ShanKyTech
NetworkingCybersecurityAIMolecular Biology

Build it. Break it. Keep the record. 

ShanKyTech is where I build and keep things: web applications people use, a homelab that runs my own services, the networking and security around them, and the AI and molecular biology work underneath. Everything here is written down as it was done — including what broke.

Start hereHow I work
Scroll
  1. 01Products & WebKhyenpa, Kuralok, kagbenimustang.com, mustangkyidug.com — and the sites that carry them; shipped, live, maintained4 products · 4 sites
  2. 02Homelab & Self-HostingA Proxmox platform, every service documented as an SOP20+ SOPs
  3. —Enterprise ITDirectory, policy, mail, print, imaging and backup — a whole company's Windows environment, built and run the way an IT department wouldAD · GPO · Exchange
  4. 03Networking & SecurityCisco and NG firewalls, zero-trust access, and a lab that watches attacks from packet to alert — seven threats on the boardProject Z
  5. 04Cloud & SecurityEntra hybrid identity, Conditional Access, Intune Autopilot, Purview, Azure — every sign-in run through the gauntletMicrosoft 365
  6. 05Molecular BiologyTwo years at the bench on AfrLEA6 protein expression — recombinant DNA, written down as it was doneResearch
  7. 06Artificial IntelligenceAs an instrument, not a subject — what runs at home, what it is for, and what it is notInstrument
  8. 07NextDirections, not commitments — cybersecurity, homelab, AIOpen
  9. 08WritingThree essays: the network I attacked to defend, the protein, the model on the Mac miniEssays
products live
0
entries registered
0
Khyenpa categories
0
Kuralok categories
0
01

Products — shipped and running

Both live · both maintained

khyenpa.comLive

Khyenpa

Registered once. Kept forever.

A public register of singular things — paintings, buildings, ships, software, typefaces, instruments, recipes — where each one gets a permanent ID that never changes hands.

Anyone can add an entry; the person who made the thing can claim it. Entries move through three states — Unclaimed, Community, Claimed — and readers, not an algorithm, decide what rises.

  • Permanent canonical IDs · KH-001121
  • Three entry states
  • Rising · Most viewed · Entry of the Week
  • ~50 categories · 10,000+ entries
Read the build →Open khyenpa.com ↗
kuralok.comLive · early

Kuralok

Every Thought Has a Place.

Long-form writing ranked by the people who read it, where an author can sign their name or publish anonymously.

No feed algorithm. Most viewed over 24 hours, 7 days or 30 days; fastest rising by momentum; awards. Forty-plus categories from Politics to Artificial Intelligence, and it is very early.

  • Reader ranking · 24h / 7d / 30d
  • Signed or anonymous
  • 40+ categories
  • Launched Aug 2026
Read the build →Open kuralok.com ↗
02

Homelab — self-hosted, at home

No open ports · nightly backups

Everything I depend on,
running on hardware I can touch.

Photos, files, passwords, media, the house, and the monitoring that tells me when any of it is wrong — all self-hosted, all in containers, reachable only over an overlay network. Nothing listens on the open internet. It is the part of all this that has taught me the most about failure, because it fails at 2am and there is no one else.

  • Pi-holeDNS · ad and tracker sinkEdge
  • NetbirdOverlay VPN · zero open portsEdge
  • VaultwardenPasswords, self-hostedCore
  • NextcloudFiles, calendars, contactsCore
  • ImmichPhotos, on my own disksCore
  • File serverShares for everything elseCore
  • PlexMediaMedia
  • JellyfinMedia, open sourceMedia
  • Home AssistantThe houseOperations
  • PBSProxmox Backup Server · nightlyOperations
  • MonitoringMetrics, logs, alertsOperations
  • DockerEverything runs in a containerOperations
The full homelab →
03

Cybersecurity — on-prem, where attacks land

Kill chain, interrupted

The network is hostile.
Even at home.

  • RDP never faces the internetHardened Remote Desktop: non-default port, NLA on, restricted by group — and reachable only over the overlay. Port 3389 is open nowhere.
  • The directory is the access controlLockout and password policy by GPO, delegated admin, share and NTFS ACLs on every folder, a root CA of our own. A user is not an admin.
  • Watch the wireProject Z: Kali attacks an isolated VLAN, OPNsense logs it, Wireshark shows what actually crossed, Splunk alerts on the domain controller's event log. Practised end to end.
  • Backups are a security controlNightly PBS snapshots behind an append-only token, tested by restore drill. Ransomware is a backup problem before it is anything else.
Projects and write-ups →
04

Cloud & Security — the sign-in gauntlet

Allow is the exception

Trusted for nothing.
Checked at every gate.

Cloud, identity & endpoint →Networking & security →
05

Molecular biology — the bench

Research · recombinant DNA

Designing under uncertainty,
one construct at a time.

My bench work is in recombinant DNA technology — cutting, joining and moving genetic material between organisms, and reading whether it worked from noisy signal. It is the same discipline as good software: you design a protocol, run it, read the gel, and iterate. Most of what I believe about building things I learned at a bench first.

  1. 01Backbone
  2. 02Restriction cut
  3. 03Insert + ligate
  4. 04Transform
  5. 05Select + grow
The research, for non-specialists →Read the gel ↓
backbone
06

Artificial intelligence — as an instrument

Local first · reviewed always

Illustrative session — the questions are mine; the replies are written here, not generated

An instrument,
not an oracle.

  • Private by defaultOllama on a Mac mini in the homelab. Drafts, summaries, questions against my own runbooks — day-to-day work, and nothing leaves the house.
  • Paired, not replacedCursor and an agent in the editor on Khyenpa, Kuralok and this site. The model drafts; I decide. Every line is read before it ships.
  • Grounded, or it is guessingRetrieval over my SOPs and notes, answers that cite the source; on the Microsoft side, a Copilot agent grounded on a single document. Fluent and unsourced is the dangerous kind.
  • Next: a lab that reads itselfAn agent over the runbooks, offline. First-pass triage of Splunk alerts. SOPs drafted from shell history and corrected by hand. Possibilities — labelled as such.
How I use it, and what is next →
07

Next — not yet in focus

Directions, not commitments

  • HomelabWazuh across the whole fleet — an agent on every VM and LXC, file-integrity monitoring, CIS benchmarks scored nightly, and a dashboard that says what drifted
  • CybersecurityPurple-team notes against my own AD — Kerberoasting, AS-REP roasting, NTLM relay — practised on the isolated VLAN, with the detection that caught each one (or did not), and canary tokens planted where an attacker looks first
  • NetworkingThe LAN redrawn — VLANs per trust zone on a managed switch, 802.1X at the port, Suricata inline on OPNsense, WireGuard site-to-site to a second location — new tools, each written as an SOP before it goes live
  • AIAn AI SOC analyst on local hardware — Splunk alerts triaged against MITRE ATT&CK, the incident note drafted with the log lines it came from, a human signing off on every action
  • AI × NeuroscienceA notebook on attention, twice — predictive coding and spiking networks read against the transformer, with small simulations that run on the homelab GPU
08

Writing — original only

Three essays · coming

Nothing borrowed.

All writing →