Emil Emilov

Runs network operations for a full hotel property day to day, then mirrors the same patterns at home to keep the muscle memory sharp.

Inbound-closed by default — every remote path goes through an explicit tunnel or mesh, never an open port.

Runs a real multi-tenant Proxmox host at home the same way you would run one in a datacenter — isolated per service, backed up, monitored.

ZFS end to end — tiered pools, scrubbed and verified, sized for headroom rather than filled to the edge.

Genuinely does not have a favorite distro — picks whichever one fits the job and stays current on the rest by actually running them.

Ships and maintains real production PHP/Python apps end to end — schema, backend, deploy, and the bug report that comes after.

Treats LLMs as another service to architect around, not a black box to prompt and hope.

Runs models the same way infra gets run — self-hosted where it makes sense, evaluated, and monitored.

Authorized web app pentesting across checkout/payment, XSS, IDOR, account security and the full infrastructure lifecycle, tested against each platform's own known CVE history, not generic scanning.

Complete rebuild of a 4-star hotel's marketing and booking site from a static template into a real product: custom navy/gold design system, full BG/EN/TR translation layer, an interactive date-range picker, and a database-driven booking pipeline with email-verified guest submissions. Built a full internal admin panel from scratch — role-based access (Superadmin/Admin/Reception) with a content-approval workflow so front-desk staff can add photos and news posts without publishing unsupervised. Includes real SMTP email notifications, Cloudflare Turnstile bot protection, and per-IP/per-email rate limiting.

Built with CODE-OSS + Claude

Full enterprise network design and deployment for a 9-floor hotel. Built from scratch — planning, hardware selection, installation, and ongoing management.

A complete hospitality management platform. Multiple hotels, one login. Each property gets its own modules — Events, Counter POS, Workers, Reception. The interface is available in Bulgarian, English and Turkish. Each business sees only its own data and roles, and staff who work in more than one place switch between them. Each property can connect its own website through revocable API keys. Each module can be sold on its own, with a free trial, usage limits and a paused mode, all enforced on the server, so a client cannot unlock a module from their own side. For support, an administrator can view a business exactly as one of its staff, a role or a customer sees it; the view is look-only, enforced twice on the server (every change is refused and the database connection is read-only), and every view is logged. Client websites run live on their own ks.vg address or on the client's own domain. Orders portal customers can have agreed terms: a discount or fixed prices per product. A client's own web designer can embed the live menu or shop catalogue with two pasted lines; the key works only on the domains the client lists, with daily quotas and rate limits. The platform's move to a rented server is scripted and was rehearsed in three full dry runs, with a cutover and rollback checklist. Staff can sign in on a client's own website through a hidden key press or triple tap, see only the modules their role allows in a white-label left bar, and install the site as a phone app from the client's address, with no app store. An OAuth-style client login (authorization code with PKCE) and a small kit let a client's own site show platform data after sign-in. A rank model lets a person manage only people strictly below their rank. A security pass added login throttling, constant-time password checks, stronger password hashes upgraded at next login, origin checks, secure __Host- cookies and revoke-everyone switches, plus a cookie audit across all sites. Ten website layouts are available, and the application was renamed from ARK to ks.vg with a light default theme. From 31 October to 3 November every client got one predictable address of the form business-name.ks.vg, with a staff-only mode that closes the public site. A tenant-isolation pass closed twelve cross-business reads, and the whole platform moved without a wipe from a home server to a hardened VPS beside the mail server, with a scripted data restore checked by row counts, a tested rollback and 30-minute off-site database pulls. A public brand guide went live in English and Bulgarian. Next, the platform's real screens were ported module by module onto a client's own address through one generic mount, so onboarding a client is configuration rather than code, and a security audit closed cross-business reads in the staff, supply, POS, reception and ticket screens, backed by a two-business end-to-end test of 136 assertions. Five landing-page designs became reusable website templates.

Built with Claude (Anthropic)

Full self-hosted infrastructure running on a single Proxmox VE node. AMD Ryzen 5 5500GT, 16GB RAM, ~20TB across 4 ZFS pools. Also the proving ground for self-hosted AI infrastructure: a personal AI agent (OpenClaw), local LLM inference via Ollama on a dedicated GPU workstation with a RAG pipeline over a personal knowledge base, and an agentic dispatcher routing bash/coding tasks to local models. Recently audited the full local-model roster with real tool-calling tests (not just load-success checks) across three independent integration paths, pruned it down to a single verified-reliable model, and live-confirmed the entire chain end-to-end after reconfiguring every dependent tool. Patch levels are checked across the whole fleet: for the PHP 8.4.26 security release, every host running PHP (Nextcloud, the application containers and the standby site) was verified, and the one host still behind (the mail VPS) was upgraded to PHP 8.5.12 and re-verified. An unattended AI job runner lives in its own unprivileged container: it sees only one folder of my notes vault through a dedicated Nextcloud user, runs Claude Code jobs from queued job notes with a tool allow-list and time and turn limits, writes its results back and reports every run by Telegram. Its first job produced the school reference cards for pi.gd (13 subjects, about 770 topics, 28 runs); when its sync stalled I traced it to stale Redis file locks (423 Locked) and cleared them.

Every public-facing service runs through Cloudflare Tunnel — no ports open on the firewall. DNS managed via Cloudflare, wildcard certificates, DDoS protection built in. Administrative/management access on the router side gets the same zero-trust treatment: no exposed management ports, and every edge router is actively hardened and audited, not just configured once.

A full-featured multi-user personal finance tracker — accounts, categorized transactions, recurring bills, and a dashboard that actually separates real cash from available credit. Manual entry by design, so it needs no bank API connections or PCI-level security surface.

A private, invite-only space for markdown notes, code snippets, and technical references — rewritten from a live Node.js/Express app to PHP 8.4 with zero data loss. Each note is public or private, taggable, and searchable, with an admin panel for issuing invite codes instead of open registration.

Designed and built, from a written spec and a 14-task plan, the site behind pi.gd: a bilingual (Bulgarian and English) platform with a Tech section, a Tools section, a blog run by a family member as editor, and school reference pages for my children. Plain PHP 8.4 and PostgreSQL with no framework and no CDN, live since 14 October 2026.

Built with Claude (Anthropic)

A public, Arch-only (pacman, no AUR) one-command installer that sets up a full Hyprland + Quickshell/DMS desktop environment from scratch. Modeled on Proxmox's community helper-scripts: an interactive whiptail picker (terminal, file manager, mail client, cloud sync as single-choice radiolists, plus an independent checklist for extras) instead of a fixed opinionated bundle, with picks wired into a separate extras.conf so the base hyprland.conf stays clean. Built test-first with bats unit tests and shellcheck before any live run, then hardened through a second person live-installing it in a fresh VM, which surfaced real bugs invisible from local testing alone.

Built with Claude (Anthropic)

Built and hardened a full self-hosted mail platform (HestiaCP: Exim, Dovecot, ClamAV, SpamAssassin, DKIM/SPF/DMARC, Roundcube webmail) on a dedicated VPS, replacing a forward-only Cloudflare Email Routing setup with real send and receive for all 3 domains and 9 live mailboxes.

Diagnosed a subtle, silent access-control misconfiguration that had disabled every automated download across three services (Sonarr, Radarr, Lidarr) for two full days with no visible error — a well-intentioned but mistaken tag-based routing scheme had tagged both the indexers and the download clients, which independently gate on the content's own tags rather than on each other, so nothing was ever tagged and every indexer/client silently went unusable.

Designed, built and deployed a public online museum for children's drawings and paintings: anyone can browse, registered users upload, and every picture is approved by a moderator before it is shown. Plain PHP 8.4 and PostgreSQL with no framework, a Bulgarian/English interface, and a landing page where gold-framed pictures orbit an empty, lit centre like Saturn's rings.

Built with Claude (Anthropic)

Designed and built a public CV-builder feature from scratch on the site's own plain PHP 8/PostgreSQL stack, with no framework: a card-gallery landing page, a multi-step wizard (about, experience, education, skills, languages, summary), a clean print-ready view, and, since October 2026, ownership through the shared pi.gd account (at first account-free, with a cookie and an email magic link for recovery).

Built with Claude (Anthropic)

Migrating the hotel's core operational software — a property-management system and two point-of-sale/restaurant systems — off ageing physical hardware onto Proxmox virtual machines, without interrupting the live systems the hotel runs on every day.

Central security visibility for a homelab, a hotel network and a public mail server. Every server and router sends its logs to one place, alerts arrive on Telegram, known attackers are blocked automatically, and a honeypot records what attackers do once they think they are in.

A power cut at home took every public website and the password manager offline, and no copy of the data existed anywhere else. Now a standby container at a second site keeps a copy that is at most two minutes old, takes over by itself when the home server disappears, and returns everything, including what was written in the meantime, when the home server is back.

Two rounds of an authorized security assessment of a friend's live VPS/VDS reseller platform (a Paymenter-based client panel plus a provisioned test VPS), end to end, each delivered as a full written report.