Jaedon Chin

Problem

Texas Southern University had no dedicated cybersecurity lab. Students lacked access to enterprise networking equipment for hands-on learning — limiting practical skill development in a field that demands it.

Architecture

Multi-layer campus network with Cisco Catalyst 9200/8200 core switching, Meraki MS130 access layer, and Firepower 1000 series for threat inspection. UCS C220 rack servers provide compute for lab workloads. Full VLAN segmentation isolates student traffic from production.

What I Built

• Physical and logical network infrastructure from bare metal to operational
• VLAN segmentation architecture separating lab, management, and campus traffic
• Network diagrams and topology documentation for the full environment
• Configuration documentation and handoff guide for program continuity
• Rack installation, cabling, and hardware commissioning

Security

Firepower IPS/IDS providing real-time threat inspection. VLAN-based network segmentation enforcing least-privilege access between zones. Dedicated management VLAN for infrastructure administration. Built to support future expansion of the cyber program.

Problem

Insulation contractors were running their businesses out of text threads, spreadsheets, and sticky notes. They had no idea if a job was profitable until it was done—and sometimes not even then. Generic CRMs didn't fit their workflow, and the industry-specific ones cost a fortune.

Architecture

Next.js App Router frontend talking to Supabase (Postgres + Auth). Row Level Security handles multi-tenancy so each contractor only sees their own data. Strict client/server split—no "use client" where it doesn't belong. Playwright catches regressions before they hit production.

What I Built

• Drag-and-drop kanban for tracking leads through the pipeline
• One-click lead → job conversion that keeps everything linked
• Time tracking that workers can use without logging in (they just need the job link)
• Real-time cost tracking that calculates labor automatically from time entries
• Profit dashboard showing estimated vs. actual—no more guessing
• Activity feed that logs everything so you know who did what and when

Current State

Core features are done and tested. Schema is locked down with migrations. Now polishing the UI and building out the marketing site. Already have contractors using it.

Problem

Cloud voice assistants are a privacy nightmare, add noticeable latency, and get expensive fast. I wanted something that processes voice locally with sub-second responses, but can still tap into cloud APIs when the local model isn't enough—all without giving an AI unrestricted access to my infrastructure.

Architecture

Two-machine setup. My RTX 3070 handles the real-time voice pipeline (wake word → speech-to-text → LLM → text-to-speech) within 8GB VRAM constraints. VPS runs the persistent stuff—Postgres, n8n for automation, Qdrant for semantic search—connected over an encrypted WireGuard tunnel. About 60% of queries stay local; the rest get routed to cloud APIs intelligently. Agent Zero on the VPS handles long-running autonomous tasks.

What I Built

• Custom voice pipeline: faster-whisper (INT8) → Qwen3 via Ollama → Kokoro TTS, ~3s end-to-end
• Trained my own wake word model using synthetic speech data via openWakeWord
• Hybrid query router that decides local LLM vs. semantic cache vs. cloud API based on complexity
• Defense-in-depth security: API wrapper with explicit container allowlists, rate limiting, immutable audit logs
• WireGuard tunnel with all services bound to tunnel IP—nothing exposed on public interfaces
• Hardened Docker containers: non-root, dropped capabilities, read-only filesystems, resource limits

Security

The AI never touches the Docker socket directly. Every container operation goes through an allowlist with rate limiting, and audit logs are stored separately where the AI can't modify them. Network is segmented by trust level—WireGuard for internal traffic, Cloudflare Tunnel with Zero Trust for anything external. I've documented the threat model with specific mitigations for prompt injection, container escape, and secret leakage.