#Python

The personnel information system of the City Government of South Tangerang: employees keep their own records and follow their services, administrators work on exactly their part of the organisation, and every rule comes from the regulation that sets it. Led and built by me since 2023.

A tiny publish-only service that keeps a root CA reachable without making it touchable: it serves the root certificate and its revocation list, while the root key and every signature stay on an offline host — reusable by any project with its own CA.

A Python service that asks a person on camera to face forward, turn right, and turn left, captures one sharp frame per pose, and keeps the three as private evidence for a human reviewer — proving a live person was present, not who they are.

A Python service that signs PDFs to PAdES B-LTA with a visible stamp — embedding the timestamp, certificates, and revocation proof, then an archive timestamp — so signatures stay verifiable long after their certificates expire, and verifies signed PDFs.

Each endpoint is one procedure that carries a request from start to finish, with its concerns in modules beside it — Fowler's Transaction Script as I shape small one-job Python services, bundled into one binary, until their rules outgrow it.

A single script that turns a project's Markdown documentation into a static site that opens from a folder with no server or internet: a menu, a table of contents that follows the reader, tables that never truncate, code with a copy button, and links that keep working.

An interactive Python script that proves an identity provider is ready for a client: it rehearses a full PKCE sign-in and sign-out like an application, then checks the tokens it receives against the provider's keys the way an application must.

The digital signature platform of the City Government of South Tangerang: signers prove who they are, sign PDFs to PAdES B-LTA with certificates from the platform's own authorities, and anyone can verify the result — version 2, which I designed, built and operate.

A single Python script that proves S3-compatible storage is ready before an application depends on it, by using every bucket the way a real client does and catching the failures that return HTTP 200.

My code is read by people who were not there when it was written: colleagues, me months later, or an AI agent that forgets on every reset. The clean code rules from Robert C. Martin I apply in every language, shown in a Rust service.

SMTP and IMAP credentials fail late and far from their cause: a reset email that never arrives. A small check proves both directions first, with a tokenised test message, a read-only inbox check, and broken config kept distinct from a broken server.

A 4 GB laptop GPU once sent every heavy job to a borrowed Colab runtime. Deciding per piece of work instead — by a measured number, by reliability, by a change of method — split one project across three places and deleted 9975 lines of machinery on the way home.

Each project began with its interface served from inside the borrowed Colab runtime, through Colab's own proxy — until Colab warned against it. Moving the interface out made the runtime a pure worker, and left two codebases held together by nothing but an agreement.

A borrowed Colab GPU ends every session by time limit or daily quota, often in the middle of hours of image generation. Picking up where it stopped meant treating each new runtime as a machine that knows nothing — and may not even be the same machine as yesterday's.

A laptop and a borrowed Colab GPU talked through a public MQTT broker that anyone could read. Giving that channel an identity took an afternoon on the broker and eight obstacles in the clients — mostly safeguards that were right for the old setup and wrong for the new one.

A Colab runtime has no address anyone can call, so a laptop and a borrowed GPU talk through a broker both of them dial out to. Sending commands was the easy half. Knowing — whether the worker is alive, whether a command arrived once — is where six silent failures hide.

A 4 GB GPU pushed the heavy work onto a borrowed Colab runtime, so a laptop and that runtime had to share one store. Storing the data was easy. Believing it was not: seven of the ten obstacles were successes that were false, and the most useful fix removed an entire layer.

Photos into one PDF, a PDF under two megabytes, a layout inspected page by page — usually done by uploading to a stranger's website. Three small tools do it locally with Pillow and Ghostscript; the only real decisions were which defaults to bake in.

A storage server that answers a connection only proves a process is listening. I check each capability separately — browser uploads via presigned URL, private buckets refusing strangers, large files through the proxy — before any application depends on it.

A failed login in a half-built service is either a misconfigured identity provider or wrong code. I rule out the first by rehearsing a full login with my own tool before writing any app, and found compliant providers still disagree on tokens and claims.