YMRTECH — linux systems & cloud security engineering

Yannick M. Richard · NixOS · declarative infrastructure · zero-trust networking

YMRTECH is one engineer's practice and one small product. I design, build and operate Linux infrastructure as code — the same declarative method that runs this site — and I run a consumer WireGuard VPN on that infrastructure: a tunnel from your devices to my own gateways, with no client app to install and no activity logs to leak.

[ GET THE VPN ] [ WORK WITH ME ]

What this site is

Three things live here: a VPN you can buy, an engineering practice you can hire, and the documentation for the infrastructure both of them run on.

󱂵 VPN

A WireGuard VPN you can buy

A tunnel from your devices to my own gateways in Montréal and Mexico, in three DNS postures at one price. No client app, no activity logs, unlimited fair use.

The service and the tiers

󰈉 SERVICES

An engineering practice you can hire

Declarative Linux and cloud infrastructure, security engineering, monitoring, email, and a scoped audit delivered as a report where every finding can be re-run.

The disciplines

󰣻 INFRA

The infrastructure they run on

How the fleet is built and operated: two flake repositories, a reviewed deploy pipeline with its own health gate, and the recovery plan behind both.

How it is built

Start with the VPN

One subscription, one tunnel per device, and the DNS posture you choose for each one. The price is flat — $10/mo a month or $80/yr a year, billed by card through Stripe, every tier included, with no data cap and no usage-based fees. Nothing of mine runs on your device: you get a configuration or a QR code, and the WireGuard client your operating system already ships does the rest.

$10/mo 󰓹 per month — every tier included

or $80/yr 󰓹 per year — every tier included

3 󰾰 devices per account

1 Gbit/s 󰓅 up to, per connection

Choose a posture. pipe leaves the resolver your device already runs untouched, privacy resolves through the tunnel, and security resolves through it with filter lists. The tiers differ in DNS only — never in speed.
Create the account and pick the monthly or the yearly plan.
Add a device, assign it a tier, and scan its QR code with your operating system's own WireGuard client.
Verify it. The portal's DNS leak test and the published infrastructure audit test the claims made on this site rather than asking you to take them on faith.

[ CREATE ACCOUNT ] [ CLIENT SETUP GUIDE ] [ THE DETAILS ]

Working with me

The same method is available for your stack: NixOS and infrastructure as code, cloud architecture, encrypted networks, monitoring and email, and an audit scoped to what actually needs reviewing. Every engagement is handed over as source you keep, not as a change nobody can read afterwards. The disciplines are on Services, and a review is scoped on Consulting & audit.

How the infrastructure is built

Everything runs on declarative NixOS from two flake repositories, deployed by a reviewed pipeline that evaluates and builds every affected host and rolls the host back by itself if a critical service does not come up. The design is at Infrastructure; the checks that verify it are published at Infrastructure audit.

Notes

Written while running this stack, each one from the run that produced it — deploys that deployed nothing, a rotation that reached no host, a rollback that could not execute. Read the notes.

󰔟 Infrastructure you can read

Declarative configuration, atomic deployment, and a rollback that has been tested before you need it. Tell me what you run and what hurts — or start with the VPN.

[ GET IN TOUCH ] [ GET THE VPN ]