IT & AI engineer · architect · Berlin

Calm systems. Local AI. A human in the loop.

Architect for infrastructure, network and security in a corporate group — and the go-to person for everything AI there: agent orchestration, enterprise-ready software built with AI, and teams that learn to work with it. After hours, my homelab is the proving ground.

No backup, no mercy. No guardrails, no agents.

Open a channel See the work

Press CtrlK for the command palette — or try the shell further down.

No trackers
Local first
Reversible > impressive
DR is not a PDF
Agents get scoped keys
Measure before you blame the model
If it repeats, it gets a button
Built with AI, reviewed by a human

01Role

Architect for the foundations. Lighthouse for AI.

As an IT & AI engineer in a corporate group, I own the architecture for infrastructure, network and security, drive the big projects in those areas — and I'm the person every AI initiative runs past.

Architecture
Infrastructure, network, security

Designs for large projects that hold up in audits, migrations and incidents — not just on slides.
AI lighthouse
Every AI project, one point of contact

Use cases, model choice, guardrails and the path from pilot to production — across the whole group.
Agent orchestration
Agents with roles and permissions

Multi-agent workflows with clear responsibilities, scoped access and an audit trail — productive without being off the leash.
Engineering
Enterprise-ready software, built with AI

AI writes a lot of the code. Tests, reviews, security checks and operability decide what ships.
Enablement
Teams that work well with AI

Workshops, patterns and good habits, so teams use AI as a tool rather than a slot machine.
Solution architecture
From business problem to running system

Translating requirements into architectures that can be built, run and handed over.

02Lab & projects

The lab is not a toy. It's the proving ground.

What holds up here — on my own hardware, with real people using it every day — is what I bring to work. A few things that are running right now.

Local voice AI v2.5.3 · in daily use

A.L.I.C.E. — a voice assistant that never leaves the house.

Speech in, speech out, entirely on local hardware: speech recognition, a 26B language model and a streamed custom voice, orchestrated in real time. She knows the calendar, the weather and the smart home, files tasks and looks through the camera when asked — behind single sign-on with a second factor, with a profile per person.

voice: time to first sound: 0.5 s
tools picked correctly in the latest benchmark: 30/30
cloud models involved: 0

Pipecat
llama.cpp
Vulkan
ROCm
Home Assistant
CalDAV

hearSilero VAD + Smart Turn
transcribeParakeet TDT 0.6B
thinkGemma 4 26B-A4B · llama.cpp
actcalendar · weather · home · tasks
speakQwen3-TTS · streaming PCM

Agent orchestration running

A dev team where most members are agents.

Coordination, development, QA, security and release — five agent roles on their own control plane, each in its own Unix account without sudo. Tasks flow in from merk[mal]; nothing reaches production without a human sign-off.

agent roles: 5
shared credentials: 0
human with the final say: 1

Paperclip
Claude Code
Codex
SSH isolation

How it runs

Product live · AGPL-3.0

merk[mal] — thoughts in, order back.

A self-hosted, LLM-assisted everyday companion against mental load: one input field, and it works out whether you wrote down a task, a note, a journal entry or groceries. Built neurodivergent-friendly, with AI hosted in the EU.

input field for everything: 1
object types, auto-classified: 5

Next.js 15
FastAPI
OKLCH
Docker

merkmal.app

ML performance lab

YuE Studio — a music model, five times faster on AMD.

A Suno-style studio for local song generation on a Strix Halo APU. The upstream decoder quietly fell back to a slow attention path on ROCm; a grouped-attention rewrite plus tuned GEMM kernels took it from 5.7 to 26–30 tokens/s — just faster than real time, without patching upstream code.

tokens/s, before → after: 5.7 → 28
upstream patches: 0

PyTorch
ROCm
TunableOp
rootless Docker

Platform in production

The homelab — run like production.

A Proxmox cluster with NetBox as single source of truth, synced automatically from hypervisors, network and storage. Stacks managed through Komodo, everything behind a reverse proxy with SSO and 2FA, monitoring and SIEM alerts pushed through a self-hosted notification service. Next up: containers onto Kubernetes.

cluster nodes: 3
VMs & containers: ≈30
source of truth: 1

Proxmox
NetBox
Komodo
Caddy
Authelia
Checkmk
Wazuh

Also in the lab

Smaller things that keep the big ones running.

Inventory sync: Proxmox, UniFi and Synology into NetBox
LiteLLM gateway in front of local LLMs, plus local speech-to-text and text-to-speech
Push alerts from Checkmk and Wazuh to my devices, self-hosted
Own RPM builds of a Wayland compositor, straight from upstream

03Agents

Agents do the legwork. Humans sign off.

The same pattern at home and at work: every agent has one job, its own account and a short leash. Here's a task on its way through.

Inboxtask arrives
Coordinationtriage & context
Developmentbranch & PR
QAindependent tests
Securityreview & secret scan
Releasenotes & rollback
Humansign-off

One job, one account
Each role runs as its own Unix user. No sudo, no peeking into other homes.
Short-lived, scoped keys
Created by script, limited to the task, revoked when the session ends.
Secrets stay out of transcripts
Credentials are loaded, never printed. A leak means rotation — so it doesn't happen.
Independent checks
QA and security never review their own work. The release always knows the way back.

04Principles

A little chaos, a lot of control.

Clear the fog before touching production.
Map dependencies first. Incidents are a terrible way to discover architecture.
No change without a way back.
Backup first, rollback documented, then the rollout.
Measure before you blame the model.
Half of "the AI is slow" is a kernel quietly taking the slow path.
Local first when the data is personal.
Voice, health and family data stay on my own hardware.
Agents get roles, scoped keys and an expiry date.
Least privilege applies to software that writes software, too.
Observability is part of the feature.
Not a guilt purchase after the first outage.

05Stack

Tools I like when the room gets warm.

Observability & security

Checkmk
Wazuh
Uptime Kuma
ntfy
SSO + 2FA
Least privilege
Backup & DR

AI & inference

llama.cpp
ROCm
Vulkan
PyTorch
Gemma 4
Qwen3-TTS
Parakeet
Pipecat
LiteLLM
Open WebUI

Agents & engineering

Claude Code
Codex
Paperclip
n8n
Python
FastAPI
TypeScript
Next.js
Gitea
Jira

Daily driver

Fedora
niri
kitty
self-built RPMs
Strix Halo

06Shell

Prefer a terminal? Go ahead.

Type help. Nothing in here can break production — I checked.

07Contact

Got a system that smells like a future incident?

Architecture, AI with guardrails, agents in real workflows — or simply a good homelab story. Send context, constraints and the part that keeps coming back as manual work.

Context what exists today
Constraints budget, deadline, compliance
Pain what keeps repeating