:linux: Qubes OS is a security-focused operating system that protects your digital life through compartmentalization. Rather than running everything in one shared space, it divides your computer into isolated virtual machines called "qubes" -- think of them as separate, secure rooms. If malware infects your web browser, it stays trapped in that single qube and cannot access your email, files, or other applications.

![qubesos-trustlevel-architecture](https://doc.qubes-os.org/en/latest/_images/qubes-trust-level-architecture.png)

Most operating systems try to prevent every possible attack, but Qubes takes a different approach: it assumes compromises will happen and focuses on containing the damage. This means journalists, researchers, privacy advocates, and :privacytech: security-conscious professionals can use their computers with confidence, knowing that a breach in one area won't compromise everything else. Each qube displays with its own colored window border so you always know which environment you're working in.

My Contributions:

- **Bug Fix:** Fixed a false-positive reboot prompt in :debian: templates when using the dom0-provided kernel — `needrestart`'s `kernelhints` was comparing the running kernel against `/boot`, which always differs in this configuration. Disabled `kernelhints` via `50_qubes.conf` when dom0 kernel mode is active  
  [qubes-core-agent-linux #645](https://github.com/QubesOS/qubes-core-agent-linux/pull/645)

- **Feature:** Added an optional comment/notes field to firewall rules in Qubes Manager, closing a feature request open since 2015 (issue #952). Comments are stored as metadata and don't affect firewall behavior;
  [qubes-manager #447](https://github.com/QubesOS/qubes-manager/pull/447)

- **Security Fix:** Prevented `qvm-device` from attaching devices to dom0 without an explicit `--force` flag, adding a safeguard against accidental attachment to the privileged domain. Implemented across both the core admin layer and the admin client :cli: CLI  
  [qubes-core-admin #798](https://github.com/QubesOS/qubes-core-admin/pull/798) · [qubes-core-admin-client #466](https://github.com/QubesOS/qubes-core-admin-client/pull/466)

- **Feature:** Added a Qubes-specific extrepo configuration for :debian: templates, using `config-package-dev` displacement to avoid conflicts with the upstream `extrepo` package. The configuration points extrepo at local offline data by default, enabling users to safely add external repositories (e.g., Signal, Element) in templates without direct network access or manual GPG key management. 
  [qubes-core-agent-linux #648](https://github.com/QubesOS/qubes-core-agent-linux/pull/648)

- **Docs:** Simplified and de-alarmed the :fedora: and :debian: template upgrade documentation, reducing friction for users who felt intimidated by the existing warning-heavy language  
  [qubes-doc #1662](https://github.com/QubesOS/qubes-doc/pull/1662)

- **Bug Fix / Consistency:** Renamed `--app` to `--apps` in `qubesctl` for consistency, with matching documentation update  
  [qubes-mgmt-salt #45](https://github.com/QubesOS/qubes-mgmt-salt/pull/45) · [qubes-doc #1672](https://github.com/QubesOS/qubes-doc/pull/1672)

- Selected for :oss: GSoC 
  https://summerofcode.withgoogle.com/programs/2026/projects/vjESxjOp

- Automating template version upgrade process 
[qubes-core-admin-linux #213](https://github.com/QubesOS/qubes-core-admin-linux/pull/213/)

[Cover Picture Credits](https://lede-admin.dailydot.com/wp-content/uploads/sites/69/2025/01/the-work-is-mysterious-and-important-meme.jpg?w=710)

GSoC'26 | The most secure operating system.

Qubes OS

![Free The Internet](https://blog.torproject.org/advancing-digital-rights-in-2026/lead.png)

## Arti (Tor's Rust Implementation)

### Timestamp Tracking for RetryError :Rust:
 
This enables developers and operators to see precisely when each failure occurred and measure how long retry sequences lasted meaningfully improving debuggability of connection failures in a privacy-critical networking stack.

https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3506

### SOCKS5 Proxy Support :Rust:

Implemented SOCKS5 proxy functionality in Arti, contributing to one of the core interoperability features needed for Arti to serve as a drop-in replacement for the C Tor client. SOCKS5 is the primary protocol through which applications route traffic over Tor.

https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3681

### HTTP CONNECT Proxy :Rust:

Added HTTP CONNECT proxy support to Arti, enabling HTTP-based clients and tools to tunnel connections through Arti without requiring SOCKS support. This expands compatibility with a broad class of software that relies on the HTTP CONNECT method for proxying.

https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3692

---

## Onion Services

### Arti Integration for Onion v3 Key Generation — OnionMine :Rust:

Integrated Arti's cryptographic primitives into OnionMine to support onion v3 (ed25519-based) key generation. This replaces reliance on older tooling and aligns the project with the modern, more secure v3 onion address standard.

https://gitlab.torproject.org/tpo/onion-services/onionmine/-/merge_requests/58

### Docker Image Size Reduced by 80% — OnionMine :Docker:

Optimized the OnionMine Docker image, shrinking it by 80% and cutting build times by ~15 seconds. Achieved through multi-stage builds and dependency pruning — directly improving CI pipeline speed and deployment efficiency.

https://gitlab.torproject.org/tpo/onion-services/onionmine/-/merge_requests/54

### Arch Linux Build & AUR Package — OnionSpray :Arch Linux: :Shell:

Added Arch Linux build support and published an [AUR](https://nihal.is-a.dev/projects/pkgbuilds) package for OnionSpray, making the tool accessible to the large Arch Linux user base without requiring manually building the project.

https://gitlab.torproject.org/tpo/onion-services/onionspray/-/merge_requests/140

---

## Snowflake

### Proxy State Icon & Client Counter — Snowflake WebExtension :Javascript:

Fixed the Snowflake browser extension so the toolbar icon accurately reflects the current proxy state (active/inactive) in real time, and added a badge displaying the running count of clients served. Snowflake is a critical pluggable transport used to circumvent censorship in restrictive regions — this improvement gives users clear, immediate feedback that their node is functioning correctly.

https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake-webext/-/merge_requests/97

---

## P4

### Onionize Links in Tor Browser :Javascript:

Proposed and developed a feature to automatically convert clearnet URLs to their onion equivalents within Tor Browser, improving privacy and onion service adoption for end users.

https://gitlab.torproject.org/tpo/applications/tor-browser/-/merge_requests/1824

### Update AnonTicket Integration

Migrated the AnonTicket integration from the legacy Tor Project infrastructure to the current platform, ensuring the anonymous issue-reporting workflow remains functional for Arti contributors and users.

https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3500

### Arti Documentation Improvements

Proposed issue templates for the Arti codebase to reduce maintainers overhead.

https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/3507

### Bug Report: Default Tabs Not Opening with History Enabled — Tor Browser

Identified and reported a reproducible bug in Tor Browser where default tabs fail to open when browsing history is enabled, helping the browser team track down a session-management regression.

https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44503

---

All contributions were made to production repositories under active use by privacy and security-conscious users worldwide. ❤️

[Cover Credits 1](https://i.pinimg.com/1200x/5b/2b/60/5b2b60706f820fb9660350653776ac3b.jpg)

[Cover Credits 2](https://blog.torproject.org/advancing-digital-rights-in-2026/lead.png)

Systems, networking protocols, DevOps, and browser internals.

Tor Project

## Zed :rust:

My first editor was Atom, and it shaped how I think about developer tooling. Years later, contributing to Zed - built by some of the same people who shaped Atom - feels like a full-circle moment.

I have been using Zed for over a year. The speed is astounding. This contribution journey began while developing an MCP extension for the Arch Linux package server. During extension development, I found a bug in the configuration modal, reported it, and started working on a fix - only to find someone had already submitted a patch. Perks of an active community. Rather than discard the setup effort, I tackled another issue I had personally encountered, and things snowballed from there.

What started as one extension contribution grew into a sustained series of contributions and selection in the **[Zed Guild](https://zed.dev/community/zed-guild)** program, spanning terminal rendering, the debugger, font infrastructure, Linux platform integration, and the git UI - both features and fixes.

---

### Features

- **Linux Global Menu Bar** - Implemented native global menu bar support for Linux (X11 and Wayland) via the D-Bus protocol, enabling desktop environment integration on KDE Plasma, GNOME (with AppIndicator), Unity, and compatible DEs. Involved hooking into GPUI's action system and translating it into D-Bus menu trees at runtime.  
    [Pull Request #51321](https://github.com/zed-industries/zed/pull/51321)
    
- **Browser / WebView Tab** - Prototyped a native browser tab inside Zed using the system webview via `wry` (Tauri's cross-platform webview library), composited as a native child view within GPUI's window. A proof-of-concept exploring GPUI's compositing model for embedding non-GPU-rendered surfaces.  
    [Pull Request #52447](https://github.com/zed-industries/zed/pull/52447)
    
- **Buffer Letter Spacing** - Threaded a new `buffer_letter_spacing` setting through GPUI's text layout, shaping, and platform text backends, and wired it into the editor's rendering and line-wrapping pipeline so layout, hit-testing, and cursor positioning all stay consistent. Revived and extended a previously approved-but-stalled PR.  
    [Pull Request #53542](https://github.com/zed-industries/zed/pull/53542)
    
- **Pin / Unpin Recent Projects** - Added pin and unpin support to the recent projects panel, allowing users to anchor frequently-used workspaces so they persist regardless of recency ordering.  
    [Pull Request #52103](https://github.com/zed-industries/zed/pull/52103)
    
- **Vim Navigation in Git Graph** - Wired up Vim mode navigation (`j`, `k`, `gg`, `G`) in the Git Graph view, making it consistent with the rest of Zed's Vim bindings.  
    [Pull Request #53609](https://github.com/zed-industries/zed/pull/53609)
    
- **Ctrl+Click in Terminal** - Implemented interactive terminal output parsing with Ctrl+Click navigation and drag selection, enabling instant file/line jumps from error messages and stack traces.  
    [Pull Request #42526](https://github.com/zed-industries/zed/pull/42526)
    

---

### Bug Fixes

- **Debugger: Offline Cache** - Diagnosed and fixed the debugger failing entirely when Zed runs without network access. The fix ensures the debugger falls back to a locally cached adapter rather than aborting.  
    [Issue #45781](https://github.com/zed-industries/zed/issues/45781) · [Pull Request #50928](https://github.com/zed-industries/zed/pull/50928)
    
- **Debugger: Local Fallback** - Fixed the debugger failing to locate a locally installed `debugpy` when offline, causing silent breakage for Python debugging workflows. The fix wires in a proper local lookup path.  
    [Pull Request #51696](https://github.com/zed-industries/zed/pull/51696)
    
- **Linux Auto-Updater Error Surfacing** - Previously, missing system dependency failures during auto-update would silently return to idle with no user guidance. Fixed the error path to surface actionable feedback.  
    [Pull Request #50637](https://github.com/zed-industries/zed/pull/50637)
    
- **Terminal True-Color Rendering** - Fixed true-color rendering in the terminal where Zed's APCA contrast adjustment algorithm was washing out explicitly-specified 24-bit colors, overriding what the application had set.  
    [Pull Request #52162](https://github.com/zed-industries/zed/pull/52162)
    
- **Git Panel: Trash Untracked Files** - Fixed a silent failure when trashing untracked files from the git panel while a repository subdirectory (rather than the repo root) was open as the workspace root.  
    [Pull Request #51161](https://github.com/zed-industries/zed/pull/51161)
    

---

### Bug Reports

- **Launchpad Viewport Shift on Panel Resize** - Identified and documented a rendering issue where resizing the terminal panel incorrectly shifts the background Launchpad view, affecting users with workspace restoration enabled.  
    [Issue #52145](https://github.com/zed-industries/zed/issues/52145)
    
- **Git Graph: Vim Navigation Missing** - Reported the absence of Vim mode support in the Git Graph view, which I subsequently fixed.  
    [Issue #53525](https://github.com/zed-industries/zed/issues/53525)
    
- **Docs Search Bar Keyboard Navigation** - Identified a keyboard navigation failure on zed.dev/docs where the search results pane fails to scroll with arrow keys, leaving keyboard-driven users stranded.  
    [Issue #50604](https://github.com/zed-industries/zed/issues/50604)
    
- **Extension Configuration Modal Scroll** - Identified viewport rendering issues in the context server configuration modal affecting scroll behavior and height calculations.  
    [Issue #42342](https://github.com/zed-industries/zed/issues/42342)
    

---

### Reproduced & Triaged

Reproducing bugs is often the hardest part of fixing them - it verifies that a reported issue is real, environment-independent, and actionable. I reproduced and elaborated on several open issues to help maintainers prioritize and fix them:

- [Agent panel input box regression](https://github.com/zed-industries/zed/issues/52424#issuecomment-4138218221)
- [Linux hang under specific workspace conditions](https://github.com/zed-industries/zed/issues/50612)
- [Ctrl-Z undo granularity inconsistency](https://github.com/zed-industries/zed/issues/51484)
- [Recent projects persistence edge cases](https://github.com/zed-industries/zed/issues/16999)
- [Tasks: custom env variables being substituted incorrectly](https://github.com/zed-industries/zed/issues/34528)
- [Codex CLI re-authentication flow](https://github.com/zed-industries/zed/issues/53689)
- [Triaged: Opencode ACP input prompt](https://github.com/zed-industries/zed/issues/53506)
- [Triaged: Git panel status display](https://github.com/zed-industries/zed/issues/53694)

---

### Extension

- **Arch Linux MCP Server** - Developed a Model Context Protocol extension for the Arch Linux package database, published to the Zed extensions marketplace to enhance AI assistant capabilities within Zed.  
    [Pull Request #3882](https://github.com/zed-industries/extensions/pull/3882/)

---

[Cover Picture Credits](https://blog.stackademic.com/reviewing-zed-the-ide-of-the-future-305d681d990c)

Zed Guild 12wk Summer Program | Contributions to the high performance editor

[![PyPI Downloads](https://static.pepy.tech/personalized-badge/arch-ops-server?period=total&units=INTERNATIONAL_SYSTEM&left_color=BLUE&right_color=BLACK&left_text=PyPi+Downloads)](https://pepy.tech/projects/arch-ops-server)

![Claude Demo](https://raw.githubusercontent.com/nihalxkumar/arch-mcp/main/assets/claudedesktop_signalcli.gif)

# Core Problem Solved:

The Arch User Repository (AUR) comprises user-submitted packages that are occasionally unverified. It relies on end users to perform manual safety checks before installation. Arch MCP addresses this issue by allowing users to express their intentions in natural language. The AI then analyzes this input to provide intelligent recommendations, empowering users to make well-informed decisions.

### Protocol Implementation & Architecture

- **MCP Server Development**: Built custom MCP server implementing the full protocol specification (resources, tools, prompts)
- **JSON-RPC 2.0 Transport**: Bidirectional client-server communication with lifecycle management
- **Cross-Platform Compatibility**: Works on both :archlinux: and non-:archlinux: systems 
- **Multi-Transport Support**: STDIO and HTTP transports for flexible deployment scenarios

### Security-First Engineering

- **PKGBUILD Static Analysis Engine**: 50+ security checks detecting malicious patterns (curl pipes, privilege escalation, data exfiltration)
- **Package Trust Scoring**: Multi-factor risk assessment (maintainer reputation, vote count, last updated, out-of-date flags)
- **Sandboxed Execution**: No direct package installation—AI provides analyzed data for informed user decisions
- **Safe-by-Design**: Operations referencing only official :archlinux: sources (wiki, repos, AUR API)

### Key Features & Capabilities

- **Package Lifecycle**: Search, install (with security checks), remove, update checking with dry-run validation
- **System Monitoring**: Disk space analysis, failed services detection, boot logs, transaction history
- **Security Analysis**: PKGBUILD scanning, package integrity verification, orphan detection
- **Mirror Management**: Speed testing, health checks, fastest mirror suggestions by geolocation
- **Documentation Access**: Arch Wiki search with relevance ranking, news monitoring for critical updates

**Intelligent Workflows (Prompts):**
- **Safe System Update**: Multi-stage workflow (critical news check → disk space → update listing → service verification)
- **AUR Package Audit**: Pre-installation security workflow (metadata analysis → PKGBUILD scan → risk report)
- **Dependency Analysis**: Installation planning with repository checks and dependency mapping
- **Troubleshooting Assistant**: Keyword extraction → Wiki search → contextual recommendations

**Asynchronous Design**
- Non-blocking I/O for concurrent Wiki/AUR/Repo queries
- Async :python: HTTP client for parallel mirror speed testing
- Stream-based log parsing for real-time system diagnostics

Docs: https://docs.nihalxkumar.dev/arch-mcp/

:python: PyPi Package:  https://pypi.org/project/arch-ops-server/

:cursor: Zed Extension: https://zed.dev/extensions/arch-mcp


---

[Cover Picture Credits](https://www.tvline.com/img/gallery/a-breaking-bad-actor-almost-played-the-offices-michael-scott/intro-1759386316.jpg)

Server that bridges AI assistants with the Arch Linux ecosystem

Arch Linux MCP Server

## Overview

A high-performance, self-hosted, production-ready clipboard sharing service built with :rust:, enabling secure text snippet sharing across devices through dual interfaces (web + CLI) with password protection and automatic expiration.

## Technical Highlights

**Core Technologies:** :rust: • :rocket: • :tokio: • SQLX • :sqlite: • Handlebars

### Architecture & Design Patterns

- **Layered Architecture**: Clean separation of concerns across presentation, service, data, and domain layers
- **Domain-Driven Design**: Type-safe business logic with dedicated domain entities and validation
- **Repository Pattern**: Abstracted data access layer with compile-time :sql: verification using SQLX
- **Async-First Design**: Tokio runtime powering concurrent request handling and background workers

### Performance Optimizations

- **Batched Hit Counting**: Asynchronous worker threads aggregate view counts, reducing database writes by 90%+
- **Non-blocking I/O**: Fully asynchronous request pipeline from HTTP to database
- **Compile-time Query Validation**: Zero-overhead :sql: checks eliminate runtime query errors

### Developer Experience

- **Migration-based Schema**: Version-controlled :sql: migrations for reproducible deployments
- **Type-safe Queries**: Compile-time verification prevents :sql: injection and schema mismatches
- **Connection Pooling**: Efficient resource utilization under high concurrency
- **Build System**: Cargo with environment configuration
- **Error Handling**: Comprehensive error handling using :rust:'s Result types and custom error propagation. 
- Modular design enabling independent testing of each layer. 
- Zero-copy optimizations where applicable
- Structured logging for observability

```shell
Zingat API Client

USAGE:
    clipclient --api-key <api-key> [addr] <SUBCOMMAND>

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
        --api-key <api-key>    

ARGS:
    <addr>     [env: ZINGAT_ADDR=]  [default: http://127.0.0.1:8000]

SUBCOMMANDS:
    get       
    help      Prints this message or the help of the given subcommand(s)
    new       
    update
```

![zingat-diagram](https://github.com/nihalxkumar/zingat/raw/main/assets/zingatdiagram.png)

Zingat

The infrastructure uses Infrastructure-as-Code principles with :ansible: for bare-metal provisioning and :argocd: for continuous deployment, enabling reproducible, version-controlled infrastructure management.

The entire stack—from OS-level security hardening to application deployments—is managed through declarative configuration files. Changes flow through :git: commits that trigger automated validation pipelines and :argocd: synchronization, ensuring the cluster state always matches the repository.

### Technical Architecture

Kubernetes Platform (K3s)

The cluster runs K3s v1.30.2, a lightweight :kubernetes: distribution optimized for edge and single-node deployments. Configuration includes custom TLS SANs for remote API access, disabled bundled Traefik (replaced with a custom deployment), and local-path storage for persistent volumes.

GitOps Deployment (ArgoCD)

:argocd: implements an app-of-apps pattern for hierarchical deployment management:

- Root Application: Syncs infrastructure components (Traefik, :terraform:, monitoring)
- ApplicationSet: Dynamically creates Applications for each service in kubernetes/apps/
- :helm: (Kustomize): Provides layered configuration with base manifests and environment overlays
- Auto-sync: Enabled with pruning and self-heal for drift detection

All changes to the cluster must pass through :git:, eliminating manual kubectl apply operations and ensuring full audit trails.

CI/CD Pipeline (:gitlab:)

A three-stage pipeline validates every merge request:

| Stage | Checks |
|-------|--------|
| Lint | :ansible: playbook linting, README validation |
| Validate | Kustomize build verification, :kubernetes: schema validation |
| Security | detect-secrets scanning, SOPS encryption verification |

Renovate bot automates dependency updates with staged rollout policies—patch updates auto-merge after 7 days, while major updates require monthly review.

Ingress & TLS (Traefik + cert-manager)

Traefik serves as the ingress controller with TLS termination via cert-manager. Certificate issuance uses Let's Encrypt DNS-01 challenges through Cloudflare API tokens, enabling wildcard certificates for *.nihalxkumar.dev without exposing HTTP-01 challenge endpoints. A custom tailscale-only middleware restricts internal services to the Tailscale tailnet CIDR (100.64.0.0/10), while the public dashboard uses standard TLS with Let's Encrypt certificates.

Network Security (Tailscale + UFW)

A multi-layered security approach:
- VPN Access: Tailscale operator enables MagicDNS for secure service exposure via tailnet
- Firewall: UFW rules configured via :ansible:—default deny incoming, explicit allow for :kubernetes: API (6443), HTTP/HTTPS, pod/service CIDRs (10.42.0.0/16, 10.43.0.0/16), and VXLAN overlay (8472/udp)
- SSH Hardening: Root login disabled, password authentication disabled, key-only access via Tailscale interface
- Network Policies: :kubernetes:-native segmentation (e.g., :n8n: only accepts traffic from traefik, tailscale, and monitoring namespaces)

External traffic flows through Cloudflare Tunnel → localhost:443 → Traefik → services, providing DDoS protection and WAF without exposing the VPS IP.

Observability Stack

:prometheus: and :grafana: provide metrics collection and visualization with pre-configured dashboards for Traefik, :argocd:, and node metrics. Axiom aggregates logs via Fluent-bit DaemonSet, collecting systemd journal and container logs with :kubernetes: metadata enrichment (pod, namespace labels). All monitoring components use Tailscale ingress for secure access.

Secrets Management (SOPS + Age)

All secrets are encrypted at rest using SOPS with Age encryption keys. The repository enforces this via CI pipeline—files in secrets/ directories must use .sops.yaml extension, and the pipeline verifies SOPS envelope presence before merge. KSOPS (:kustomize: SOPS generator) decrypts secrets at build time, integrating seamlessly with :argocd:'s GitOps workflow.


![kubernetes-hell](https://c.tenor.com/tvtnW8BmD-YAAAAd/tenor.gif)

Deployed Services as of 02/22/2026

| Service | Purpose | Access | Notable Config |
|---------|---------|--------|----------------|
| Glance | Dashboard & :kubernetes: monitoring | Public (maya.nihalxkumar.dev) | Split deployment (UI + :kubernetes: API bridge), ClusterRole for metrics |
| :n8n: | Workflow automation | Tailscale-only | Daily backups (30-day retention), NetworkPolicy isolation, :prometheus: PodMonitor |
| KaraKeep | AI-powered bookmarks | Tailscale-only | Meilisearch + Headless Chrome, :openai: Gemini AI integration |
| DeepWiki | AI documentation generator | Tailscale-only | Dual-port (UI:3000, API:8001), Google embedder |
| The Lounge | IRC web client | Tailscale-only | HostNetwork proxy, persistent sessions |

---

Infrastructure as Code (:ansible:)

Four playbooks handle bare-metal provisioning:

| Playbook | Purpose |
|----------|---------|
| k3s.yml | :kubernetes: installation, kubeconfig setup, prerequisites (open-iscsi, nfs-common) |
| security.yml | UFW firewall rules, SSH hardening, fail2ban installation |
| tailscale.yml | VPN client installation, MagicDNS configuration |
| dns-tunnel.yml | Cloudflare Tunnel setup for public DNS routing |

Variables are managed via :ansible: Vault with a .vault_pass file, ensuring sensitive values (Tailscale auth keys, Cloudflare tokens) are encrypted in the repository.

---

Key Metrics

- 5 containerized applications deployed across dedicated namespaces
- Single-node :kubernetes: cluster on 6GB RAM / 5 vCPU / 100GB NVMe
- Zero public SSH exposure (Tailscale-only access)
- Automated certificate renewal via Let's Encrypt DNS-01
- Daily automated backups with 30-day retention
- 3-stage CI pipeline with security gates
- Automated dependency updates via Renovate

---

Skills Demonstrated

- Infrastructure-as-Code: Declarative infrastructure with :ansible: playbooks and :kubernetes: manifests
- GitOps: :argocd: for continuous deployment, app-of-apps pattern, :helm: overlays
- DevSecOps: SOPS encryption, CI security gates, NetworkPolicies, UFW firewall
- :kubernetes: Administration: Resource management, RBAC, ingress configuration, storage orchestration
- Self-Hosting: Production-grade service deployment on constrained resources
- Observability: :prometheus: metrics, :grafana: dashboards, centralized logging
- Automation: Renovate dependency management, automated backups, self-healing deployments

---

This homelab demonstrates production-ready infrastructure practices applied to a personal project—from automated provisioning to secure service exposure, all managed through version-controlled declarative configuration.

[Cover GIF Credits](https://www.theguardian.com/tv-and-radio/2025/feb/10/breaking-bad-euphoria-industry-drugs-on-tv-weed-crack-cocaine-meth)

GitOps-driven K3S running self-hosted services

Homelab

## Linux Adoption :linux:

Helping Windows users migrate away from end-of-life systems toward modern, sustainable alternatives.

Despite being a privacy advocate for years, switching to Linux felt daunting. A Discord stranger walked me through it in 2024, and I've never had a better computing experience. Now I pay it forward—reducing suffering, one migration at a time.

- **Community Impact:** Directly assisted 5+ individuals through complete OS migrations; contributed documentation improvements to transition resources  
  https://invent.kde.org/websites/endof10-org/-/merge_requests/214

---

## Zen Browser

My daily driver since it's release.

- **Fix:*** prevent new window when shift-clicking links in split view glance.
  https://github.com/zen-browser/desktop/pull/11424

---


## Anytype :typescript:

Local-first knowledge management platform with P2P sync, emphasizing data sovereignty and offline capabilities.

When I switched to Linux, I needed a native Notion alternative. Tried Anytype and loved its feature richness, though I eventually settled on Obsidian. Still use it for specific workflows.

- **Bug Report:** Documented visual rendering bug where container boundaries leaked into viewport  
  https://github.com/anyproto/anytype-ts/issues/1074

---

## FreeTube :javascript:

Privacy-respecting YouTube client with 300k+ downloads, eliminating ads and tracking while preserving functionality.

I've been using FreeTube since 2022, and this missing feature always bothered me. Decided to scratch my own itch and implement it for the community.

- **Feature:** Implemented queue management system allowing users to remove individual videos from the playback queue  
  https://github.com/FreeTubeApp/FreeTube/issues/6968

---

## OldTwitter :javascript:

Browser extension restoring legacy Twitter UI for users preferring the classic interface over X's redesign.

The sneak peak of upcoming tweet was distracting and doom-scroll inducing. Built Zen Mode to strip away distractions and center single tweets.

- **Feature:** Designed and implemented Zen Mode for distraction-free single-tweet viewing, reducing UI clutter  
  [Discussion #1141] https://github.com/dimdenGD/OldTwitter/discussions/1141

---

## Prav :xmpp: :hugo:

Privacy-focused messaging platform built on XMPP protocol, offering E2EE communication without central servers.

Like Linux, I'd always known about XMPP but assumed it was too complex. Prav proved me wrong—it made XMPP approachable. Now I maintain their web presence to help others discover the same simplicity.

- **Web Development:** Maintaining and developing the project's landing website to showcase features and drive adoption  
  https://codeberg.org/nihalxkumar/prav-website

---

## SponsorBlock

Crowdsourced browser extension that automatically skips sponsored segments, intros, off-topic tangents, and filler in YouTube videos.

Random internet strangers saving each other's time 🫡

- **Database Contribution:** Actively submit segment timestamps for sponsor detection, helping maintain the community-driven skip database  
  https://fxtwitter.com/nihalxkumar/status/1937143982800118213

---

_...and more contributions adding value to the open-source ecosystem_

[Cover Picture Credits](https://gamerant.com/game-of-thrones-many-faced-god/)

Misc Contributions

Anonymous discussion app connecting university students for focused, constructive, and enjoyable conversations. 

Designed in 2023. See more details on Behance.

UI Design for anonymous college social network 

WIZSPACE

## Overview

Arch Linux :ArchLinux: is a lightweight, rolling-release Linux distribution favored by developers for its minimalist design philosophy and cutting-edge software packages. Unlike distributions that bundle pre-compiled software, Arch provides users with powerful package management tools and expects them to build their system to their exact specifications.

The Arch User Repository (AUR) is a community-maintained repository containing over 85,000 user-contributed packages making it one of the largest software repositories in the Linux ecosystem. The AUR serves millions of Arch Linux users worldwide, providing access to software ranging from bleeding-edge development tools to specialized scientific applications. The ecosystem thrives on user contributions, encouraging collaboration and knowledge sharing.

Each AUR package requires writing PKGBUILDs - specialized bash scripts that automate source fetching, dependency resolution, compilation, and installation. This demands deep understanding of build systems (Make, CMake, Meson), compilation flags, and cross-platform compatibility.

Maintaining packages requires git workflows, semantic versioning, tracking upstream changes, writing clear installation instructions, maintaining changelogs, testing packages across different system configurations, handling edge cases, and ensuring reproducible builds. This entire process develops the quality-focused mindset essential for shipping reliable software.

I also review packages submitted by other maintainers.

## Technical Highlights

**Core Skills:** Shell Scripting • Package Management • Build Systems • Dependency Resolution

## Process

- Understanding codebase of the source repository
- Writing maintainable build scripts (PKGBUILD)
- Handling diverse build systems (`make`, `cargo`, `npm`, `pip`, etc)
- Managing dependencies (`makedepends`, `depends`, `optdepends`)
- Implementing version schemes (`pkgver` functions, VCS packages)
- Creating installation hooks and file placements
- Test builds in clean `chroot` environments
- Monitoring upstream projects for new releases
- Reporting issues to upstream maintainers
- Contributing patches when needed
- Act on community feedback

This entire process develops the quality-focused mindset essential for shipping reliable software.

---

[Cover GIF Credits](https://www.youtube.com/watch?v=PonI1eXZqg8)

Arch Linux Packages

## Philosophy

Ever since I took my first breath, I’ve relied on communities. It’s the shared support of individuals; each contributing their part in a collaborative effort that allows us all to grow. I believe and work on building open spaces where people can learn, grow, and solve important problems together.

## Active Community Building

In my first semester, I noticed a gap that students from previous batches had no organized peer community/platform to talk on. I took the initiative to build one from the ground up. Created a **Discord Server** and a **Matrix Space** which now consists of **900+ members** through persistent outreach and explainer sessions. Along with that, I created a [GitHub Organization](https://github.com/bits-bsc-cs) to work on projects together, which saw light to a [discord bot](https://github.com/bits-bsc-cs/discord-bot), along with a [LinkedIn Group](https://www.linkedin.com/groups/14460056/). Our community is uniquely diverse; members aged 16–65, including career starters, career changers, and lifelong learners.

A lot of collective time and effort has been spent in building this the best student discord community server ever. Together, A supportive environment was created where students and professionals, from first-years to alumni, can connect, share knowledge, and learn from one another.

![DC-BITS-Meetup](https://gist.github.com/user-attachments/assets/ec419b17-608b-438e-8a41-03eefb3330a3)

## Passive Community Building

These days (Nov '25) I actively participate in [Ente](https://ente.io), [FOSS United and its related groups](https://fossunited.org/), [KDE India](https://kde.org/), [Rust Delhi](https://www.meetup.com/rustdelhi/), [OSM India](https://www.openstreetmap.in/), [FSCI](https://fsci.in/) and other privacy communities under disguised names.

These contributions go beyond code. I engage in discussions that actually are important for all of us. I believe in the power of collaborative effort to solve problems that no individual could tackle alone.

![Teamwork-Growth](https://marketplace.canva.com/WWw78/MAEZYCWWw78/1/tl/canva-business-team-illustration--MAEZYCWWw78.png)

[Cover Picture Credits 1](https://www.istockphoto.com/vector/group-of-diverse-people-with-arms-and-hands-raised-towards-a-hand-painted-heart-gm1436319269-477390231) [Picture 2 Credits](https://marketplace.canva.com/WWw78/MAEZYCWWw78/1/tl/canva-business-team-illustration--MAEZYCWWw78.png)

because communities drive societal development

Nihal Kumar

Projects

Loading...