13/13tests passing
WhatsApp Cloud API audit and a secure webhook
A toolkit that shows whether a WhatsApp integration is really official and who owns it, plus a webhook that verifies Meta's signature and never processes a message twice.
Available for new projects
Websites, systems and AI that run on your own server
Full-stack developer and systems engineer from Jordan. I build web platforms, dashboards and internal systems, and run AI models on your own server when data privacy comes first.
- Clear, phased delivery
- Docs in Arabic
- Tested before handover
- Arabic + English, full RTL
Numbers from real work
Every number here comes from a test or measurement I ran myself, and the files exist. Tap any number to see how it was measured.
6→
tokens per second from a 35B model on a 4 GB GPU, before and after tuning
evaluation cases passed by the document assistant
audio tracks delivered, 0% packet loss in a load test
automated tests passing across three kits
VMs and containers running on one host
$ cd whatsapp-webhook && npm test | tail -3
ℹ tests 13 ℹ pass 13 ℹ fail 0
$ cd offline-sync && python3 -m pytest -q | tail -1
34 passed in 0.10s
$ cd rag-assistant && python3 -m pytest -q | tail -1
38 passed in 0.74s
export function isValidSignature(rawBody, signatureHeader, appSecret) {
if (!appSecret || typeof signatureHeader !== "string") return false;
const header = signatureHeader.trim();
if (!header.startsWith("sha256=")) return false;
const receivedHex = header.slice("sha256=".length);
// SHA-256 hex digest is always 64 chars
if (!/^[0-9a-fA-F]{64}$/.test(receivedHex)) return false;
const expected = Buffer.from(computeSignature(rawBody, appSecret).slice(7), "hex");
const received = Buffer.from(receivedHex.toLowerCase(), "hex");
if (expected.length !== received.length) return false;
return timingSafeEqual(expected, received);
}
Tools I work with every day
- Next.js
- React
- TypeScript
- Node.js
- NestJS
- PostgreSQL
- Supabase
- Docker
- Proxmox
- Linux
- Ubuntu
- Cloudflare
- Flutter
- Expo
- Laravel
- PHP
- Python
- FastAPI
- WhatsApp Cloud API
- Odoo
- n8n
- Caddy
- Google Cloud
- Tailwind CSS
- Gitea
- Redis
- CUDA
- Ollama
- Authentik
Fixed-price services
Four tightly scoped services on Khamsat. Each one builds on work I've already shipped and tested, so delivery is quick and predictable.
Connect the official WhatsApp Cloud API to your site or system
From$503 days
- Meta's official API, no unofficial QR tools that can get your number banned
- Account review: assets, permissions and billing owned by you
- Secure webhook with signature verification and de-duplication
- Approved template messages: order confirmations, reminders, shipping updates
Add-ons: template automation, a simple inbox dashboard, 24-hour delivery
Install an open-source system on your server, with SSL and backups
From$252 days
- n8n, Supabase, Odoo, Mattermost, Uptime Kuma and more
- Docker and a hardened server: firewall, automatic updates
- Your domain with automatic SSL
- Automatic backups and a short runbook in Arabic
Add-ons: extra systems, nightly off-site backups, uptime alerts to Telegram
An AI assistant that answers from your company files, with sources
From$605 days
- Every answer cites its source: file name and page
- If the answer isn't in your files, it says so instead of inventing one
- Arabic and English, hardened against prompt injection
- Via API, a Telegram bot, or a chat widget on your site
Add-ons: Telegram bot, web chat widget, fully on your own server with a private model
AI product descriptions inside Google Sheets
From$101 day
- A button in your sheet writes a description for every product
- Arabic or English, at the length you choose
- Skips products that already have a description
- No server, no subscription: you only pay OpenAI usage
Add-ons: SEO titles and tags, Arabic + English versions, Salla/Zid/Shopify export
How I work
The same steps on every project, small or large.
- 1
Pin down the scope
We agree in writing on what gets delivered, and what I need from you, before I start.
- 2
Deliver in phases
Each phase ends with something you can see and try, so you never wait until the end to know where things stand.
- 3
Test before handover
Automated tests where they matter: the WhatsApp kit ships with 13 tests, the Odoo sync daemon with 34.
- 4
Document in Arabic
An Arabic runbook that explains how to run, restore and extend the system after I'm done.
Case studies
The problem, what I built, the stack and the measured result. No client names, no invented numbers.
30/30audio tracks, 0% packet loss
A self-hosted LiveKit voice server for a Flutter app
Audio rooms on your own server instead of per-minute billing, with a one-command install and audio-only tokens.
34tests passing
An offline-first Odoo server that syncs to the cloud
The shop always works on a local Odoo, and a background daemon pushes invoices and customers to the cloud when the internet returns, without duplicates.
20/20evaluation cases
A document assistant that cites its sources
Answers only from your files, cites the file and section, says when the answer isn't there instead of inventing one, and flags instructions hidden in documents.
14VMs and containers
A complete self-hosted infrastructure on Proxmox
Git with CI, a database, single sign-on, secrets management, error and uptime monitoring and a mail relay, all on one machine I run every day.
6 → 37tokens per second
A 35B model on a 4 GB GPU: from 6 to 37 tokens per second
Diagnosing a slow local model: the cause wasn't the hardware but a full swap file. Then tuning and measuring about 20 models.
Private AI on your own server. Your data never leaves.
Contracts, staff records, customer data: some files should never be sent to an outside service. I run the model on your own server, so it reads your files and answers inside your network.
- Nothing leaves your network
- Files, questions and answers all stay on your machine.
- No per-request bill
- A local model needs no API subscription, so costs don't grow with every question.
- On sensible hardware
- I pick the model and settings that fit your server, and benchmark them before handover.
On my own server: a 35B-parameter model on a 4 GB GPU, generating 37 tokens per second.
Ask about running it on your serverYour server
Company files
Local model
Answer + source
Ready-made kits for developers and agencies
The same tools I use on client projects, packaged so you can start right away. English and Arabic guides included.
Self-hosted LiveKit voice server for Flutter apps
Replace ZEGOCLOUD/Agora per-minute bills: one-command install, auto TLS, token server, and a Flutter voice-room screen.
$19Buy now
WhatsApp Cloud API webhook starter + ownership audit
Zero-dependency TypeScript webhook with 13 tests, a template sender, and a 60-item audit checklist.
$15Buy now
Offline-first Odoo server + auto-sync daemon
For shops with unreliable internet: Odoo 18 on Docker, a sync daemon with 34 tests, and an Arabic restore runbook.
$29Buy now
Laravel scale-to-zero on Cloud Run
A 10-platform comparison with sources and costs, a FrankenPHP Dockerfile, and keyless GitHub Actions deploys.
$12Buy now
Google Sheets AI product-description generator
An Apps Script menu inside Sheets, Arabic and English, plus a Python alternative.
$7Buy now
From the blog
Laravel scale-to-zero: running a Laravel API on Cloud Run with min-instances 0, and what it really costs
How to host a low-traffic Laravel API that costs close to nothing when idle, what breaks under scale-to-zero (queues, cron, local disk, the database) and how to replace each piece.
LiveKit vs ZEGOCLOUD vs Agora: what a voice-chat app really costs, and when self-hosting wins
A worked cost comparison for audio rooms using each provider's published prices, how participant-minutes add up, and what it takes to run LiveKit on your own server instead.
Self-hosting n8n with Docker Compose: setup, licence, backups and the parts people skip
A practical guide to running n8n on your own server with Docker Compose and HTTPS, what the Sustainable Use License allows, moving to Postgres, and backing up the encryption key you can't afford to lose.
Questions
Do you work with clients outside Jordan?
Yes. All work is remote, through Khamsat, Mostaql, or directly.
How does payment work?
On Khamsat or Mostaql the platform holds the payment until you receive the work. Larger projects are paid per delivery phase.
Does the private AI really keep my data in-house?
Yes. With the local-model option everything runs on your server. You need a server with suitable specs, and I'll help you choose one before we start.
I don't have a server. Do I need one?
For self-hosting services, yes: a VPS from Hetzner, Contabo or DigitalOcean, or a machine in your office. I'll help you pick one for your budget.
What do I get at the end?
The code, or the system running on your server, tested, with a runbook in Arabic.
Do the kits come with Arabic docs?
Yes. Every kit includes English and Arabic guides.
Tell me what you need
Send a short message about your project and I'll reply with what it takes, the price, and the timeline.