TLS certificate & domain expiry monitoring :: Crystal, PostgreSQL, Ansible

Designed and built a production monitoring service that tracks TLS certificate coverage for registered domains, polling Certificate Transparency logs (crt.sh) and whois on a daily schedule and alerting on DNS names about to lose valid certificates. Complete ground-up rewrite of a legacy Ruby/Sinatra application, redesigned around DNS names rather than certificates to eliminate false alerts on every renewal.

The rewrite

• ~5,900 lines of Crystal across 90 files, backed by 674 tests.
• A custom Postgres-backed job queue, rather than pulling in Redis.
• Ships as a single static binary.

The Project

• Project has zero package dependencies - so no ORM and all SQL in one layer, plus a CI pipeline enforcing format, lint and a full suite against real PostgreSQL.
• Custom PostgreSQL-backed job queue (FOR UPDATE SKIP LOCKED + LISTEN/NOTIFY) with retries, exponential backoff, dead-lettering and cron scheduling - deliberately avoiding Redis so the app has exactly one runtime dependency.
• Three-node HA deployment provisioned with Ansible: PostgreSQL under Patroni with etcd consensus, HAProxy routing writes to the elected leader, all inter-node traffic over Tailscale. Ships as a single static binary.
• Purpose-built health checks used both by Icinga and as a rolling-upgrade gate - designed to fail while the cluster is still serving but no longer at full strength, so an automated rollout halts instead of taking out quorum.
• Migrated 12,340 certificates from the legacy database, collapsing 34,849 duplicated rows into a 927-row DNS-name registry and re-deriving every fingerprint through the application's own X.509 parser so future polls wouldn't duplicate the import.

3D multiplayer capture-the-flag tank game :: Crystal, raylib

• Built an authoritative game server with a fixed 30 Hz tick and fiber-based concurrency; implemented client-side prediction, server reconciliation, and entity interpolation so gameplay stays responsive over a lossy network.
• Designed a binary wire protocol with value quantization and Quake III-style delta compression against per-client acknowledged baselines - ~15-20× smaller than JSON and small enough to avoid IP fragmentation.
• Architected a pure, IO-free simulation core shared by client and server, making game rules unit-testable in isolation and guaranteeing prediction matches authority.
• Automated specs and Windows/macOS builds in Gitlab CI.

DNS telemetry ingestion pipeline :: Crystal, S3, Parquet, RabbitMQ

Ported the ingestion core of ENTRADA (SIDN's Java/Spring DNS analytics platform) to Crystal as a dependency-light, horizontally scalable service.

• Reimplemented two external Java libraries in Crystal: a PCAP reader (IP defragmentation, TCP reassembly, handshake RTT) and a DNS wire decoder (all common RR types, EDNS0 / ECS / EDE), validated against the upstream project's JUnit fixtures.
• Built the full pipeline: S3 fetch → gzip/xz/bz2 decompress → packet parse → request/response join → 50-column row build → MaxMind GeoIP/ASN, public-suffix and resolver enrichment → Parquet write to day-partitioned S3.
• Wrote Parquet via Apache Arrow GLib FFI with ZSTD, dictionary encoding and deliberate row-group sizing; added a compactor that merges small per-file outputs into sorted ~128 MB–1 GB partition files for interactive query (DuckDB/Athena/Trino) over ~3.6 B rows/year.
• Hand-rolled an S3 client with AWS SigV4, a pure-Crystal MaxMind .mmdb reader, and liblzma/libbz2 FFI, keeping the runtime dependency surface minimal; verified against MinIO in CI.
• Designed the runtime as leaderless stateless workers on a RabbitMQ quorum queue, with hot-reloading enrichment data from S3 and separate compaction/refresh jobs - deployed as a single multi-call binary.

A framework and web admin console for self-hosted Linux game servers :: Crystal, systemd, GitLab CI

Framework plus per-game web consoles for administering self-hosted Linux game servers, currently supporting: Valheim & Conan Exiles

• One static binary is both the installer and the server: setup creates the service user, installs packages, and writes systemd units, sudoers rules and env files - idempotent, with --dry-run.
• Browser console built on the standard library alone, no external dependencies: live-streamed start/stop/restart/upgrade, server settings, save-game downloads, and world switching.
• Designed so unsafe operations are unreachable rather than merely hidden - file downloads are constrained by an allow-list the listing itself produces, and locked settings can't be written even by a forged request.
• ~3,900 lines of Crystal, 357 specs, and a 10-job integration matrix that installs and exercises the real binary under real systemd on Ubuntu 22.04/24.04/26.04 and Debian 12/13