┬────────╯
                │ outbound-only
       ╭────────┴────────╮
       │ nginx             │  hsts · csp · real-ip
       ╰────────┬────────╯
                │ docker bridge — internal only
       ├── beanthere      php · mariadb
       ├── taskflow       mern
       ├── debian-watch   go · htmx
       ├── cipher-agent   fastapi
       ├── cipher-forge   react · fastapi · mongo
       ├── cv-api         node · postgres
       ├── cv-spring      java · spring · postgres
       ├── vaultwarden    secrets
       └── grafana        prometheus · loki

       ufw · fail2ban · crowdsec   configured host protection
       tailscale                   ssh + ci deploys, private
Homeserver specification
hostdebian 13 · self-hosted at home
cpu—
memory—
storage—
gpu4 GB — runs the local Ollama model behind BeanThere
runtimedocker — 8+ services, non-root, internal network
patchingunattended-upgrades — unattended, on schedule
exposurezero published host ports
Workstation
workstationcachyos · arch-based
barwaybar — this site borrows its palette
shellfish
typejetbrains mono, everywhere

Live server monitor

~> btop # real metrics from my home server · this page stays online independently
cpu — — —
load — procs — up — kernel —
memory
ram —
swap —
/ —
/home —
i/o
net ↓—
net ↑—
disk r—
disk w—
nvme—
gpu—
containers —

connecting to the homeserver …

Timeline

~> git log --graph ~/timeline # 6 commits · newest first
  1. f1c9d04 HEAD -> mainwork sep 2026 – mar 2027

    DevOps intern — 6-month industrial placement

    • Six months confirmed, 7 September 2026 – 5 March 2027
  2. a7f3e21 edu oct 2023 – mar 2027 (expected)

    BSc Computer Science (Hons) — UiTM Shah Alam

    • CGPA 3.66 · Dean's List every semester
    • Final year project: C-Aegis — Android parental monitoring, geofencing and tamper-resistant app control
  3. 3d90c4f work may 2025

    Exam invigilator — Community Tuition Group, Selangor

    • Ran a hall of 20+ students solo — seating, materials, and order start to finish
  4. 8b2e510 edu aug 2022 – jun 2023

    Foundation in Engineering — UiTM Dengkil

    • CGPA 3.81 · top 10% of the faculty cohort
    • Ranked 1st in cohort, second semester
  5. c15af73 edu 2022

    SPM — SMK Saujana Utama

    • 8A out of 9 subjects
  6. 0e4d6a1 workroot-commit apr 2022 – jul 2022

    Part-time crew — Subway, Eco Grandeur Puncak Alam

    • Open to close through peak volume, accuracy held under pressure

Security posture

~> cat security.txt # project security configuration — not live health checks
CSPdefault-src 'self' — explicit analytics and status API origins, no eval
passwordsbcrypt — salted, work-factor tuned, never reversible
queriesprepared statements only — zero string-built SQL
SASTsemgrep gate — build fails on new findings
secretsgitleaks gate — no key reaches a commit
imagestrivy scan — deploy blocked on known CVEs
transportportfolio: GitHub Pages via Actions; home projects: Tailscale SSH deploys and Cloudflare Tunnel — zero open inbound ports
requestsCSRF tokens + per-route rate limiting on every mutating path

Contact

~> cat contact.txt

If you're building something similar or just want to talk shop, reach out.

Placed for a confirmed 6-month internship as a DevOps intern, 7 September 2026 – 5 March 2027.

emailahmadsyamim200@gmail.com whatsappclick to open chat githubgithub.com/syamxm linkedinlinkedin.com/in/syamxm projectsls ~/projects
~> xdg-open jomqr.my/syamxm ↗
~>
syamxm.com — built by hand, deployed to github pages after CI checking homeserver…