Reference Projects

Challenge

The well-known KeePass browser bridges are archived or in maintenance mode only, and Chrome is removing old Manifest V2 extensions. KeePass users needed a maintained, secure connection to the browser — without the cloud.

Solution

An independent implementation of the KeePassXC browser protocol with NaCl encryption, our own KeePass 2 plugin with a connector for Windows and Linux, autofill across frames and Shadow DOM, passkeys straight from KeePass, one-time codes (TOTP) and a warning on fake sites (Punycode, typo domains). Passwords are never stored in the extension.

Challenge

Each location had its own uncoordinated Wi-Fi infrastructure with no central management. Security policies weren't followed, and the guest and practice networks weren't separated.

Solution

Rollout of a self-hosted UniFi Network Application on a Linux server. All access points at every location connected via site-to-site VPN. Unified SSIDs, automatic firmware updates, captive portal, full MAC/IP filtering.

Challenge

Every day, multi-gigabyte XML files following DIN EN 15380 landed on Nextcloud and had to be processed by hand. The process was error-prone and, due to its RAM usage, could not be automated on Windows servers.

Solution

Built a complete pipeline: Nextcloud monitoring → streaming processing of huge files without loading them into memory → automatic splitting and classification → backup → transfer to the Linux database → admin notification.

Challenge

Customers with multiple locations needed secure, manageable connections between branches — with central monitoring and GDPR-compliant settings.

Solution

Planning, delivery, and complete configuration of Sophos XG/XGS firewalls: firewall rule sets, site-to-site IPsec and SSL VPN, remote access VPN, IPS, web filtering, and Sophos Central cloud management.

Challenge

A flat network where every device reaches every server: a single compromised device would have had access to administration, databases and backups.

Solution

Separate zones for administration, publicly reachable services, internal databases and test systems. Between zones only what is needed is allowed (for example just the database port). Remote access via WireGuard VPN, approved per device rather than across the board. Traffic and rules are monitored continuously.

Challenge

The company was still running an outdated ISDN system. The new system had to be rolled out over a weekend with zero downtime.

Solution

Installation of Starface on a dedicated server, configuration of all phone numbers, groups, queues and IVR menus, SIP trunk connection, rollout of IP phones (Yealink) and softphone clients.

Challenge

Customers needed a clear virtualization strategy: hardware consolidation, structured backup, high availability and remote access without physical access to the site.

Solution

Project-specific choice between Proxmox VE and VMware ESXi. Configuration of iDRAC (Dell) or iLO (HP) for remote maintenance. Setup of backup routines with PBS and Veeam. HA clustering where it makes sense.

Challenge

The client wanted to move off Hetzner onto its own hardware. The platform was live — the move couldn't cause any downtime.

Solution

Complete documentation of the Hetzner environment, target server preparation (NGINX, Node.js, PM2, SSL via Let's Encrypt), database transfer, media sync via rsync, DNS cutover.

Challenge

Organically grown networks with unstructured switches, no VLAN segmentation and security issues from open ports.

Solution

VLAN design by network zone, Spanning Tree Protocol to prevent loops, port security, LACP trunks to servers and firewalls. Complete documentation.

Challenge

Customers who needed to share passwords securely within their organization had no simple, self-hosted solution without cloud dependency.

Solution

Node.js-based platform with encrypted storage, single-use QR codes, and automated email delivery. Credentials are deleted automatically once retrieved or expired.