Small-business IT, Cloudflare and Raspberry Pi. Miami, Florida. contact@javiercarnicer.com, javiercarnicer.com/portfolio
I look after the IT for a handful of small businesses: their domains and DNS, email, hosting on Cloudflare, sign-in and backups. At home I run the servers behind that work, a small Proxmox cluster and a NAS, set up so nothing on the network accepts connections from outside. I also build electronics, mostly sensors, input devices and Raspberry Pi tools; some of them are below.
Experience
Founder, WebLandscapes LLC
Current
I set up and look after the IT for small businesses: domains and DNS, email authentication, hosting, an admin built for how each business works, backups and sign-in. I run the business day to day with my wife and handle the back-end systems in my own time, alongside my full-time job.
For Oceanside Realty, staff logins where each agent sees their own showings, and website enquiries that go straight into the broker's MLS lead system.
For Padilla & Perry, a move off a vendor-hosted WordPress site onto infrastructure in the brokerage's own Cloudflare account.
For Rosa Vita Wellness, booking requests kept in a database and tracked in an admin inbox through to the completed visit.
I run the store day to day with a team of three to four per shift.
Look after the store's technology: point-of-sale, printers, scanners, network and cameras.
Enter and reconcile inventory in the state-required tracking and point-of-sale systems; check orders, vendor deliveries and manifests.
Opening and closing procedures, store security, cash handling, drawer counts, daily reconciliation and bank deposits.
State inspections and internal audits; sales and shrink reports for the owners; hiring and training staff on procedures and compliance.
Seasonal Specialist, Apple
September 2022 to January 2023
Set up iPhones and Macs for customers, moved their data and sorted out Apple ID and iCloud problems. Sales, including to business customers, and back-of-house inventory audits.
Administrative Assistant, Oceanside Realty
August 2018 to September 2022
Set up and supported the office's computers, email, printers and software accounts, and managed the listings and the website. Coordinated transactions between clients, lenders and agents, prepared contracts and closing documents, and handled bilingual client communication.
Infrastructure and Cloudflare
The client sites and my own tools run on Cloudflare as Workers and Pages projects. A Worker holds the code; it keeps relational data such as bookings, sessions and job queues in D1, short-lived state such as rate-limit counters and cached pages in KV, and files such as uploads and finished archives in R2. Durable Objects hold real-time state, such as the rooms of a small multiplayer game and a daily usage budget. A project is bound only to the databases and buckets it uses, and its keys live in Cloudflare's secrets store, so one site's code has no access to another site's data.
Some work needs more than a Worker can do, so it runs at home and reaches Cloudflare from the inside. A website-archiving service I built is one example: a customer orders an offline copy of a site, the order lands in a D1 queue, and two machines at home claim jobs from it, capture the site in a headless browser and upload the result to R2. The assistant on my site reaches a language model at home the same way, through a Cloudflare Tunnel with an Access service token.
The machines at home make outbound connections only.
My admin panel rejects any change request that lacks its session's CSRF token. For a domain-monitoring tool, I applied to ICANN for zone-file access and was approved for 18 top-level domains; the data from those files stays on the admin side, as the agreement requires.
At home
Three Proxmox VE 9 nodes form a cluster with corosync quorum: three votes, two needed, so any one node can fail and the rest keep running. The HA manager uses watchdog fencing, so a node that loses quorum stops itself before its guests are started elsewhere, and a container never runs twice. The cluster runs about thirty guests, mostly unprivileged LXC containers and a few virtual machines, among them a reverse proxy, Grafana monitoring and media and photo servers.
A TrueNAS server holds about 30 TB in RAID and serves the cluster over NFS: one share for the HA containers' disks, so any node can start them, one for backups and others for data. Proxmox takes weekly snapshot backups, compressed with zstd, to the backup share and keeps the latest two, and TrueNAS mirrors nightly to a second NAS with 30 days to recover a deleted file.
A separate ZimaBoard with a Tesla P4 handles AI work; when an OS update replaced its driver with one that no longer supports the card, I traced the cause, rolled back the boot environment and kept a copy of the working driver. Two UPS units cover the machines and the internet connection.
Security
Monitoring has read-only access
The monitoring tools connect with their own database role: SELECT permission, read-only transactions forced, a query timeout and a connection limit.
Same-day response to CVEs
The day PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was published, I checked every site and service for PHP. One internal service used it; it was already offline, and I recorded the patched version it needs before it comes back.
Re-authentication before destructive changes
My admin panel uses passkeys, writes every change to an audit log, and requires a sign-in from the last 10 minutes before any security setting can change.
No inbound ports
Published services leave through Cloudflare Tunnels and I administer over Tailscale. The archive machines connect out to fetch their jobs.
Reviewed, reversible deploys
A change goes live after a second review, often by an AI code reviewer, and a verification run. I write down the version to roll back to first, and deploy while the job queues are idle.
Projects
Air-quality sensor network
I wanted to see how the air in a room changes through the day without putting sensors on a Wi-Fi network or a cloud account. Battery nodes built on the M5Stack StampS3, with Sensirion SEN55 and SCD40 sensors on I2C, broadcast a small versioned packet over ESP-NOW every 10 seconds. An e-paper receiver collects up to six nodes, writes each reading to a CSV file on its SD card and draws per-minute charts of any file.
The hard part was keeping bad data out of the log. A node that has just woken sends a few unreliable packets, so the receiver starts logging it after three good ones, and the e-paper redraws the values that changed instead of the whole screen. The packets are unencrypted because the readings are not sensitive; ESP-NOW's paired encryption is the next step for anything that is.
Breath-operated keyboard
Four MPRLS pressure sensors, a TCA9548A multiplexer and a QT Py.
A controller for someone who cannot use their hands, in the same family as commercial mouth-operated controllers such as the QuadStick. It plugs in as a standard USB keyboard, so it works on any computer without drivers. Blowing into or sipping from a tube presses a key; each of the four tubes maps to its own keys (A and B, Space and Enter, Shift), and a small joystick worked by the mouth sends the arrow keys.
The four Adafruit MPRLS pressure sensors share one fixed I2C address, so each sits on its own channel of a TCA9548A multiplexer. At power-on each sensor averages ten readings to learn its own resting pressure, and a breath counts only when it moves 2 psi or more from that baseline. The firmware tracks which keys it holds, so a sustained puff holds a key down and letting go of the breath releases it. The joystick has a dead zone so it ignores small movements. In a workplace it is adaptive equipment for an employee who cannot use a standard keyboard.
PiSigns: sign-language letters on a Raspberry Pi
PiSigns reads American Sign Language letters from a camera on a Raspberry Pi. OpenCV and cvzone (MediaPipe) find 21 points on the hand, and my own rule-based classifier turns which fingers are raised, plus the geometry between them, into letters. Letters that raise the same fingers are told apart by measurements: B and C, for example, by the average distance from the fingertips to the base of the palm.
The same tracking drives hardware: an open hand or a fist switches an LED on an Arduino over serial, and a servo works the same way. The classifier went through several versions in early 2024. The code is on GitHub.
GPS loggers
A GPS FeatherWing with a coin cell that keeps its clock, on a Feather logger board with a microSD slot.
These loggers record a route to a memory card without a phone or a subscription. The first was an ESP32 with a UART GPS module; later ones moved to a Feather and a QT Py with I2C GPS. They write time, position, speed and altitude to a CSV file per trip, named from the GPS clock, and the latest opens a short-lived Wi-Fi access point when a separate button node asks over ESP-NOW, so the logs download to a phone.
Two failures shaped it. SD writes failed over jumper wires until I lowered the SPI clock to 4 MHz. A XIAO ESP32-C3 version never logged reliably, because the board has one spare UART and its SD pins clashed with the GPS, so I switched to I2C GPS.
Other builds
Keyboards and controllers
A pocket keyboard for a headless Raspberry Pi: an M5Stack CardKB on I2C, first as a USB keyboard on a QT Py ESP32-S3, then over Bluetooth on a XIAO ESP32-S3, later with a trackpad and an OLED menu. The hard part was mapping the CardKB's own key codes to HID reports with modifiers.
LoRa mesh messengers
Handheld text messengers that reach each other over long-range radio with no phone signal. I wired and assembled them (Heltec LoRa ESP32, GPS, a CardKB keyboard) and set up the encrypted channels. The firmware is Meshtastic and the case is a public design.
E-paper office hub
Calendar, weather, Home Assistant controls and a USB keyboard on a battery e-paper panel.
Round display in a case I designed
A XIAO ESP32-C3 decodes animated GIFs from a microSD card onto a round screen. I modelled the two-part case in CAD and printed it.
Network status display
A Raspberry Pi that shows its own address and link state on an OLED from boot, so a headless box can be found without a monitor, with a network-lost alert.
Raspberry Pi cameras
Low-latency camera streams that stay on the local network, later behind a login.
Wireless presence sensor
A 24 GHz radar on a XIAO sends a smoothed distance over ESP-NOW to a receiver that shows it as a color and flags a dropped link.
Home Assistant wall panel
A touch panel on the M5Stack CoreS3. It lost half its battery a day in sleep until I found the speaker, microphone, camera and 5 V rails still powered and switched them off.
Offline workbench
A Pi on the bench network serving a parts inventory with bills of materials, a browser Arduino IDE that flashes boards over Web Serial, and a GPIO panel.
Earlier firmware was written by hand; larger recent rewrites used AI assistance. Code is available on request.
