Skip to content
View cyb3ralbert's full-sized avatar
🎯
Focusing
🎯
Focusing
32 followers · 64 following

Achievements

Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: Pull Sharkx2

Achievements

Achievement: Pair ExtraordinaireAchievement: QuickdrawAchievement: Pull Sharkx2

Block or report cyb3ralbert

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
cyb3ralbert/README.md

cyb3ralbert

Infrastructure engineer. Linux, Kubernetes, Go, Python.

Most of what's here shares one property: self-custody. Whatever unlocks a thing stays with the person the thing belongs to — not in a vendor's database, not in a CI secret, not in a config file sitting next to the data it protects.

Currently

Bitcoin Core — small patches, and commits signed by a hardware device rather than by a key on disk. Pull requests.

Kubernetes The Hard Way, starting one step before the tutorial does. It opens by asking for four Debian 12 machines and never says where they come from — chapter-zero is that step: libvirt/KVM cloud-image VMs and cloud-init profiles on a host you already have, instead of four rented instances.

Self-custody, concretely

  • trezor-totp — TOTP secrets encrypted at rest. The AES key is derived on the Trezor from a fixed BIP32 node and never leaves it; only ciphertext is on disk.
  • trezor-gpg-recovery — rebuild a Trezor-backed GPG identity from the seed phrase alone, in software, so you can confirm the fingerprint reproduces while you still have the device (SLIP-0010). Related: romanz/trezor-agent#335.
  • git-crypt + Trezor — the repository's encryption key is unwrapped by the device on demand and never written to disk.
  • hiddenjump — reach a machine behind CGNAT over an SSH tunnel you run yourself, rather than a third-party remote-access service.

The same question turns up away from hardware: which tools an MCP server hands an agent in tools/list, and how to make it hand over fewer.

Write-ups

site · telegram · email

Pinned Loading

  1. trezor-totp trezor-totp Public

    Store TOTP secrets encrypted by a Trezor — only ciphertext on disk

    Python

  2. trezor-gpg-recovery trezor-gpg-recovery Public

    Recover a Trezor-backed GPG identity from the BIP39 seed, no hardware needed (SLIP-0010)

    Python

  3. chapter-zero chapter-zero Public

    Kubernetes The Hard Way asks for four Debian 12 machines. This is where they come from — libvirt/KVM cloud images on your own host.

    Shell 1

  4. cyb3ralbert.github.io cyb3ralbert.github.io Public

    Write-ups: hardware-backed keys, MCP tool permissions, homelab infrastructure

    HTML

  5. hiddenjump hiddenjump Public

    Reach your own machine behind CGNAT over your own tunnel — autossh, nologin tunnel user, fail2ban

    Shell

  6. claude-skills claude-skills Public

    Reusable Claude Code skills, including hardware-key setup (git-crypt + Trezor)

    1 1