{ "meta": { "title": "Fabrizio Salmi (fab): identity context", "intro": "Context about the person you are working with. Use it to adapt language, rigor and defaults. Project files (AGENTS.md, CLAUDE.md) in the current repo take precedence over this.", "updated": "2026-10-15", "schema": "nodes: {id, type, label, text?, url?, ask?}; edges: {from, rel, to}", "schema_version": 1 }, "nodes": [ { "id": "fab", "type": "person", "label": "Fabrizio Salmi (Fab)", "text": "Infrastructure architect and engineer based in Genoa, Italy. 20+ years designing, building and defending mission-critical systems, from SMBs and non-profits to European financial markets and global CDNs. Philosophy: autonomy through code, turning manual and fragmented operations into automated platforms. Self-described 'not a coder': started publishing open source around 2023 and learns by shipping, fail after fail. Works solo with several AI agents in parallel. Italian native, professional English. Classical high school (liceo classico)." }, { "id": "role-independent", "type": "role", "label": "Independent engineer and fractional CTO (2026 to present)", "text": "Freelance. Builds data, analytics and infrastructure platforms for clients. Also independent security researcher doing coordinated disclosure (private report plus fix, per SECURITY.md)." }, { "id": "role-mainstreaming", "type": "role", "label": "MainStreaming SpA (Jul 2025 to Apr 2026)", "text": "Senior System Engineer at a video streaming CDN, focused on CDN technologies." }, { "id": "role-borsa", "type": "role", "label": "Borsa Italiana / Euronext (2019 to 2025)", "text": "Senior Solutions Architect (resilience and innovation), previously Senior Engineering Specialist in architecture and engineering. Perimeter security, DNS, Cloudflare, AWS, high-availability services for financial markets." }, { "id": "role-sorint", "type": "role", "label": "SORINT.lab (2018 to 2019)", "text": "System Engineer on Borsa Italiana (LSEG) projects." }, { "id": "role-youtube", "type": "role", "label": "YouTube partner (2014 to 2019)", "text": "25M+ views on own channel, 50M+ on others. No camera: FFmpeg, automation and SEO." }, { "id": "certmate", "type": "project", "label": "CertMate", "url": "https://github.com/fabriziosalmi/certmate", "text": "Self-hosted TLS certificate lifecycle platform: issue, renew, discover, inventory, deploy. REST API, UI, MCP, Helm, CLI via Homebrew. Flagship project, ~1.4k stars. Fab is maintainer and reviews contributor PRs.", "ask": { "question": "If you manage TLS at scale: what would stop you adopting CertMate, and what one change would fix it?", "in_scope": "Adoption blockers seen in a real deployment: CA support, DNS providers, deploy targets, auth, scale, upgrades.", "out_of_scope": "Wishlists with no deployment behind them, rewrites in another language, UI theming.", "evidence": "Your setup (CA, DNS provider, order of magnitude of certificates) and the file:line or API endpoint involved." } }, { "id": "caddy-waf", "type": "project", "label": "caddy-waf", "url": "https://github.com/fabriziosalmi/caddy-waf", "text": "WAF middleware for Caddy: regex rules, IP and DNS filtering, rate limiting, GeoIP, Tor, anomaly detection. In the Caddy module registry, ~900 stars.", "ask": { "question": "Which request should caddy-waf handle better: a false positive it blocks or an attack it lets through?", "in_scope": "Concrete false positives or negatives, rule performance, rule ordering.", "out_of_scope": "Generic WAF advice, ports to other web servers, commercial rule sets.", "evidence": "The raw request (sanitized), the expected verdict, and the rule id or file:line that decides it." } }, { "id": "security-suite", "type": "project", "label": "Security tooling", "text": "patterns (OWASP CRS and bad-bot rules for Nginx, Apache, Traefik, HAProxy), blacklists (daily aggregated domain blocklist), wildbox (self-hosted SIEM/SOAR/WAF platform), zion (Rust TLS reverse proxy with WAF), secure-proxy-manager, aidlp (DLP for LLM endpoints), llmproxy (security-first LLM gateway with audit log), nis2-public (NIS2 posture management), naso (breach exposure monitoring), agssh, limits, caddy-mib, fqdn-model.", "url": "https://github.com/fabriziosalmi", "ask": { "question": "Which domain blocklist source should blacklists add or drop?", "in_scope": "Public sources whose license allows redistribution; false positives with the affected domains.", "out_of_scope": "Commercial or paid feeds, sources requiring sign-up, unrelated security tools.", "evidence": "Source URL, license, update frequency, and measured overlap or false positives against the current list." } }, { "id": "proxmox-suite", "type": "project", "label": "Proxmox and self-hosting tooling", "text": "proxmox-vm-autoscale and proxmox-lxc-autoscale (and an ML variant), proxxx (Rust TUI/CLI cockpit for Proxmox VE and PBS), lws (aws-cli-like CLI for Proxmox, LXC, Docker), proxmox-cluster-balancer.", "url": "https://github.com/fabriziosalmi/proxxx", "ask": { "question": "Which Proxmox VE or PBS operation do you still script by hand that proxxx should cover?", "in_scope": "A concrete operation with the PVE/PBS API call behind it.", "out_of_scope": "GUI requests, other hypervisors, cluster design advice.", "evidence": "The API endpoint (e.g. /nodes/{node}/lxc) and the script you use today." } }, { "id": "cloudflare-suite", "type": "project", "label": "Cloudflare and EU sovereignty tooling", "text": "cf-box (multi-account Cloudflare API toolkit), zonecontrol and wafcontrol (Cloudflare settings as YAML via CI), dnscontrol-actions, rainlogs (NIS2 log archiving), flareover (deterministic migration from Cloudflare edge to EU-sovereign infrastructure).", "url": "https://github.com/fabriziosalmi/flareover", "ask": { "question": "Which Cloudflare feature has no clean EU-sovereign equivalent in flareover's mapping yet?", "in_scope": "A specific Cloudflare feature and a specific EU-operated replacement.", "out_of_scope": "Arguments for or against leaving Cloudflare, non-EU providers, general cloud comparisons.", "evidence": "Cloudflare docs URL for the feature, the EU provider and feature that replaces it, and where flareover maps it today." } }, { "id": "ai-devtools", "type": "project", "label": "AI developer tooling (l0 family and friends)", "text": "l0-memory (minimal long-term memory for AI assistants: Go MCP + SQLite), l0-git (deterministic project-hygiene gates), l0-compressor (compresses command output to save tokens), slopless (static analysis for AI-slop patterns), noted (local-first Markdown notes with AI), silicondev (local LLM fine-tuning on Apple Silicon), git-flare (coordinating many coding agents on one repo). Used daily across IDEs.", "url": "https://github.com/fabriziosalmi/l0-memory", "ask": { "question": "How would you make cross-tool memory for AI assistants both minimal and trustworthy? One concrete mechanism.", "in_scope": "One mechanism for l0-memory: schema, verification, expiry, conflict resolution, provenance.", "out_of_scope": "Vector database or RAG pitches, hosted services, new heavy dependencies.", "evidence": "Where it plugs into l0-memory (file:line) and the concrete failure it prevents." } }, { "id": "italian-ai", "type": "project", "label": "Italian-language AI", "text": "glm-ocr-ita (GLM-OCR fine-tuned for Italian documents, 8-bit MLX, on Hugging Face), a small Italian LM trained on MLX, Italian translation of oMLX upstream, ai-security (Italian guide). Priorities for OCR: quality, then speed, then size.", "url": "https://github.com/fabriziosalmi/glm-ocr-ita", "ask": { "question": "Where does glm-ocr-ita fail on Italian documents?", "in_scope": "Public, license-compatible Italian samples with exact ground truth.", "out_of_scope": "Private or personal documents, model-generated ground truth, languages other than Italian.", "evidence": "Sample URL and license, the exact expected text, the model output, and the version tested." } }, { "id": "llm-feeds", "type": "project", "label": "LLM content experiments", "text": "UglyFeed (RSS retrieve, rewrite and serve with LLMs, ~300 stars), newsgator, ethical-ai, ai-hallucination-research, ai-dependency-guard.", "url": "https://github.com/fabriziosalmi/UglyFeed" }, { "id": "music-software", "type": "project", "label": "Music software", "text": "mixi (browser-native deterministic audio workstation, Rust/Wasm DSP), mixi-cut (timecode vinyl generator), open-bpm, txt2vst, web-kick.", "url": "https://github.com/fabriziosalmi/mixi", "ask": { "question": "Give a test vector where mixi's DSP output is wrong or not deterministic.", "in_scope": "Reproducible audio diffs, BPM or beat-grid errors, timing drift between runs or browsers.", "out_of_scope": "Feature requests for effects, comparisons with commercial DJ software.", "evidence": "Input file (license OK), expected vs actual output, browser and version." } }, { "id": "identity", "type": "project", "label": "This identity graph", "text": "A single source describing Fab for any AI tool: local symlinked file for his own agents, static JSON API for everyone else.", "url": "https://github.com/fabriziosalmi/identity", "ask": { "question": "How would you change this graph's shape so agents use it more reliably and with fewer tokens?", "in_scope": "Schema, rendering, endpoint layout, token efficiency, how asks are expressed.", "out_of_scope": "Adding personal data, tracking, analytics, sign-ups.", "evidence": "Before and after token counts, or a concrete agent failure the change fixes." } }, { "id": "sk-infra", "type": "skill", "label": "Infrastructure", "text": "Linux, networking, DNS (BIND, PowerDNS), CDN, Proxmox VE/PBS and LXC, Docker, Kubernetes, AWS, GCP, Cloudflare, Caddy, Nginx/OpenResty, Tailscale, Prometheus/Grafana, Terraform, Helm, GitHub Actions and GitLab CI." }, { "id": "sk-security", "type": "skill", "label": "Security", "text": "WAF, DDoS defence, TLS/PKI and ACME, perimeter security, SIEM/SOAR, DLP, supply chain (gitleaks, Dependabot, SLSA provenance, pinned digests), NIS2, coordinated disclosure." }, { "id": "sk-lang", "type": "skill", "label": "Languages and frameworks", "text": "Python first (FastAPI, Pydantic, SQLAlchemy, Celery, Django, Flask, uv), then TypeScript (React, Next.js, VS Code extensions), Rust, Go. Bash everywhere." }, { "id": "sk-ai", "type": "skill", "label": "AI and ML", "text": "MLX first on Apple Silicon (PyTorch as fallback), fine-tuning and quantization, MCP servers, LLM gateways (litellm, OpenAI-compatible), multi-agent workflows across Claude, Gemini/Antigravity, Codex, OpenCode." }, { "id": "p-language", "type": "preference", "label": "Language", "text": "Talk to me in Italian. Code, commits and public GitHub text in English. I type fast: fused words and typos are normal, read for meaning, never ask me to rephrase for spelling." }, { "id": "p-gate", "type": "preference", "label": "Ask before outward actions", "text": "Wait for an explicit go ('via', 'ok vai') before releases, tags, deploys, publishing, merging to main or touching anything outside the repo. 'Solo per parlarne' means discuss, do not build. Big steps: talk first." }, { "id": "p-rigor", "type": "preference", "label": "Draconian rigor", "text": "Verify by running the code. Measure, do not estimate; write the prediction before measuring. A false success is worse than a failure: do not trust exit codes alone. Never invent hosts, commands, numbers or features. Remove unproven claims from docs; rewrite docs from the code." }, { "id": "p-output", "type": "preference", "label": "Short verdicts, numbered choices", "text": "One-screen verdicts, not surveys. When a decision is needed, give numbered options with a recommendation so I can answer '1', '2 ok', 'vai con 3'. On 'status update?': what is done, what is running, what is blocked, what you need from me." }, { "id": "p-sample", "type": "preference", "label": "Sample first, then scale", "text": "Smoke-test on a small subset before long runs or big datasets. Machines have 16 GB RAM: set explicit memory limits and caps. Heavy training never runs on the work laptop." }, { "id": "p-public-text", "type": "preference", "label": "Public text", "text": "Professional tone, no emoji, no em dash. Draft first, show me the full text, publish only after my ok. PR reviews: directive and verified, we decide and tell the contributor what to change." }, { "id": "p-git", "type": "preference", "label": "Git hygiene", "text": "Conventional Commits with scope (feat(tls):, fix(release):, docs:, chore(release): vX.Y.Z). Subjects state the resulting behaviour, e.g. 'the renewal sweep asks about a name before it builds a path from it'. Changes go through PR/MR. Decisions live in commits and issues, not summary docs." }, { "id": "p-secrets", "type": "preference", "label": "Secrets", "text": "Never read, print or commit secrets. They live in a secrets manager or in .env on servers. Client data never goes to third-party models unless I say so." }, { "id": "p-multiagent", "type": "preference", "label": "Multi-agent setup", "text": "I run several sessions and tools at once. Often another model generates and Claude acts as architect and reviewer. When I paste another AI's report, check it skeptically against the code. Break-tests are the proof: disable the check, the test must fail." }, { "id": "st-work", "type": "style", "label": "Work emails", "text": "'Ciao X, ciao a tutti,' then numbered points, ALL-CAPS section headers, concrete numbers, a clear ask, 'Grazie, Fabrizio'. Batches open items into one message instead of many." }, { "id": "st-casual", "type": "style", "label": "Casual and social", "text": "Short, warm, direct, emoji and ':D'. Open source posts end with 'Enjoy and contribute'. Blunt on non-negotiables." }, { "id": "i-tekno", "type": "interest", "label": "Freetekno music", "text": "DJ and producer since 1998 (Fab / Space Invaders Tekno Sound System). Vinyl releases. Founder of Free Underground Tekno Radio (24/7, since 2008) and WebTeK. Ableton Live, Traktor, analog machines.", "url": "https://soundcloud.com/spaceinvaders" }, { "id": "i-audiolibri", "type": "interest", "label": "Audiolibri.org", "text": "Founder of a free audiobooks directory and search engine in Italian, with a large YouTube and Telegram audience.", "url": "https://audiolibri.org" }, { "id": "i-causes", "type": "interest", "label": "Causes", "text": "Arts and culture, civil rights, education, environment, animal welfare, science, digital sovereignty in Europe." }, { "id": "l-github", "type": "link", "label": "GitHub", "url": "https://github.com/fabriziosalmi" }, { "id": "l-linkedin", "type": "link", "label": "LinkedIn", "url": "https://www.linkedin.com/in/fabriziosalmi" }, { "id": "l-hf", "type": "link", "label": "Hugging Face", "url": "https://huggingface.co/fabriziosalmi" } ], "edges": [ { "from": "fab", "rel": "works_as", "to": "role-independent" }, { "from": "fab", "rel": "worked_at", "to": "role-mainstreaming" }, { "from": "fab", "rel": "worked_at", "to": "role-borsa" }, { "from": "fab", "rel": "worked_at", "to": "role-sorint" }, { "from": "fab", "rel": "worked_at", "to": "role-youtube" }, { "from": "fab", "rel": "maintains", "to": "certmate" }, { "from": "fab", "rel": "maintains", "to": "caddy-waf" }, { "from": "fab", "rel": "maintains", "to": "security-suite" }, { "from": "fab", "rel": "maintains", "to": "proxmox-suite" }, { "from": "fab", "rel": "maintains", "to": "cloudflare-suite" }, { "from": "fab", "rel": "maintains", "to": "ai-devtools" }, { "from": "fab", "rel": "maintains", "to": "italian-ai" }, { "from": "fab", "rel": "maintains", "to": "llm-feeds" }, { "from": "fab", "rel": "maintains", "to": "music-software" }, { "from": "fab", "rel": "maintains", "to": "identity" }, { "from": "certmate", "rel": "uses", "to": "sk-security" }, { "from": "certmate", "rel": "uses", "to": "sk-lang" }, { "from": "caddy-waf", "rel": "uses", "to": "sk-security" }, { "from": "security-suite", "rel": "uses", "to": "sk-security" }, { "from": "proxmox-suite", "rel": "uses", "to": "sk-infra" }, { "from": "cloudflare-suite", "rel": "uses", "to": "sk-infra" }, { "from": "ai-devtools", "rel": "uses", "to": "sk-ai" }, { "from": "italian-ai", "rel": "uses", "to": "sk-ai" }, { "from": "llm-feeds", "rel": "uses", "to": "sk-ai" }, { "from": "role-borsa", "rel": "uses", "to": "sk-infra" }, { "from": "role-borsa", "rel": "uses", "to": "sk-security" }, { "from": "role-mainstreaming", "rel": "uses", "to": "sk-infra" }, { "from": "fab", "rel": "prefers", "to": "p-language" }, { "from": "fab", "rel": "prefers", "to": "p-gate" }, { "from": "fab", "rel": "prefers", "to": "p-rigor" }, { "from": "fab", "rel": "prefers", "to": "p-output" }, { "from": "fab", "rel": "prefers", "to": "p-sample" }, { "from": "fab", "rel": "prefers", "to": "p-public-text" }, { "from": "fab", "rel": "prefers", "to": "p-git" }, { "from": "fab", "rel": "prefers", "to": "p-secrets" }, { "from": "fab", "rel": "prefers", "to": "p-multiagent" }, { "from": "fab", "rel": "writes", "to": "st-work" }, { "from": "fab", "rel": "writes", "to": "st-casual" }, { "from": "fab", "rel": "into", "to": "i-tekno" }, { "from": "fab", "rel": "founded", "to": "i-audiolibri" }, { "from": "fab", "rel": "cares_about", "to": "i-causes" }, { "from": "fab", "rel": "is_on", "to": "l-github" }, { "from": "fab", "rel": "is_on", "to": "l-linkedin" }, { "from": "fab", "rel": "is_on", "to": "l-hf" } ] }