My Now Page
This page is inspired by Derek Sivers and now the thousands of others who have joined in.
Currently focused on the wilsoon.dev ecosystem - building and re-inventing core infrastructure to deeply understand the protocols that power the web. From OIDC-compliant identity layers to WebRTC P2P relays, I prefer building from the metal up over using black-box frameworks.
Re-inventing the Wheel
My engineering philosophy centers on learning through reconstruction. I believe the best way to master a technology is to split it into smaller, manageable tasks and build it yourself from scratch.
A primary example is my identity layer, id.wilsoon.dev. Instead of using an off-the-shelf provider, I built a custom OAuth2 / OIDC compliant server. This allowed me to implement and understand critical security layers first-hand:
- State & PKCE: Implementing the full Authorization Code Flow with PKCE to secure client communication.
- IFrame Protection: Preventing UI redressing and clickjacking through strict
X-Frame-OptionsandContent-Security-Policyheaders to block unauthorized iframe interception. - Cryptographic Signing: Securing private RSA keys for JWT signing within hardware-backed environments or secure edge runtimes.
- Infrastructure Bridging: Leveraging Cloudflare Access and service tokens to authorize internal app-to-app communication across the ecosystem.
The Architecture
Identity is the gravity of my services. By building the identity provder myself, I have total control over user session management and cross-domain authentication.
The backbone runs on a Cloudflare Worker that balances the load between Vercel and my Raspberry Pi, ensuring users in Singapore get quicker speeds while the service remains available worldwide. The data is stored in PostgreSQL with a Redis database hooked up to it for stateless validation of JWTs.
Projects in this Ecosystem
Status Page Backend & Frontend
ActiveHigh-frequency ecosystem health monitor performing scheduled HTTP and TCP checks via Cloudflare Workers and cloudflare:sockets. Features real-time Telegram alerting for downtime, persistent D1-backed incident logging, and a Tremor-based dashboard for visualizing latency and uptime trends.
status.wilsoon.devCobalt Viewer
Active - InternalA secure media inspection tool deployed on Google Cloud Run for reviewing and processing content through the Cobalt pipeline. Secured behind my custom identity layer.
Federated Identity Provider
ActiveUnified authentication gateway providing secure OIDC and OAuth2.0 identity services across the ecosystem's subdomains. Features passwordless Passkey integration and a Redis-backed session versioning system for real-time global session management.
id.wilsoon.devWebRTC P2P Web Relay
In ProgressA web-based peer-to-peer file transfer system utilizing Cloudflare Durable Objects for WebSocket signaling and STUN/TURN for NAT traversal. Features a stateless HMAC-based session ticketing system for authorized room access and real-time WebRTC DataChannels for direct browser-to-browser media relaying.
Current Focus: Pushing WebRTC Limits
Right now, I am obsessed with making my WebRTC file transfer system as fast and seamless as possible, with the goal to reach USB equivalent transfer speeds (480Mbps and beyond) over a standard web browser.
While I acknowledge the inherent limitations of WebRTC, such as SCTP overhead, packet encapsulation, and signaling latency, I am experimenting with chunk-size optimization and buffer backpressure monitoring to saturate the available bandwidth. The goal is to make P2P transfers feel native, rather than a "best effort" web workaround.
The goal isn't just to make it work. It's to try to make it work to the best of the protocol's abilities.
Get in Touch
If you're curious about re-inventing infrastructure or want to discuss OIDC and WebRTC, reach out via email or explore my projects.