// projects
Things I build and run.
Small, sharp tools for the problems I keep hitting while self-hosting AI — keeping personal data inside Europe, sizing models to real hardware, and getting a service reachable from the outside world. vramfit and reachdoc are Apache-2.0; hushgate is source-available under BUSL-1.1. All built to be used rather than demoed.
hushgate
Use the best LLM APIs. Keep the data in Europe.
A self-hosted gateway for European companies that want Claude or GPT without sending personal data to US infrastructure. Point your existing OpenAI or Anthropic SDK at hushgate: it strips personal data out of the request, forwards the sanitised prompt, and restores the real values in the response. The provider never sees them — and every request leaves an audit record you can hand to your DPO.
- Thirty-three detectors that check their own arithmetic — IBAN mod-97, Luhn, ICAO 9303 passport digits, and the Bundesbank’s 91 account check-digit methods, so a number that fails its own checksum is never reported as personal data.
- Attachments are redacted too: a PDF, Word file, spreadsheet or e-mail is extracted, pseudonymised and never forwarded as bytes — and a document hushgate cannot read is refused rather than passed on.
- Residency policy that fails closed — an upstream outside your allowlist stops the server at boot instead of leaking quietly.
- Tamper-evident hash-chained audit log that exports a GDPR Article 30 record of processing.
vramfit
Will this model run on my machine, and how fast?
The question every self-hoster asks before downloading 40 GB of weights, answered with arithmetic instead of forum folklore. vramfit models weights, KV cache and runtime overhead for a given quantization, context length and device, then tells you whether it fits, the largest context that would fit, and roughly how many tokens per second to expect.
- GQA/MQA-aware KV cache maths — the figure naive calculators overestimate by up to 8×.
- Understands MoE: total parameters drive memory, active parameters drive speed.
- Doesn’t fit? It works out how many layers you can offload and what that costs you.
reachdoc
Why can’t anyone reach my self-hosted service?
A diagnostic that walks the whole path from your process to the public internet and names the first thing that is actually broken. Bound to 127.0.0.1, a firewall rule, a missing port forward, stale DNS, an expired certificate — or your ISP quietly moved you behind CGNAT, where no port forward can ever work.
- Detects CGNAT (100.64.0.0/10) and double-NAT, and says plainly that port forwarding cannot work.
- Ordered chain that short-circuits, so you get one real cause instead of ten cascading errors.
- Standard library only — every external call sits behind an interface, so the tests never touch the network.