Hi, my name is

Justin Burton

I’m a systems & platform engineer who builds self-hosted infrastructure, Apple apps and fast static sites, with AI agents in the loop.

Projects
01.About Me

I run a Proxmox homelab that behaves like production: multiple nodes, dozens of containers, a WireGuard-tunnelled edge on a public VPS, and everything recorded as docs and code on a self-hosted Forgejo. Over the last four months that turned into shipped work: two Apple apps uploaded to App Store Connect, static sites for real clients, governance-as-code for a Microsoft 365 tenant, and a local AI gateway that keeps models on-prem. I work across Proxmox, Debian, nginx, Cloudflare, Tailscale, Go, Python, Swift and PowerShell, with a long background in Microsoft 365 identity, Active Directory and SQL Server.

  • Proxmox VE
  • Debian / LXC
  • nginx
  • Pangolin + WireGuard
  • Cloudflare DNS
  • Tailscale
  • Docker
  • Forgejo / Git
  • Swift / SwiftUI
  • Go
  • Python
  • TypeScript
  • PowerShell
  • HTML / CSS / JS
  • SQLite / Postgres
  • Supabase
  • LiteLLM / LM Studio
  • MCP servers
  • Microsoft 365 / Entra
  • ESP32
02Featured Projects

JusTrack

Field app for managed-service work on iPhone, iPad, Mac and Apple Watch: the tickets that need you, customers and their equipment, live alerts, and a work timer that follows you between devices. One Swift package with its own design system and iCloud session sync. Version 1.0 uploaded to App Store Connect on 3 Oct 2026.

  • Swift
  • SwiftUI
  • watchOS
  • iCloud sync
  • XcodeGen
Support Privacy
JusTrack · Tickets
P1  SQL service failed after reboot   · Acme Co
P2  Backup job missed window          · Globex
P3  New laptop onboarding             · Initech
───────────────────────────────────────
⏱  01:42:10   on-site   ⇄ iPhone · Mac · Watch

Tempo

Menu-bar time tracker for billable work on the Mac, with iPhone and Apple Watch companions. No Dock icon, no main window: a dot in the menu bar, idle detection, reports, and invoice-ready CSV export. Ported from the original tracker to a native macOS app on 1–3 Oct 2026, built and signed from a single script.

  • Swift
  • AppKit + SwiftUI
  • Menu bar
  • CSV export
Support Open
Tempo · menu bar
● 02:15:33   Acme Co · Server maintenance
  Today      5h 40m      This week   31h 10m
  ─────────────────────────────────────
  ▸ Start new segment     ▸ Reports     ▸ CSV

justek.dev edge

Authenticated, TLS-terminated front door for every self-hosted service: Cloudflare DNS → a reverse-proxy hub on a hardened VPS → WireGuard tunnels back into the Proxmox nodes, with Google SSO and per-resource public, PIN or SSO rules. No inbound ports on the home network, ever. The hub and every tunnel were brought current in late September 2026.

  • Pangolin
  • Traefik
  • WireGuard
  • Cloudflare
  • Docker
Open
edge · resources
justek.dev          → static host   public
docs.*              → tunnel → LXC  SSO
archive.*           → tunnel → LXC  SSO → header auth
files.*             → tunnel → LXC  PIN
admin UIs           → not published

web-ops: minimal static web servers

Two tiny Debian LXCs running host nginx with one vhost per hostname and nothing else installed. Published by a tar-over-ssh script that also works from Git Bash on Windows. Rebuilt in September 2026 to replace a container-hosting panel that was managing zero applications. Serves justek.dev and thejustinburton.com.

  • Debian
  • nginx
  • Proxmox LXC
  • Bash
justek.dev thejustinburton.com
bin/web-push
$ web-push  justek.dev ./public
tar → ssh … 1.2 MB
chown -R … /srv/www/justek.dev
nginx -t && systemctl reload nginx     ok
https://justek.dev  200  in 38 ms

Claude Code usage dashboard

Near-real-time view of Claude Code usage across machines. A collector watches session logs and a static page updates about 25 seconds after each response. Deduplicates by message id after finding that raw transcripts triple-count tokens. Published behind SSO and re-verified on the rebuilt host in September 2026.

  • Python
  • nginx
  • Static HTML
  • SSO
usage dashboard
Today      ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇  6.2 M tokens
This week  ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇      28.9 M
Sessions   14 active · 3 machines
Last event 25 s ago

Project Atlas + Quartz knowledge bases

Two documentation sites generated from the repositories themselves. Project Atlas (Astro, Starlight, Pagefind) discovers every repository on Forgejo and publishes its Markdown on a timer. Quartz v4 mirrors the READMEs and architecture docs scattered across the share, 38 projects and 205 documents, with a small panel to edit and rebuild. Built 10 Sep 2026.

  • Astro + Starlight
  • Quartz v4
  • Pagefind
  • Forgejo API
  • systemd timers
quartz · index
Projects  38     Documents  205    Words  ~201k
▸ homelab / docs / NETWORK-PLAN
▸ edge / ARCHITECTURE
▸ web-ops / STATE
▸ Ffilemgr / PLAN              rebuilt 12:04

News aggregator

Self-hosted news dashboard that polls Google News keyword searches and RSS/Atom feeds into SQLite, then shows unread counts, per-source allow/block rules and a JSON/CSV search API. Pure Python standard library: no pip installs, no framework. Runs as a locked-down systemd service in its own container behind SSO since 12 Oct 2026.

  • Python stdlib
  • SQLite WAL
  • systemd
  • SSO
news · dashboard
Unread 42   Sources 17   Rules 9
● Proxmox VE 9.2 point release           2 m
● OPNsense 26.x security advisory       14 m
● Tailscale: DNS changes in macOS 27    31 m
GET /api/search?q=opnsense&format=csv

Law firm website redesign

Mobile-first rebuild of a law firm’s website as five static pages, about 100 KB in total, on a token-based design system with no web fonts and no third-party scripts beyond reCAPTCHA on the intake form. Zero axe-core WCAG 2.2 AA violations at 390 px and 1366 px; keyboard navigation and form errors tested with Playwright. Delivered October 2026.

  • HTML
  • CSS custom properties
  • Vanilla JS
  • axe-core
  • Playwright
axe-core · 5 pages
/            0 violations   390px · 1366px
/about/      0 violations
/team/       0 violations
/contact/    0 violations
/intake/     0 violations   reCAPTCHA v3 kept

Parish church website

Mobile-first rewrite of a historic country parish’s website in Mississippi, hosted on my own infrastructure and served as a private preview. Includes a mirror script for the original content and before, after and live screenshot sets. Marked noindex until the parish is ready to cut over. September 2026.

  • HTML / CSS
  • Python mirror
  • nginx
  • Proxmox LXC
preview · parish site
Parish Church · Mississippi
Holy Eucharist  Sundays 8:30 AM · 11:00 AM
X-Robots-Tag: noindex, nofollow
Lighthouse mobile  99 / 100 / 100 / 100

M365 Governance MCP server

Configuration as code for a Microsoft 365 tenant through a local MCP server: conditional-access policies and named locations live as JSON, a dated read-only baseline is exported before any change, and new policies start report-only. TypeScript over Microsoft Graph, pinned to a single tenant, driven from Claude. 5 Oct 2026.

  • TypeScript
  • MCP
  • Microsoft Graph
  • Entra ID
Private repo
m365_apply_policy_files
baseline/2026-10-05T09-12.json   exported
CA-001 Require MFA for admins    report-only
CA-002 Block legacy auth         report-only
named-locations/office.json      upserted
03.Experience

Four months of dated work, mid-June to 14 October 2026, reconstructed from the project folders and session history rather than memory.

October 2026

  1. Portfolio sitesTwo portfolio sites built from reference designs as pure static HTML, CSS and vanilla JS.
  2. Single production hostProxmox Datacenter Manager added, LibreChat serving local models from the AI workstation over Tailscale, Synology DSM virtualised in an LXC, and the firewall cutover plan refreshed.
  3. News aggregatorStdlib-only Python news dashboard deployed to its own container and published behind SSO.
  4. Network inventory rescanFull port scan of every live host cross-checked against the hypervisors and DNS client names; the infrastructure docs re-verified on the hosts. Agent governance policy consolidated into one AGENTS.md.
  5. Law firm websiteDesign-system audit of the existing site and a five-page static redesign with zero accessibility violations.
  6. Legacy system dependency analysisPrioritisation matrix for a legal billing system’s master, transactional and history screens, with the data flow drawn out in Mermaid.
  7. M365 GovernanceTypeScript MCP server that applies conditional-access policy files to a Microsoft 365 tenant from dated baselines.
  8. JusTrack and justek.devApp renamed JusTrack with full re-identification, version 1.0 uploaded to App Store Connect for iOS, watchOS and macOS, and justek.dev stood up as the developer site with support and privacy pages.
  9. Tempo for macOSTime tracker ported to a native menu-bar app: build, sign and DMG from one script, App Store listing prepared.
  10. Paperless-ngx + AIDocument archive and an AI tagging companion deployed in their own container behind SSO header auth, reachable only through the tunnel.

September 2026

  1. ThinxAI orchestratorDesign for a sovereign meta-harness: LiteLLM routing between local models and cloud backends, with a Python agent harness and resumable sessions.
  2. Edge upgradeReverse-proxy gateway, licence and every tunnel brought current; Claude usage dashboard re-verified on the rebuilt web host.
  3. Project Atlas, design system, parish siteAstro/Starlight documentation site generated from Forgejo; the Modernist design system packaged as React components; church site rewrite published as a preview.
  4. Firewall build planLive survey of both hosts and a printable, offline cutover card for moving routing onto the main node without re-IPing anything.
  5. Web servers rebuilt as LXCsHosting-panel VMs retired for two 512 MB Debian containers running plain nginx; NetWatch availability monitor started; Tailscale MagicDNS repaired on macOS 27.
  6. Supabase, Quartz, OwncastSelf-hosted Supabase folded behind the SSO edge; Quartz knowledge base built from 38 projects; HTTPS plan for a streaming server.
  7. Forgejo serverSelf-hosted Git server so the 16 of 20 repos with no remote finally had one.
  8. Hosting consolidationPlan to collapse four tunnels and two hosting panels into one; cloud VPS tooling with cost tracking and hibernate/restore.

August 2026

  1. Mac mini hosting clusterOrbStack-hosted container panels behind the SSO edge, documented as an architecture spec.
  2. FfilemgrSingle Go binary that crawls SMB shares into SQLite FTS5 and serves a mobile-first vanilla-JS PWA for search and playback.
  3. Container hosting trialPanel-based hosting trial on the web VMs (later replaced, see 16 Sep); productivity-suite of branded artifact skills.
  4. Organize Synology; SSO assessmentLandscape scan of the NAS with machine-readable inventories; passthrough single sign-on evaluated for the Proxmox UI.
  5. ESP32-S3 ESP-NOW meshThree boards, one firmware, relay layer and link-quality instrumentation (RTT, RSSI both ways, packet loss) with an operating guide; packet-capture plan; SSH keys staged for Transmit, Prompt and Nova.
  6. Website stack reportTechnology audit of a third-party site delivered as a standalone HTML report.

July 2026

  1. Mirrored web serversTwo web hosts provisioned across the Proxmox nodes with static IPs, key-only SSH and per-host automation keys.
  2. Edge Second Brain2,555 bookmarks and 16,671 history URLs cleaned, deduplicated and classified into a 3,115-entry searchable knowledge base (single-file app plus MkDocs Material).
  3. Homelab recoverySingle-board host connectivity diagnosed and fixed; a self-contained dashboard artifact built and published.
  4. Edge architectureThe Cloudflare → reverse proxy → tunnel design written up with the full traffic flow, ACME DNS-01 and firewall rules.
04.Contact

Opens your mail client addressed to info@thejustinburton.com.