Hi, I'm Mammen 👋

I trade uptime for sleep, and mostly regret it in the morning.

I was supposed to be a merchant navy officer. Somewhere between learning knots and learning ropes, I found out epoll() is more addictive than actual sailing — no seasickness, and the only thing that capsizes is your prod deployment at 2 AM.

Now I'm a Software Engineer at Singularis Ventures, working on Platform, Identity & Infrastructure. I spend my days convincing three regional Keycloak clusters to agree on who a user is, and my nights convincing myself that "it works on my machine" is a valid production strategy (it is not).

• 🔭 Currently building distributed IAM, multi-region proxies, and fine-grained authorization at Singularis WoW
• 🏢 Also building Octaview, a B2B SaaS recruitment platform — check the org: Octaview-b2b on GitHub →
• ⚙️ Currently obsessed with: WireFlow, a TCP proxy I wrote in raw C because apparently Node.js wasn't punishing me enough
• 📝 I write about the things that broke me, on Medium
• ❓ Ask me about auth (Keycloak/OIDC/Cerbos), distributed systems, or why your JWT is 4KB of regret

A non-blocking TCP proxy written in C using Linux epoll, built from scratch because I wanted to know what nginx does for a living.

Single thread. Zero malloc in the hot path. Edge-triggered epoll doing the work of what would otherwise be a small army of threads complaining about context switches.

Architecture at a glance:

• epoll edge-triggered event loop — one thread handles every connection, no drama
• O(1) fd → connection lookup via a direct-indexed fd_to_conn[] array
• Non-blocking async upstream connect with EINPROGRESS handled properly (not vibes-based)
• 8KB ring buffer per direction per connection — the garbage collector's day off
• EPOLLOUT-driven buffer drain — no silently dropped partial writes
• Backpressure: reads pause when the buffer's full, resume on drain
• TCP_NODELAY everywhere — Nagle's algorithm was not invited
• SIGPIPE ignored — dead peers get handled via errno, not a crash log

Baseline throughput (WSL2, loopback, Python echo backend)

Break-point test

High-load test

Zero connection errors up to 15,000 concurrent clients. p99 stayed under 11ms across the entire range. The real bottleneck was Python's GIL on the echo backend — WireFlow was just standing there, arms crossed, waiting for it to catch up.

make && ./build/wireflow
python3 benchmarks/backend.py     # start echo backend
python3 benchmarks/bench.py       # baseline
ulimit -n 65536 && python3 benchmarks/breakpoint2.py   # break-point test

What building it actually taught me: why epoll edge-triggered mode demands you drain to EAGAIN or it will silently hate you forever, why O_NONBLOCK isn't optional with EPOLLET, how proxies bidirectionally map client_fd ↔ upstream_fd, why a blocking accept() quietly kills your concurrency, how ring buffers survive partial reads/writes without a single malloc, and how to actually read a p99 instead of just screenshotting it for a slide.

Building the platform, identity, and infrastructure layer for Singularis WoW:

• Multi-region IAM — three regional Keycloak clusters, realm-based tenant isolation, one Security Interface pretending it's all simple
• Cerbos-backed authorization — RBAC/ABAC/PBAC over gRPC, because a JWT with your entire permission tree in it is a war crime
• Zero Trust API Gateway — JWT validation, rate limiting, structured audit logging
• Multi-region streaming proxy — request streams piped end-to-end, GDPR-compliant, constant memory, no buffering entire payloads like some kind of animal
• Federated schema-driven API — one endpoint, many regions, no one downstream knows the difference
• Multi-tenant portfolio platform — Keycloak for identity, PostgreSQL/Prisma for domain data
• AI-powered MDM — vector embeddings + semantic scoring to stop duplicate garbage data from reaching the database
• LLM resume microservice — event-driven, IBM Granite-powered, actually understands a resume better than most humans skimming one in six seconds
• Pluggable storage engine — provider-agnostic streaming + presigned URLs, EventBridge-driven lifecycle events