Systems · Cloud · Embedded · Real-time UX

Building production-grade tools across trading, cloud edge, and musical electronics

This site summarizes work spanning a FastAPI trading platform (Suvriddhi), Oracle Cloud edge infrastructure with OAuth and SSH tunnels, a multi-channel notification bus, ESP32/STM32 microcontroller systems, and music-tech applications (likhAmi, Finger Drums, Swara Laya).

OAuth2 Proxy SSH tunnels & forwards Notify bus MQTT / WLED Bare-metal audio On-device STT

Architecture narrative

Edge platform (eSwara VM)

Shared Caddy TLS front door, Docker Compose services, systemd units, and state-preserving deploy scripts. Secrets and runtime DBs stay on the VM; rsync excludes .env, rosters, MQTT ACLs, and correlation state.

Identity & tunnels

Google OAuth via oauth2-proxy with separate email allowlists for family and TradeX. Identity headers are injected only after OAuth; an nginx gate token blocks spoofed headers through SSH tunnels. Local RDP and Schwab OAuth callback forwards keep admin and broker flows on loopback.

Notify bus

FastAPI hub fans out alerts with correlation IDs to WhatsApp (Whapi), Telegram, SMS (Twilio), and email. Inbound YES/NO webhooks map replies back to the originating alert. Slack is a planned adapter, not yet implemented.

TradeX / devices
    │  POST /api/notify  ·  MQTT
    ▼
Notify hub (eSwara) ──► WhatsApp / Telegram / SMS / email
    │ webhooks (YES)
    ▼
TradeX YES consumer  ·  human-in-the-loop execution

eSwara.com hosts

Public and private names on the eSwara edge VM. Google OAuth gates use per-host email allowlists. Traffic to the Suvriddhi OCI machine is not a DNS redirect — TLS stays on eSwara and an SSH tunnel carries the app.

Same-app aliases share a row. karnatiktok.com is the standalone name for karnaTikTok.
Host What it is OAuth gated Notes
Static pages
portfolio.eswara.com This engineering showcase No Public static site
school.eswara.com Carnatic school of arts No Public static site
Websites
www.eswara.com eswara.com preview.eswara.com Product catalog + India orders No Apex eswara.com permanently redirects to www. preview is the same catalog
admin.eswara.com Store order / analytics dashboard Yes Private back office for www
Pay apps / free services
karnatiktok.eswara.com karnatiktok.com www.karnatiktok.com karnaTikTok — Carnatic practice Yes One app, one Google OAuth allowlist
vibe.eswara.com test1.eswara.com Party projector visuals No Mic listens to room audio (YouTube through speakers) to pick up beat, BPM, and energy so the canvas follows the music. Local files use Web Audio instead — the browser cannot tap YouTube’s soundtrack
subham.eswara.com Hindu calendar reminders (ICS) Yes Google OAuth allowlist
family.eswara.com Family launcher + chaNakya chat Yes Google OAuth allowlist
tradex.eswara.com TradeX trading UI Yes OAuth on eSwara, then SSH tunnel → Suvriddhi OCI (pnl_server). Public exception: /whatif
Infrastructure
notify.eswara.com Notification hub (WhatsApp / Telegram / SMS / email) No API bearer token, not OAuth. YES replies are forwarded to TradeX on Suvriddhi OCI
mqtt.eswara.com Mosquitto MQTT broker No MQTT credentials on port 1883 — not an HTTPS site
automation.eswara.com WLED / Node-RED automation No Public HTTPS front door; Node-RED /nodered may have its own login

Featured projects

1. Suvriddhi / TradeX

Python · FastAPI · Brokers

Cloud-operated decision-support and trading platform: portfolio views, option strategy screeners, order preview/submission, WebSocket terminal, and background scanners. Broker integrations include Schwab OAuth APIs and Fidelity session workflows.

  • Risk-aware credit-spread and index-option tooling with explicit safety scoring
  • Notification client + YES consumer for correlated human confirmation before live tickets
  • Fail-closed access profiles, gate tokens, rate limits, and paper vs live boundaries
  • ~130 Python modules, FastAPI route surface, and a substantial unit-test suite

Portfolio statement describes engineering scope only — not trading performance.

2. Oracle Cloud shared setup

Ops · Caddy · Docker · systemd

Operational infrastructure for two OCI instances: Suvriddhi (app workload) and eSwara (edge platform). Deploy automation preserves server-side secrets; SSH config provides named hosts and localhost-only RDP tunnels.

  • wled-cloud: Mosquitto MQTT, Node-RED, Caddy site roots
  • Persistent SSH tunnel from eSwara → Suvriddhi for TradeX browser gateway
  • Family / TradeX OAuth gates with hardened cookie and header injection
  • Notification hub deployment without rewriting roster or .env state

3. Microcontrollers & ESP32

ESP32 · STM32 · MQTT · WLED

Cloud + device stack for addressable LEDs and product firmware: ESP32 WLED fork with MQTT defaults wired to the OCI broker, plus STM32/Kinetis audio metronome firmware lineage.

  • WLED/MQTT topic ACLs and optional device registry schema
  • STM32F303 dual-DAC audio (~44.1 kHz), SD PCM, tala engine, WS2812 hand LEDs
  • ESP32 maglev control demo (PWM + ranging + web UI)

4. eSwara audio electronics (Swara Laya)

Product firmware · DSP-adjacent

Commercial Carnatic practice instrument lineage (Laya / Siddhi / Sadhana): looping tambura/sruti, 175-tala metronome, LCD UI, and hand-board kriya LEDs. Active work ports the long-shipped NXP Kinetis baseline to STM32 with PlatformIO + libopencm3.

  • Bare-metal ISR timing for audio + rhythm superclock
  • Production hex/font assets and multi-SKU feature flags
  • Roadmap: advanced Swara Laya electronics beyond the current metronome/sruti product

5. likhAmi

Flutter · On-device STT

Cross-platform transcription workspace for Indian classical music: capture lyrics, sargam, and rhythmic syllables into beat-aligned notation with script-aware editing and export.

  • Pluggable STT (Sherpa ONNX / Paraformer / Vosk family)
  • VAD state machine → vocabulary filters → musical-time quantization
  • macOS build path with editable notation model and persistence

6. Finger Drums

React · MediaPipe · Web Audio

Browser-based virtual drum kit driven by webcam hand tracking: fingertip collisions against pads, gesture heuristics, metronome, and timestamped recording/replay.

  • MediaPipe Hands + Web Audio sample playback
  • Debouncing to avoid retrigger while hovering a pad
  • Two-hand tracking and camera selection UX

Technical depth employers usually ask about

Security posture

  • OAuth allowlists + short-lived sessions
  • Constant-time token compares on notify/gate paths
  • Secrets outside git; deploy excludes runtime state

Reliability

  • systemd restart policies and health checks
  • Correlation TTL for alert replies
  • Broker polling isolated from alert latency

Interfaces

  • REST + webhooks + MQTT
  • SSH LocalForward / persistent reverse service tunnel
  • WhatsApp · Telegram · SMS · email (Slack planned)