Projects

A new courtroom evidence-presentation system had to work with the county’s courtroom AV and hand its audio off into the state court system.

I configured it with the vendor, including the audio handoff. Having worked in both county IT and state court IT, I knew both sides of the integration.

The courtroom’s evidence presentation and its audio into the state court system were set up together, in one install.

County staff kept getting locked out of their accounts. The standing fix was to reboot the workstation until it worked.

I traced the lockouts to workstations drifting out of time sync with the domain controller, and got a proper NTP configuration in place.

The lockouts stopped.

The working relationship between county IT and state court IT had broken down, and court IT’s access to county buildings had gone with it.

I rebuilt the working relationship, and briefed a state legislator in Boise on the scope and value of the new field technician position.

Court IT access restored to 9 of 10 county buildings.

Every rollout of the jury-questionnaire scanning tool began with a 55-minute vendor session hand-configuring the software before anyone could be trained.

I packaged the configuration as an MSI installer, so the tool deployed the same way as the rest of the managed software.

Idaho Supreme Court IT used it to deploy the tool to the remaining 38 to 40 of Idaho’s 44 counties.

A faulty CrowdStrike update left Windows machines unable to start. In the 7th Judicial District that meant courthouse computers in ten counties, needed by judges, clerks and staff that morning.

The first report came at 6:00 AM. I was on site in Bingham County before business hours, found the fix and alerted the Trial Court Administrator early. I handed the fix to Bingham’s county IT, rolled it out in Bonneville myself, and walked every other county through it by phone.

Nine of ten counties were back the same day. The tenth had no 16 GB USB drive on hand; I fixed it on site before business hours the next business day.

Field technicians couldn’t see their district’s ticket queue.

I designed two ServiceNow dashboards, one for field techs and one for their supervisor: each district’s tickets by county, assigned to the field tech or the service desk.

Field techs could pick up service-desk work between site visits.

The front desk ran on aging laptops, and only one could print, over a long USB cable. Event nights had a TV but no sound through the PA, and incoming email was failing.

I replaced the laptops with two desktops on a switched network, tied the event-night TV into the sound system with a new mixer, audited DNS, and started moving email from cPanel to Microsoft 365.

Both stations print and event nights have sound. The email migration is in progress.

The boutique had no website.

I built a storefront connected to its Poshmark shop, then rebuilt it on a Twenty Twenty-Five child theme in November 2026 and closed its user-enumeration leak.

A live storefront at aurumgroveboutique.com.

I gave an AI agent broad access to my homelab to organize and secure it. With little direction, it drifted toward one organizing style, wasted usage, and made changes in my name that I couldn’t explain.

I put an approval gate in front of every root command on my Proxmox hosts. Agents reach models through an AI gateway (LiteLLM) that prefers local models.

• Agents sign in with SSH certificates that expire after an hour, signed by HashiCorp Vault acting as a certificate authority. No permanent keys.
• A forced-command wrapper records each request with the agent’s name and stated reason, hashes the exact command, and won’t run it until approved. Any edit to the command needs a new approval.

1. Agent asks to run a root command
2. 1-hour certificate signed by Vault
3. Wrapper records and hashes the command
4. Policy check read-only or not
5. Read-only auto-approved, 15 minutes max
6. Anything else held for me
7. Run then written to the audit log

• The gate has logged 4,883 privileged requests from 39 agent identities since June. That audit trail survives a model swap, and it taught me how my own lab works.
• When I audited the gate itself, the data showed my convenience auto-approver was clearing 94% of requests within a minute without reading them. The gate was logging, not gating.
• I rebuilt the auto-approver so only read-only commands clear automatically: a 66-case test suite, rejecting pipes, redirection, shell wrappers and secret-looking paths. Anything that changes state waits for me.

Promotions and routine notices buried the messages that mattered across two inboxes (Gmail and Outlook).

I built n8n workflows on deterministic rules, with no LLM, so they don’t depend on an AI model and don’t spend tokens I’d rather use for development work.

• A sorter files known senders.
• A collector moves bulk promotions out of the inbox into a private RSS reader.
• A code broker lets other automations fetch a one-time login code, then trashes the email only after the login is confirmed. The email stays recoverable.

Guardrails: per-run caps; a protected list (banks, schools, utilities, job boards, billing and account senders); it never deletes or unsubscribes; codes are never logged; any error halts the run and pushes an alert. 61 tests passed before go-live.

• In the first two weeks, 101 promotions moved out of the inboxes.
• No mis-filed messages: when something looked off, the system stopped itself rather than guess. 5 halts, each caught before acting.

Earlier this year, one Proxmox host went down. It was running my secrets vault, password manager and single sign-on (Authentik), so I couldn’t authenticate to anything until it came back. Weeks later, I renamed the main node by mistake, and the container configs vanished with the old name.

• Restored the lost container configs from backup. Recovering for real is what taught me to trust, and test, the backups.
• Turned the two-server cluster into a three-vote quorum, with an off-site tie-breaker on a free-tier cloud VM, so a single host failure doesn’t freeze the cluster.
• Set boot order so the vault starts and unseals before anything that depends on it, and made dependent services fail closed instead of starting half-configured.
• Moved backups to NAS storage in tiers (daily for the vault and single sign-on, weekly for the password manager), with health-check alerts on every job and archive-integrity checks.

• When a RAID-controller fault took a host down in September, I restored its guests onto the other node from backup.
• A planned hardware upgrade went from power-off to all services green in 37 minutes.
• Next: automatic failover and replication for the identity services. This is planned, not built.