Forensic intelligence, AI semantic search, 4-layer network security. 299 MCP tools, 30 published dossiers, 68K+ threat vectors. 90+ services on one machine — zero cloud, zero monthly bills.
Built by Lișneanu Dumitru-Cristian — from a 44 m² village apartment near Iași, Romania
AI & Search
Built from scratch. Running in production on Kubernetes with local LLMs — no API keys, no data leaving the machine.
Semantic search across 131,000+ documents (1.2 TB) in 50+ formats. Three modes: keyword, semantic (vector kNN), and hybrid. Multilingual — understands Romanian, English, and 100+ languages via bge-m3 embeddings. Dual-model architecture: nomic-embed-text (English) + bge-m3 (multilingual), both running on CPU.
Terminal + web AI assistant running 100% locally. 182 MCP tools across 19 modules: K8S, MikroTik, CrowdSec, Docker, Elasticsearch, Prometheus, network diagnostics. Smart auto-routing selects optimal model (3B→14B) per query complexity. Web UI with 18 specialized model personas, voice I/O, dark web research tools.
400+ ZIM archives providing offline access to Wikipedia, StackOverflow, DevDocs, Khan Academy, medical references, and more. 42 custom SearXNG search engines with progressive RAG caching — AI answers backed by offline encyclopedic sources.
Safe dark web research: dedicated SearXNG routing through 3 Tor proxies with circuit rotation, Playwright anti-detection, custom safety filters blocking illegal content, curated .onion directory as RAG knowledge base. All research stays local.
Security
Defense in depth — from the router's raw prerouting chain to application-level auth. Every layer built and configured by hand.
CCR1009 router with 4-chain firewall: RAW prerouting (pre-conntrack drops), Filter (79 rules with SYN flood protection, port scanner detection, mail brute-force 3-strike escalation), NAT (15 port forwards), Mangle (QoS). 14 address lists, 563 entries. SSH honeypot redirecting attackers to Cowrie.
Community-driven IDS parsing Traefik access logs in real-time. Detects CVE exploits, brute force, crawlers, admin probing. Two bouncers: firewall (iptables) and MikroTik (REST API pushing bans to router address lists). Community threat intelligence feed for proactive blocking.
SSO gateway with a custom-built access management platform — 72 API endpoints, visual access matrix, OIDC management, auto-discovery, GitOps workflow, and Prometheus monitoring. The flagship project of this infrastructure. See the full showcase below ↓
SSH honeypot on port 22 (real SSH on internal only). Captures attacker credentials, commands, and malware. Custom Grafana dashboard (18 panels) with live attack feed, top attacker IPs, captured passwords, and malware download tracking. Integrated with Loki for log analysis.
Kernel-level runtime threat detection across all K8S pods. Detects container escapes, unexpected process execution, sensitive file access. Falco Sidekick forwards alerts to Telegram/Discord. Falco UI dashboard for investigation.
Trivy operator continuously scans all container images for CVEs. Custom dashboard for vulnerability trends. Vaultwarden (Bitwarden-compatible) for secrets management. ClamAV for file scanning. MikroTik security audit script (13 automated checks) with alerting.
🎯 Security Operations
A full security operations center and offensive testing platform running as a K3S namespace — 52 MCP tools, 4 AI model tiers, Tor-routed stealth scanning, cross-layer threat intelligence, automated weekly reports, and real-time Telegram alerts. Every component custom-built. Stats as of June 2026
Full-stack security operations dashboard with 10 interactive views: real-time honeypot intelligence (drill-down per IP, credential analysis, SSH fingerprints, command viewer), Falco runtime events with priority filtering, defense system status across all layers, IP correlation engine (query any IP across 4 systems), engagement management with action timelines, AI-powered pentesting chat with streaming responses and model selector, and a dedicated reports center with generate/view/download.
Custom MCP server (JSON-RPC 2.0 + SSE) exposing 52 tools across 8 categories: passive recon (crt.sh, DNS, WHOIS, Shodan), active scanning (nmap 8 scan types, masscan, httpx, subfinder), web exploitation (nuclei, nikto, sqlmap, ffuf, gobuster), brute-force (hydra — ssh/ftp/http/rdp), 16 MikroTik tools (router API gateway — firewall, DHCP, WireGuard, DNS, security audit), defense intel (CrowdSec, Falco, Cowrie cross-ref), K8s job orchestration, and persistent script library.
All external reconnaissance routes through a 3-replica Tor proxy cluster (SOCKS5 + Privoxy HTTP). Nmap uses proxychains4 with dynamic DNS resolution (background watcher re-resolves ClusterIP every 60s — zero-downtime IP rotation). httpx, nuclei, and nikto use native SOCKS5/HTTP proxy flags. 3 scan profiles: aggressive (T4, all ports), polite (T3, top 200, Chrome UA), stealth (T2, top 100, Safari UA, packet fragmentation). Exit IP verification via tor_check tool before each engagement.
Autonomous pentesting agent with 4 model tiers (Gemma 4 e4b for fast execution, Gemma 4 26B for deep analysis). 10 tool-group affinity rules auto-switch model based on task complexity. 12-step max engagement cycle with minimum 3 tool calls before conclusion. Streaming SSE responses with 8s heartbeat. Automatic retry logic: 3× Ollama, 2× MCP, 3× parameter validation. Smart target extraction from natural language requests. Findings normalized with LLM typo tolerance.
5 report types (full weekly, honeypot, Falco runtime, defense posture, security posture) generated on demand or via weekly CronJob (Sunday 06:00 UTC). Each report includes threat level assessment (🟢LOW → 🔴HIGH), visual severity metrics, address-list breakdowns, top attacker rankings, credential analysis, engagement summaries. Exports to rich Markdown, structured JSON, and direct Telegram delivery with HTML formatting. Reports archive persisted on 20Gi shared volume.
Ingests 336K+ events from Cowrie SSH honeypot. Inline aggregation (no intermediate lists — processes 190MB+ rotated JSONL in <1s). Event distribution charts, hourly heatmaps, credential wall (tag cloud sized by frequency), SSH client fingerprinting, captured command terminal viewer. Filter by time range, IP, event type. Every attacker signal feeds into CrowdSec CAPI — shared with 300K+ community installations globally.
Enter any IP and instantly see its footprint across all defense layers: CrowdSec ban status + scenario + origin (local/CAPI/import), MikroTik address lists (14 lists, 603 entries), Falco runtime alerts by priority, Cowrie honeypot activity (login attempts, commands, downloads). One-click drill-down from any attacker in the honeypot view. Threat level auto-computed: low → medium → high → critical based on multi-layer presence.
Kali-class container with 14 offensive tools: Nmap (8 scan types including SYN, UDP, OS, vuln scripts), Masscan (10K pps rate), Nuclei (community templates, severity filtering), Nikto, SQLMap (level/risk 1-5/1-3), Hydra (ssh/ftp/http/smb/rdp), FFuf, Gobuster, SSLyze, Searchsploit (Exploit-DB), httpx, subfinder. Custom Python scripting engine with persistent script library. K8s Job orchestration for long-running scans. Full engagement lifecycle: create → scan → chain → analyze → report → Telegram notify.
Live counts as of June 2026
🧠 Forensic Intelligence
What started as a monolithic HTML page of attackers became a complete forensic pipeline — honeypot data to structured investigation to vectorized memory to published dossier. Every layer interconnected. 18 Qdrant collections. Zero cloud.
817 structured investigations — each with confidence-rated findings, source-cited evidence, infrastructure nodes, actor profiles, and relationship graphs. Every claim traceable. Nothing published without passing every layer.
8,375 NLP-enriched chunks from court filings, WikiLeaks, OFAC sanctions, ODNI reports. Plus a full web threats intelligence layer: Traefik + CrowdSec + MikroTik unified into 4,444 IP profiles and 36 HTTP campaigns — same graph as the honeypot.
Everything vectorized via bge-m3: honeypot IPs, dossier findings, published articles, OSINT library docs, web threat profiles — 68,323 vectors across 18 collections, bridged by 16,050 entity crosslinks. Any connected AI model inherits the full intelligence picture instantly.
🏆 Flagship Project
A full access management platform built from scratch — the kind of tool that enterprises pay $500–1,000/month for, except this one understands your Kubernetes cluster, writes its own security policies, and commits every change to Git automatically. No commercial product does what this does.
Active Directory-style group × service grid. Click a cell to grant or revoke access. Three security groups, 64 services, every combination visible at a glance. Changes propagate to Authelia ACL rules instantly.
Background scheduler scans the Kubernetes cluster every 5 minutes. New IngressRoutes are detected, services registered, domains mapped — automatically. The platform always knows what's running.
Full CRUD management for Authelia OIDC/OAuth clients. Create, configure, and delete SSO integrations (Gitea, Grafana, Immich, OpenWebUI, and more) without touching YAML files. Config backup on every change.
Every access control change generates an ACL diff, writes to the Authelia config, copies to the git repository, and pushes to Gitea — all from one button click. Full audit trail. Every change is reversible.
70 internal .home.lsn routes, each with an independent auth toggle. Enable Authelia forwardAuth on any local service with one click — middleware is auto-created, IngressRoute patched, and git-synced in seconds.
Non-root container (zero capabilities), Traefik-only NetworkPolicy, login rate limiting, restricted PostgreSQL user with table-level permissions, cookie hardening — validated by a 52-test adversarial security audit.
View and edit Traefik middleware assignments across all namespaces. IP allowlist editor with live K8S API patches synced to git manifests. See which services use which middleware at a glance.
Prometheus metrics pipeline from Authelia → ServiceMonitor → Grafana. 15-panel dashboard: authentication rates, failures, latency, OIDC events, ban tracking. Real-time visibility into who's accessing what.
"The closest commercial equivalent is Auth0 + a custom Kubernetes operator + ArgoCD — roughly $500–1,000/month plus months of engineering. This was built in a week, runs on $0, and does things none of them can."
Network Management
The MikroTik router isn't just a gateway — it's a fully API-integrated node in the infrastructure, managed by AI agents, bots, and custom web UIs.
Custom web UI managing MikroTik wireless access via REST API. Three-tier device access: LAN Access (full network), Internet Only (isolated), Blocked. Modifies DHCP leases and firewall address lists in real-time. 45-panel Grafana dashboard. Also controllable via Telegram bot.
Custom web UI for full VPN peer lifecycle: create, configure, revoke. Generates QR codes for mobile onboarding. Prometheus metrics exporter for peer traffic and handshake monitoring. 9-panel Grafana dashboard. VPN subnet 192.168.89.0/24 with full LAN access.
Network-wide ad blocking and DNS filtering with custom blocklists. Prometheus exporter feeding a 19-panel Grafana dashboard: query rates, blocked percentages, top clients, upstream latency. Upstream DNS through MikroTik with failover.
Custom Python bot on Telegram + Discord. 70+ commands across 14 modules: MikroTik management, Kubernetes ops, CrowdSec security, classroom/Jitsi administration, monitoring, NAS, Docker, Tor, honeypot analytics. REST API for webhook integrations + autofix engine. Prometheus metrics endpoint. Runs 24/7 as systemd.
obfs4 bridge relay helping users in censored countries access the internet. Snowflake proxy running alongside. 3-replica Tor proxy cluster (SOCKS5 + Privoxy) powering stealth pentesting scans with zero attribution. Docker-isolated with iptables separation from LAN. IP watchdog for dynamic DNS. MikroTik raw firewall bypass for Tor peer traffic.
Full self-hosted email: SMTP, IMAP, JMAP with PostgreSQL backend. SnappyMail web client. Custom domains with DKIM/SPF/DMARC. MikroTik NAT forwards ports 25/465/587/993. Mail brute-force protection via 3-strike firewall escalation.
Full self-hosted video conferencing with JWT authentication. Prosody XMPP, Jicofo conference focus, JVB video bridge, Etherpad collaborative notes, Excalidraw whiteboard. Custom Prosody module (token_affiliation v6) enforces role-based moderator control from classroom RBAC. TURN relay via Coturn for NAT traversal.
Custom Flask web app managing Jitsi rooms with full role-based access control. Admin/teacher/student/guest roles with room-level moderator mapping. Guest registration with Telegram + email notifications, Authelia SSO on public domain, PostgreSQL backend. REST API with 22 endpoints. JWT tokens carry room-level roles to Jitsi via custom Prosody module.
Observability
Full observability stack — Prometheus + Grafana + Loki + Alertmanager. Every dashboard hand-built for this infrastructure.
Metrics collection from 15+ exporters: node, kube-state-metrics, MKTXP (MikroTik), pihole, DCGM (GPU), CrowdSec, WireGuard, Infra-Bot custom metrics. AlertManager routes to Telegram/Discord via Infra-Bot webhook.
Centralized logs from all K8S pods, Traefik access logs, Cowrie honeypot, AMP game servers, Tor daemon. Powers real-time dashboards: live attack feeds, access log analysis, bot detection, error tracking.
Endpoint monitoring for all public and internal services. HTTP/HTTPS, TCP, DNS, and Docker checks. Notifications via Telegram. Status page for service health overview.
vs. The Industry
Every service listed is running in production right now. Here's what the commercial equivalent would look like — and what it would cost per month.
| Category | Shuffle-On (Self-Hosted) | Commercial Equivalent | Monthly Cost |
|---|---|---|---|
| AI Chat & Assistants | Open WebUI + 54 local LLMs, unlimited | ChatGPT Team + Claude Pro | $50–100/user |
| AI Infrastructure Agent | LSN Agent + 192 MCP tools, auto-remediation | No direct equivalent exists | N/A — custom |
| Semantic Search (131K docs) | DocSearch + dual embeddings, multilingual | Algolia + Pinecone | $500–800 |
| Vector Database | Qdrant + Elasticsearch (7.5M vectors) | Pinecone Serverless | $70–300 |
| LLM Hosting (54 models, 435 GB) | Ollama on CPU, 4 parallel, 32K context | OpenAI / Anthropic API | $200–2,000 |
| Code AI Assistant | Tabby (local GPU) | GitHub Copilot Business | $19–39/user |
| Image Generation | ComfyUI + Stable Diffusion (GPU) | Midjourney + DALL-E | $30–60 |
| Kubernetes Cluster | K3S, 54 namespaces, 127 pods | AWS EKS + EC2 (88 vCPU, 503 GB) | $3,000–5,000 |
| Container Registry | Private registry + weekly GC | ECR / GCR | $50–100 |
| SSO & 2FA | Authelia + custom manager platform (72 APIs, ACL auto-gen, OIDC mgmt) | Auth0 / Okta | $200–500 |
| Firewall (4-layer) | MikroTik + CrowdSec + iptables + Traefik | Palo Alto / Cloudflare Pro | $200–500 |
| Runtime Security | Falco + Trivy + CrowdSec | Sysdig + Snyk | $500–1,500 |
| SSH Honeypot + SOC Platform | Cowrie + 52-tool AI SOC + Tor stealth + weekly reports | Thinkst Canary + Pentera | $500–2,000 |
| Monitoring (15 dashboards, 274+ panels) | Prometheus + Grafana + Loki + Alertmanager | Datadog (equivalent scope) | $500–1,500 |
| Log Aggregation | Loki | Splunk Cloud | $150–500/GB/day |
| DNS Filtering | Pi-hole (19-panel dashboard) | Cisco Umbrella | $50–100 |
| Email Server | Stalwart + SnappyMail + DKIM/SPF/DMARC | Google Workspace | $7–18/user |
| Video Conferencing | Jitsi Meet + custom RBAC classroom + TURN relay | Zoom Business + LMS | $20–50/user |
| VPN | WireGuard via MikroTik + custom UI | Tailscale Business | $5–18/user |
| Photo Management | Immich (ML face recognition, smart search) | Google Photos | $3–10 |
| Media Server | Plex + Tautulli + MiniDLNA | Netflix + Spotify Premium | $25–35 |
| Offline Knowledge | Kiwix (400+ ZIM, Wikipedia, StackOverflow) | No equivalent | Priceless |
| Backup | Velero + NAS CronJobs + 9 backup schedules | AWS Backup + S3 | $100–300 |
| Password Manager | Vaultwarden (Bitwarden-compatible) | Bitwarden Teams | $4–6/user |
| UPS / Power | 14 kWh battery + solar + generator | Enterprise UPS rack | $5,000–15,000 (one-time) |
| Tor Privacy Infra | Bridge + Relay + Snowflake + 3-replica scanning proxy + Onion research | No commercial equivalent | N/A |
| Threat Intelligence Platform | 817 investigations · 9,573 evidence items · 8,375 OSINT chunks · 68K+ vectors · 30 dossiers published | Recorded Future / Mandiant TI / ShadowDragon | $500–3,000 |
| Estimated commercial equivalent: $7,000–17,000/month (June 2026) | Shuffle-On: $0/month (self-hosted, one-time hardware investment) | ||
Everything Else
Every service self-hosted, configured, and maintained by hand. This runs alongside the AI and security stack on the same machine.
Power & Resilience
The entire infrastructure runs through UPS battery stations. Power outage? The server doesn't even blink. Gas generator and solar panel for extended grid-down scenarios.
Oukitel BP2000 (2,048 Wh, 2,200W AC, UPS mode) + 3× Oukitel B2000 expansion batteries (2,048 Wh each). Powers the Dell workstation, MikroTik router, and Synology NAS. Seamless UPS switchover — services stay online through power outages.
Oukitel P2001 Plus (2,048 Wh, 2,400W, LiFePO4) for the kids' bedroom — fast charging 80% in 1h. Fossibot F3600 (3,840 Wh, 3,300W) for the kitchen — 13 outputs, LCD monitoring, BMS protection. Every room has independent battery backup.
Herrgut HG2500i inverter generator (2,500W, silent 59 dB, eco mode, 6L tank, 3h runtime) for extended grid-down events. Oukitel PV400 solar panel (400W, 23% efficiency, monocrystalline, IP65) for off-grid recharging of all battery stations.
The Human
A small apartment in a village near Iași, Romania. Two kids, four cats, and a datacenter. This is where everything you see on this page comes from.
I build things. Infrastructure, furniture, music, sentences — it doesn't matter. If it's broken, I fix it. If it doesn't exist yet, I make it. If someone says it can't be done on a budget, I take that personally.
Everything on this page — 90+ services, 299 MCP tools, 4-layer firewall, 817 investigations, 15 dashboards, 14 kWh of battery backup — runs from a single workstation in a 44 m² apartment where my kids do homework, my cats rule every surface, and an 800W 5.1 Hi-Fi audiophile setup ensures the music never stops.
I write poetry and philosophical essays in Romanian and English — because building infrastructure for the mind and infrastructure for machines aren't that different. Every mistake is a lesson. Every downfall is a reason to grow. Knowledge never dies.
"To the evil minds — try me. My honeypots are waiting.
To the envious — look closer, and you'll find only open source.
To the brilliant and the pure — come build with me."
Need self-hosted AI? A semantic search solution? An infrastructure that belongs to you? A security stack with honeypots, IDS, and real-time dashboards? I build these things from a village apartment — imagine what I can build for you.
Iași County, Romania 🇷🇴 · Available for remote work worldwide · The music is always on