Vahid · Veteran Software Solutions Architect & Engineer

/01 2025 → present Flagship · post-quantum

vChat
Secure Messenger

End-to-end encrypted messenger built post-quantum-first on CRYSTALS-Kyber (ML-KEM). PQXDH key agreement, a Double Ratchet message layer and an epoch-based group key system (GMK) with recovery & sender rotation — all powered by one shared Rust core (KyberSDK) reused across iOS, Android, Tauri desktop and a self-hosted Go backend. BIP39 recovery, multi-device, panic-mode wipe. A standalone project — no shared code with TerraCrypt.

vC.

KyberSDK · Rust post-quantum core

A single Rust crypto engine compiled to a C ABI and reused by every client — no per-platform crypto code, one audited surface.

CRYSTALS-Kyber (ML-KEM) post-quantum KEM
PQXDH post-quantum key agreement
Double Ratchet messaging (AEAD + KDF)
GMK epoch group keys + sender rotation & recovery
BIP39 mnemonic + argon2id / AES-GCM state escrow
FIPS-hardening track

Why a shared core

The hardest, most security-critical code lives once in Rust and is called identically from every platform.

RustCRYSTALS-KyberML-KEM PQXDHDouble RatchetAEAD argon2idC ABI / FFI

iOS Native · Swift / SwiftUI

Modular SPM monorepo — each Core* a framework boundary, each Feature* one surface. Calls the Rust KyberSDK over a C ABI via KyberSDKWrapper.

SwiftUI across DM, group chat, calls & media
vChatNSE: Notification Service Extension for E2E push decryption
CoreCrypto / CoreCryptoDM / CoreCryptoGroup
Encrypted local store (CoreDatabase)
BIP39 recovery + Keychain device identity

Modules

CoreSession, CoreNetwork, CoreMessages
FeatureAuth / DMChat / GroupChat / Call
FeatureMediaMessages, FeatureSettings

SwiftSwiftUISPM NSEKeychainC-FFI

Android Native · Kotlin / Compose

Kotlin client mirroring the iOS feature set, sharing the exact same Rust KyberSDK through JNI bindings.

Jetpack Compose declarative UI
Coroutines + Flow async / reactive streams
Rust crypto core via JNI
Encrypted local store
FCM push with E2E decryption pipeline

Shared core

Same PQXDH / Kyber / GMK logic as iOS — zero crypto re-implementation per platform.

KotlinJetpack ComposeCoroutines JNIFCM

Desktop · Tauri (Rust + TypeScript)

One cross-platform desktop client (Windows, macOS & Linux) embedding the same Rust crypto core natively.

Rust core shared with the mobile clients
TypeScript + Vite front-end
Native tray, menus & notifications
Small native installer, no Chromium overhead

Why Tauri

The crypto engine is already Rust — Tauri lets the desktop app link it directly.

RustTauri 2TypeScript Vite

Backend · Go (self-hosted)

Standalone Go backend on kyber.vaha.net — auth, devices, prekeys, DM & group envelopes, files. Zero TerraCrypt reuse.

Go services: auth, devices, bundles / prekeys, DM + group epochs, files
PostgreSQL 16, Redis 7 (+ RedisBloom)
MinIO (S3) presigned encrypted file storage
APNS + FCM push; WebSocket realtime (kyber.* topics)
Caddy auto-TLS, systemd, JWT + argon2id

Observability

Loki: log aggregation
Prometheus: metrics
Tempo: distributed traces
Grafana: dashboards & alerts

GoPostgreSQLRedis MinIOCaddyWebSocket LokiPrometheusTempoGrafana

/02 2024–2026 Own SaaS · eumeet.eu

EU
Meet

My own video-meeting SaaS: encrypted WebRTC video calls, screen-sharing & chat on a self-hosted media stack. Free tier plus Pro at $10/mo (Polar billing). Four clients (web, desktop, iOS & Android) on one PHP API with JWT auth shared across subdomains.

EUm

API & Real-time

PHP + SQLite API behind a self-hosted WebRTC media server (SFU) for routing 1-on-1 and group calls with encrypted streams.

PHP REST API + SQLite (users, rooms, billing)
JWT cookie auth shared across subdomains
WebRTC SFU media server for video routing
Same-origin token proxy for browser clients
Polar checkout + webhooks for Pro billing
Free / Pro ($10/mo) plan enforcement

Infrastructure

Docker Compose for the media stack
Apache reverse-proxy, Cloudflare DNS + TLS
Cloudflare Origin cert (wildcard *.eumeet.eu)
Encrypted SRTP media transport

PHPSQLiteJWT WebRTCSFUDocker CloudflarePolar

Web App · React + Vite

Single-page web client at app.eumeet.eu, joins calls straight from the browser, gets its media token same-origin so no CORS pain.

React + TypeScript, built with Vite
In-browser WebRTC calls & screen-share
JWT cookie scoped to .eumeet.eu
Same-origin token proxy (token.php)

Desktop · Tauri

One codebase shipped as a native desktop app
Tauri (Rust shell) wrapping the web client
Small binary, native window & system integration

ReactTypeScriptVite TauriRustWebRTC

iOS Client · Swift

Native Swift app integrating CallKit, PushKit and the system call UI. Supports multitasking, picture-in-picture and AirPlay.

CallKit + PushKit deep integration
WebRTC.framework with custom signaling
Picture-in-Picture during calls
JWT login, token stored in Keychain
Localized for 12+ EU languages

Polish

Smooth transitions, custom haptics
Accessibility (VoiceOver, Dynamic Type)
Background audio & CarPlay

SwiftCallKitPushKit WebRTCKeychainSwiftUI

Android Client · Kotlin

Native Kotlin app with full ConnectionService integration, foreground call services and Material 3 design.

ConnectionService + Telecom integration
Foreground service for ongoing calls
Material 3 + Compose UI
JWT login, token in EncryptedSharedPreferences
Background-call PiP

Highlights

Adaptive bitrate streams
Ringtone & ringback parity with iOS
Push via FCM with E2E payload

KotlinJetpack ComposeWebRTC Telecom APIFCMMaterial 3

/03 2026 Live · mtb.vaha.net

Sandžak
Outdoor

Outdoor activity platform for the Sandžak region — a Strava-style tracker for biking, gravel, road & hiking. Record rides over GPS, auto-match segments & leaderboards, plan and follow routes, log community places, and share to a social feed. Three native apps — iOS, Android & HarmonyOS — on one self-hosted Go + PostGIS backend.

SO.

What it is

Record an activity, see which segments you crossed, climb the leaderboards, then plan the next route — all over offline-friendly vector maps of the region.

GPS recording: MTB, gravel, road, e-bike & hike
Segments + leaderboards — Kralj / Kraljica Brda
Routes: plan, surface-tag, refine & voice-follow
Community places: peaks, waterfalls, springs, vie ferrate
Social feed: follow, kudos, comments, messages
FIT import + HealthKit / Health Connect
PRO tier: create, navigation, voice, live activity, export

One backend, four clients

A single Go + PostGIS API serves three native apps plus a marketing site. Live at mtb.vaha.net, localized sr / en / bs.

GoPostGISSwiftUI Kotlin / ComposeArkTSMapLibre JWTDocker

API & spatial data

Go 1.25 on the pure stdlib (net/http method+path routing, no framework). PostgreSQL + PostGIS for all geometry, pgx/v5 driver, ~36 feature handlers in one package.

Activities with 3D track geometry + sensor streams
Segment efforts: PRs & per-bike-type leaderboard splits
Routes with surfaces, markers & offline refinement
Places with 4-vote community confirmation
Social: follows, kudos, comments, messages, notifications
FIT file parsing, GIST spatial indexes, timeline composites

Roles & ops

Role ladder: user → editor → moderator → admin → superadmin
Review separation-of-duties (no approving your own)
PRO entitlements via feature flags on /api/me
JWT HS256 + bcrypt, 30-day Bearer tokens
Docker Compose + nginx, rsync deploy to VPS

Go 1.25PostgreSQLPostGIS pgx/v5JWTbcrypt FITDockernginx

iOS · Swift / SwiftUI

Min iOS 17, XcodeGen project, MapLibre GL Native maps. JWT stored in the Keychain.

GPS recorder with WidgetKit Live Activities
HealthKit import, route follow with voice cues
Segment & route review queues for moderators
Social, messages, notifications, bikes, PRO control
RemoteImage disk cache for stutter-free feed scroll
Localized sr / en / bs via Localizable.xcstrings

Stack

Swift 5SwiftUIMapLibre XcodeGenWidgetKitLive Activities HealthKitKeychain

Android · Kotlin / Compose

Kotlin 2.1, 100% Jetpack Compose, minSdk 29 / target 35. Retrofit + OkHttp + Kotlinx Serialization, Coil images, MapLibre 11.

Foreground recording service + route-follow engine
Health Connect import, MapLibre maps
Glance home-screen widget
JWT in EncryptedSharedPreferences
Single-activity NavHost, per-app locale (~607 keys)
Coil mem + 200 MB disk image cache

Stack

Kotlin 2.1Jetpack ComposeRetrofit OkHttpCoilMapLibre 11 Health ConnectGlance

HarmonyOS · ArkTS / ArkUI

Third native client, built in DevEco Studio with hvigor and ArkTS declarative UI. Same REST API; data layer mirrors Android one-to-one so screen porting is mechanical.

@ohos.net.http client, Bearer + snake_case JSON
JWT auth store in encrypted preferences
DTOs mirror the Android wire models
MapLibre (maplibre_harmony.har) + Leaflet rawfiles
Localized en / zh / bs

Stack

ArkTSArkUIDevEco Studio hvigorMapLibre@ohos.net.http

/04 2026 → present Own SaaS · POS

vCoffee
Café POS & Fiscalization

A modern POS for cafés & hospitality, built for the Serbian market and sold on monthly subscription. Guests order by scanning a table QR; waiters, kitchen and bar work from phones; the owner runs everything from an admin. A “thick local, thin cloud” design: a Tauri desktop “box” runs a Rust (axum) server, an encrypted SQLite (SQLCipher) store and a React PWA over the venue LAN — fully offline. Serbian fiscalization (ESIR → LPFR) with central license control over a VPS.

vC.

Kasa & touch POS · Tauri desktop

The venue PC runs a Tauri desktop app — the local “box”. A visual 2D table map per room; tap a table to open its bill.

Drag-and-drop floor plan: rooms, floors, table layout
Fast bill entry; split a bill by person (drag items)
Live occupancy counters & realtime updates
Receipt printing; table frees on payment
7 theme palettes + light / dark

Built for speed

Touch-first UI tuned for a busy bar — the whole shift runs from one screen.

Tauri 2RustReact TypeScriptTouch UI

QR ordering & staff apps · React PWA

Served over the venue LAN. Guests scan a table QR; waiters, kitchen and bar each get their own surface.

Guest: scan table QR, browse menu, send order (waiter confirms)
Loyalty via phone-number OTP + points
Waiter PWA: approve orders, take payment
Kitchen / Bar KDS: orders auto-routed by category
Wi-Fi-scoped ordering, rate-limit + device blocking

One LAN, four surfaces

Guest, waiter, kitchen/bar and admin/POS all talk to the same local box.

ReactPWAreact-router ViteQRWebSocket

Local server · Rust (axum)

A self-contained Rust server runs on the box — REST + WebSocket, fully offline, no internet dependency.

axum REST API + WebSocket live updates
SQLite via rusqlite, encrypted with SQLCipher
Inventory auto-deduct on sale + stock-take reports
argon2 role PINs (admin / waiter / kitchen / bar)
OS keychain for secrets (keyring)

Offline-first

The café keeps working with no connection — the box is the brain.

Rustaxumtokio SQLiteSQLCipherargon2

Serbian fiscalization · ESIR → LPFR

PURS-compliant fiscal receipts: the app acts as an ESIR talking to an LPFR and printing to a thermal printer. No evasion features — certifiable by design.

ESIR → LPFR → thermal printer pipeline
LPFR integration implemented in Rust
Legitimate non-fiscal categories (staff meal, comp, waste)
Built to the PURS / LPFR specification

Compliant by design

Certification with the tax authority is a feature, not an afterthought.

RustESIRLPFR PURSThermal print

License control · VPS (license.vaha.net)

Thin cloud: a per-café subscription. An unpaid subscription locks the app and encrypts the local DB; unlock only on vendor approval.

Central license server (Node.js) on a VPS
ed25519-signed licenses, verified offline
DB-encryption tie-in (SQLCipher) on lockout
TOTP 2FA admin, Nginx-fronted

Subscription enforcement

Multi-tenant: each café is its own tenant, billed monthly.

Node.jsed25519TOTP 2FA NginxSQLCipher

/05 2022 → present Flagship

TerraCrypt
Messenger

End-to-end encrypted messenger spanning iOS, Android, Tauri desktop & a full self-hosted Go backend with admin dashboard and observability stack. Group chats, voice, video, file transfer, all protected by custom-curve cryptography running on every device.

TC.