Skip to content
sapiqa

Wiktor Kitzman · systems architect

AI systems, from hardware to agent.

I build systems that run in production: agents working on company data, LoRa GPS tracker networks with no internet, and platforms that replace five subscriptions. This site shows what's underneath.

See the systems Book a call
lora.gateway
2.5 km · hops=0
keramos.agent
propose → approve
mcp.oauth
PKCE · token rotation
ingress
cloudflare tunnel only

From three systems in production and pre-launch

commits across three systems since April 2026
1,362commits across three systems since April 2026
FastAPI endpoints
614FastAPI endpoints
lines of Python and TypeScript
165klines of Python and TypeScript
APIs on a public port: traffic comes in through a tunnel
0APIs on a public port: traffic comes in through a tunnel

Systems

The interesting part is underneath

Each system has its architecture and flows laid out, and you can play them step by step. Data in the screenshots is fictional.

01Edge · LoRa · offline-first

SurfCenter · Boardsforce

A water-sports centre that sees every student on the water, even without internet

LoRa range over water measured in a field test, straight to the gateway
2,5 kmLoRa range over water measured in a field test, straight to the gateway
with a solar repeater on the roof: design range, line of sight over water
up to 8 kmwith a solar repeater on the roof: design range, line of sight over water
Take it apart
Safety zones per level on a satellite map of the bay
02AI agent · MCP · voice

Keramos · Studio Rhei & Sway

A London pottery studio run by talking to an agent that changes nothing without approval

from an empty repo to a system with an agent and MCP (329 commits)
17 dnifrom an empty repo to a system with an agent and MCP (329 commits)
API endpoints; the server checks access: customer, staff, owner or agent (OAuth)
304API endpoints; the server checks access: customer, staff, owner or agent (OAuth)
Take it apart
Keramos writing down what the owner said
Keramos reading the answer aloud
Keramos · Studio Rhei & Sway
03Platform · automation · B2B

Werka · Rad Tennis Court

A one-coach tennis business with a system that books courts, bills companies and issues invoices

clubs with live court availability
3clubs with live court availability
API endpoints
112API endpoints
Take it apart
Company offer wizard with a price
Confirming the club slot
Employee attendance

Live · flow

An alarm from the water that needs no internet

Pick a flow and watch the data move through the system. Click any part to see what it does and why.

← swipe the diagram →

WATER · LORA 868 MHZBEACH · NUCBOX, WORKS OFFLINECLOUD · WHEN THERE IS A LINKT1000-EGPS tracker + SOSSolar P1-Prosolar repeaterWIO L1 ProLoRa gateway → USBreceive.pyreceiver + geofenceInfluxDBtelemetry and tracksFastAPIsessions, kit, alarmsPostgreSQLoperational datanginx · dnsmasqLAN, HTTPS, DNSLive · CMSPWA on a tabletNiimbot B1QR labels (BLE)Cloudflare Tunneloutbound, no open portsbook. · panel.Droplet, multi-tenantStripepaymentsBókunOTA, Viatorfirma.deveIDAS waiversClaudeAsk AI agentElevenLabsvoiceAgent fleetoversight (plan)

Flows

The alarm reaches the instructor without the internet.

Step 1 of 6

Click a part of the diagram for details.

  • hardware
  • edge / network
  • service
  • data
  • AI
  • third party
  • people / apps
  • radio
  • tunnel
  • HTTPS
  • local
  • event
Every element, described
T1000-E · GPS tracker + SOS
A Meshtastic tracker on the student's arm. Sends a position every 30 s (shorter intervals clogged the channel and lost telemetry) and has an SOS button. The whole fleet is configured by one script, about a minute per tracker.
Solar P1-Pro · solar repeater
A SenseCAP Solar repeater on a mast. Monitored: no signal for 3 h shows as a fault in the “Mesh health” panel.
WIO L1 Pro · LoRa gateway → USB
A gateway permanently plugged into the NucBox over USB. In a field test it received trackers 2.5 km away over water, with zero mesh hops. With a SenseCAP P1-Pro solar repeater on the roof (5.8 dBi antenna, self-powered) the design range grows to 3–8 km line of sight.
receive.py · receiver + geofence
A separate systemd service. Decodes packets, matches nodes to trackers in the database, checks every position with point-in-polygon against the zones and raises events: SOS, zone breach, GPS silence.
InfluxDB · telemetry and tracks
Time series of positions and telemetry. Session history and analytics are built from it.
FastAPI · sessions, kit, alarms
The core: customers, sessions, rentals, zones, events. Base configuration (brand, currency, map) comes from one file, so the same install serves Mykonos, Hel or a demo.
PostgreSQL · operational data
Customers, sessions, kit (79 items in a season), bookings synced from the cloud. Backups from a timer.
nginx · dnsmasq · LAN, HTTPS, DNS
The beach router hands out addresses and dnsmasq points the domain at the NucBox, so tablets open the same domain with a valid certificate even with no internet.
Live · CMS · PWA on a tablet
Live map with zones, alarms, registration, a customer card with QR, check-in. Installed as a PWA, with an offline map downloaded by one button.
Niimbot B1 · QR labels (BLE)
A label printer driven from the browser over Web Bluetooth: kit labels and customer cards, in bulk too.
Cloudflare Tunnel · outbound, no open ports
The NucBox dials out to Cloudflare, so the beach router has no port forwarding and no open ports. The admin panel sits behind Cloudflare Access.
book. · panel. · Droplet, multi-tenant
Online booking and the owner's panel, multi-tenant. Bookings sync to the NucBox when there is a link; the beach never waits for the cloud.
Stripe · payments
Deposit or full payment at booking. Plan: Stripe Connect Express, so each school connects its own account in 5 minutes.
Bókun · OTA, Viator
OAuth and REST v2 integration: pushing products, prices, availability, photos and the booking webhook.
firma.dev · eIDAS waivers
Waivers signed electronically before going on the water, with an offline version on the tablet.
Claude · Ask AI agent
An agent with read-only tools: sessions, kit, telemetry, mesh health. It has a cost budget and shows anything that needs approval for confirmation.
ElevenLabs · voice
Agent answers and “read the situation” on the map, spoken aloud. Fixed phrases are cached on the NucBox, so they play offline too.
Agent fleet · oversight (plan)
Design: a cheap model watches 20+ sites continuously, a stronger one steps in on anomalies, and fixes arrive as PRs for approval.
SurfCenter · Boardsforce

Services

Four kinds of work, one way of working

01

Operational agents

An agent that knows your data and processes, does the work inside your systems and changes nothing without approval.

  • Agent tools built on your services and rules, not shortcuts into the database
  • Every write as a proposal with the amount and wording, approved with one click
  • An MCP connector for Claude, voice, a cost budget, an action history

02

Edge and offline systems

Systems that must work where there is no internet: hardware, radio, a local server, with the cloud as a bonus.

  • An edge server with a local network, HTTPS and a PWA that works offline
  • Telemetry and location over LoRa / Meshtastic, geofencing, alarms
  • Sync with the cloud when there is a link, without opening ports

03

Vertical platforms

One system instead of five subscriptions: booking, payments, sales channels, invoices and e-signature, joined together.

  • Booking, packages, vouchers, customer and company accounts
  • Stripe, OTA (Bókun/Viator), Fakturownia, e-signature, calendars
  • Sites prerendered for SEO, multilingual from day one

04

Architecture audit and oversight

A map of what really runs in production, what is exposed and what breaks first, followed by agents that keep watch.

  • Architecture diagrams, trust boundaries, open ports, data flows
  • A prioritised risk list with a fix plan
  • Secrets, backups, a recovery procedure
  1. 011–2 weeks, fixed price

    Discovery

    I take apart the process and current systems, draw the target architecture, price the running costs and split the work into stages that each ship something that works.

  2. 02staged, something in production every 1–3 weeks

    Build

    Code with tests, CI/CD and documented decisions. You see progress live, not at the end.

  3. 03monthly

    Care

    Updates, monitoring, backups, oversight agents and time for new work. No retainer for nothing: we set the scope every quarter.

Principles

No vibe coding

AI speeds up the typing, but I own the architecture, the tests and the decisions. Every decision is written down with its reason.

Your code, your accounts

The repository, cloud, keys and domains are yours from day one. No lock-in to me.

Zero open ports

Services behind a tunnel, secrets out of Git, admin access over VPN. Security is the default, not an add-on.

A human approves

The agent proposes, a human approves. Automation has gates wherever money or customers are involved.

Got a process that should run itself?

30 minutes, free. I'll tell you if it makes sense, how I'd build it and what it would cost to run.

Book a call