About
Shankar Gurung.
I build systems, break them on purpose,
and keep the record of both.
ShanKyTech is that record. Web applications people actually use, a homelab that runs my own services, a Windows enterprise stack and its extension into Microsoft's cloud, the networking and security around all of it, and AI used as an instrument — each one built, operated, attacked, and written down as it happened. Nothing here is hypothetical.
The record — seven entries
- Khyenpa and Kuralok — a public register of singular things, and reader-ranked writing. Plus the sites: kagbenimustang.com, mustangkyidug.com, shankargurung.com.
- A Proxmox platform that runs my files, photos, media, passwords, DNS, monitoring and backups. Every service is an SOP; the platform can be rebuilt without me remembering anything.
- A small company's Windows environment, built end to end and operated properly: directory, group policy, certificates, mail, print, imaging, backup and restore drills.
- The same domain lifted into Microsoft's cloud: hybrid identity, Conditional Access, zero-touch device provisioning, data-loss prevention, Azure networking and TLS.
- A lab where I am my own adversary: Kali on an isolated segment, a firewall that drops by default, Wireshark on the wire, Splunk on the logs — so the defences are tested, not assumed.
- AI as a tool with a protocol around it: a private model on my own hardware, a pair in the editor, answers that cite their source — and nothing trusted that cannot be reproduced.
- The habit that holds the rest together. Outages become post-mortems, fixes become SOPs, and the failures stay published next to the successes.
Operating principles
- 01Reproduce or discountA result I cannot get twice is not a result. This is how the homelab is run, how the security lab is read, and how any model output is treated.
- 02Denied by defaultNothing listens on the open internet. Access is the exception, granted deliberately — never the leftover state of a device someone forgot.
- 03Draft, then decideTools and models are good at first passes and bad at being trusted with the last one. The final call is always read, by me, before it ships.
- 04Keep the recordIf it is not written down, it did not happen. The write-up is part of the work, not an afterthought — including for the things that broke.
Absent, by design
The work is public.
The network is not.
- IP addresses & subnets
- Hostnames
- Internal domain & tenant names
- Share & tunnel paths
- The address behind the contact form
Nothing on this site says how anything is laid out. Each infrastructure page carries the same line where the detail would otherwise be — the absence is the control. The surface you don't expose is the one you don't defend.
For the résumé, visit Shankar Gurung.