Jordan Novak

The identity, credential, and configuration backbone every other service depends on. Users sync in from Authentik SSO; companies, people, AI agents, and fleet-wide config live in one registry instead of a copy in each service.

• Default-deny rights engine with roles and per-resource grants
• Fernet-encrypted credential vault for email, SMS, voice, chat, and Nextcloud
• Onboarding that provisions real accounts, including SSO logins and SIP extensions on the SBC
• Fleet-wide LLM and agent-tool registries that sync automatically from the inference host
• OIDC-gated admin console, separate from the machine-facing REST API

A self-hosted AI phone receptionist. It answers real calls, transcribes and understands the caller, and replies in a natural synthesized voice. No call audio or transcript ever goes to a third-party voice-AI vendor.

• VAD → speech-to-text → LLM → text-to-speech → live RTP, with filler audio to mask model latency
• Barge-in: callers can interrupt mid-sentence (~140 ms energy-based confirm)
• One pipeline, two entry points: PSTN through the PBX, and in-app calling through LiveKit
• Speech-to-text (faster-whisper) and TTS (Kokoro) offloaded to a GPU host for low latency
• Per-agent profiles (prompt, voice, guardrails, transfer targets) loaded live from QuoraIAM

A carrier-grade signaling edge built from open-source parts. A Kamailio session border controller terminates SIP from browsers, apps, and the PSTN carrier. Behind it, an Asterisk PBX runs the dialplan and exposes the call-control API that the voice and presence services consume.

• Kamailio 6 SBC with SIP over WSS and TLS, auto-renewing Let's Encrypt certificates
• RTPengine bridges WebRTC (ICE, DTLS-SRTP) to plain RTP for the PBX, switching profile by call direction
• Brute-force protection via pike rate-limiting and auth-failure bans
• Provisioning API: QuoraIAM creates SIP subscribers over an authenticated, mesh-only endpoint
• Asterisk 22 built from source, PJSIP-only, with ARI (REST + WebSocket) call control

The fleet's event bus and automation hub. It pulls every communication channel into one normalized feed, runs automations against it, builds a behavioral profile of its operator, and tracks which clients are online.

• Five live connectors (Asterisk ARI, IMAP, Nextcloud DAV, Telnyx SMS/voice, Redis), each isolated so one crash never takes down the feed
• 91k+ events ingested and normalized into a single stream
• Flow-graph automation engine with durable wait/resume, plus rule-based triggers with LLM checks
• Identity engine that builds a contact graph, topic frequencies, and a daily diary, then syncs them to a RAG folder
• Real-time SSE feed and heartbeat-based presence for desktop and mobile clients

Project management where AI agents do the work. QouraDinate turns a project plan into tasks and compiles a system prompt for each assigned agent. QouraKeeper, an autonomous executor, picks those tasks up and works through their subtasks against self-hosted models.

• Project wizard that plans work and compiles per-agent system prompts: identity, capabilities, knowledge, contacts, guardrails
• HMAC-signed broker API between the task board and the executor
• Structured output protocol: progress, complete, clarify, decision, blocker
• Human-in-the-loop checkpoints: agents pause for a person, then resume on the next poll
• Rolling per-agent memory and a tool-calling loop backed by the fleet tool registry

The fleet's own inference plane: a GPU workstation that serves every LLM, speech-to-text, and text-to-speech request in the fleet. No per-token bills, and no data leaves the network.

• Multi-model serving through Ollama and llama.cpp behind OpenAI-compatible APIs
• Planning, coding, and reasoning models picked per task through a central registry
• GPU speech-to-text and text-to-speech moved here from the voice host to cut call latency
• Per-company model allow-lists enforced by the QuoraIAM registry

The Linux desktop client for the fleet: AI chat, contacts, voice, and video from one home screen. It shows live reachability for every backend service it talks to.

• Flutter for Linux desktop, split from the Android + Linux quoraMobile client
• Registers straight to the SBC over SIP-over-WSS for native calling
• Presence heartbeats and a live event stream from qouraPresence
• Streaming AI chat with local history and optional text-to-speech playback

The public front door and private-network hub. Internet traffic ends here and is routed over encrypted tunnels, so backend services are never exposed to the internet directly.

• Traefik v3 terminating TLS for 36 hostnames across 3 domains, with automatic Let's Encrypt
• LiveKit WebRTC media server and token service for meetings and in-app calls
• Migrating from hand-built WireGuard hub-and-spoke to a self-hosted Netmaker mesh
• Split-horizon DNS on internal BIND resolvers

A three-node, high-availability Kubernetes cluster that hosts per-company tenants alongside shared services. It was migrated from Docker Swarm in place.

• Every node runs both control plane and etcd, so there's no single point of failure
• Per-tenant Nextcloud instances (files, calendar, contacts) linked to Authentik SSO
• Also hosts Gitea, Passbolt, Redis HA, Qdrant, an MCP tool gateway, and business apps
• Per-app namespaces, with TLS handled upstream at the edge

A full property-management product built on the same fleet: portfolio dashboards, late-rent tracking, and a drag-and-drop builder for automated rent-reminder escalation policies.

• Runs as its own tenant, with a dedicated Nextcloud instance and SSO
• Built for multi-company tenancy, not only internal tooling