Hi, I'm Angga. I build secure, passwordless identity platforms.
Deep in identity, authentication, and applied cryptography — Keycloak, Verifiable Credentials, WebAuthn, post-quantum — and broad across the stack, from frontend to cloud-native. Building open-source tools like pqinv and awswaste, and writing about it here.
That's me.
I care about secure, well-built systems. By day I develop VIA's self-hosted Keycloak identity platform; by night I ship open-source tools like pqinv and awswaste and write about identity, security, and cloud-native engineering here.
More about meOpen-source tools
pqinv
Post-quantum readiness scanner for identity infrastructure.
Inventories the crypto an identity platform actually uses — OIDC/JWKS signing keys, TLS handshakes, cert chains, source code — grades it against the NIST PQ timeline, and gates CI on the result.
GoOIDC / KeycloakCBOMawswaste
Find AWS waste from the terminal.
Scans an account for idle and orphaned resources — unattached volumes, idle NAT gateways, orphaned snapshots — and prints each finding with an estimated monthly cost and a fix command.
GoAWSFinOps
Currently working on
Micro-SaaS
A small open-source DevOps tool — currently in exploration.
Tech blog
One post a week — engineering retros, not generic tutorials.
Open-source
Contributing to Ghost. Aiming for a PR every two weeks.
Mobile app
Subscription-based product, parked until SaaS validates.
Latest posts
View all- How I design a database now: rules from five production schemasSchemas I've owned in production — an 85-model construction SaaS, an identity platform, a staking backend, a marketplace API — taught me a short list of rules I no longer negotiate on. Snapshots for money, triggers for audit, constraints for invariants, and the isolation level nobody changes.
- What it actually takes to deploy your app on EKSThe checklist looks short: network, cluster, nodes, ECR, deploy. Each line hides a day of work. A field guide from taking a real app to an EKS cluster — nine subnets, Pod Identity, managed services, and the manifest that finally ships it.
- Building awswaste: finding AWS waste from the terminalAn open-source Go CLI that scans an AWS account for idle and orphaned resources and estimates the monthly cost — the Trusted Advisor checks you shouldn't need a Support plan for. Here's the origin story.