Georgi Dimitrov

1. 2020 to 2023

   BSc (Hons) Pharmacology, University of Portsmouth

   First Class Honours. Pharmacology gave me the habit of separating signal from noise before acting on either.

2. 2022

   LoRaWAN project lead

   I led a network of about 70 Helium hotspots for a dairy company. The project ended with the 2022 crypto crash.

3. 2022 to 2023

   Sapverse

   A 24-chapter novella written with early AI models, and my first AI project.

   Read the Sapverse story

4. 2024

   Biogard

   The first website I started, for a regional pest-control company, and where I learnt to build software. It moved to Next.js on Netlify in 2025. Later I rebuilt it as v2 and moved it to a self-hosted server.

   Read the Biogard storyBiogard, pest control in Ruse

5. Late 2024

   Teaching myself to build software

   I taught myself to build software by directing AI models. The habit formed then still holds: I decide what should exist, and I check that it does.

6. October 2025

   Valox EOOD and ValoxVSL

   I founded Valox EOOD and its AI video production business, ValoxVSL. The pipeline takes a script through a visual bible, generated images and generated video to an assembled ad. My brother collaborates with me on it.

   Read the ValoxVSL storyValoxVSL, AI video ads

7. October 2025

   PlayBelote

   I started a Bulgarian online belote game: a deterministic rules engine shared by the browser client and the game server, Monte Carlo bots, tournaments and a replay format. It is live.

   Read the PlayBelote storyPlayBelote, online Bulgarian belote

8. February 2026

   A server compromise

   A botnet exploited a known Next.js vulnerability on the server that ran the video generator. SSH hardening could not have stopped it, because the attack came in over HTTP. I found it by checking outbound connections, wrote the incident up, upgraded the framework, and turned the lessons into a hardening playbook that I use as the starting point for each new server.

   Read the server compromise story

9. March 2026

   Senior AI Consultant at DigiSol

   I joined DigiSol as Senior AI Consultant. The main engagement is agentic systems for a large industrial manufacturer, where deterministic code produces the numbers and a person approves what has consequences.

   Read the Customs and Compliance Agents story

10. April 2026

    Ruse AI Hack

    I took part in the Ruse AI Hack and helped my brother build his entry, a 3D asset generator pipeline.

11. 2026

    Moved to Varna

    I moved to Varna, on the Black Sea coast.

12. September 2026

    Valox Office

    I forked the MIT-licensed agent-office project by AgentSystemLabs and built it into Valox Office: a 3D office in the browser where Claude Code, Codex and OpenCode workers sit at desks, each in its own git branch. I stripped what I did not need and added the agent tooling that makes it a harness: custom MCP tools for a manager agent, routing between workers, runners on remote computers and isolated worker accounts.

    Read the Valox Office story

13. October 2026

    Head of AI Engineering at DigiSol

    I became Head of AI Engineering at DigiSol. I own how the company's AI systems are designed, built and run in production, and the harness the coding agents work inside.

• Avant-garde jazz

  My listening runs through Frank Zappa, Miles Davis, Wayne Shorter, John Coltrane, Mary Halvorson, John Zorn and Dave Douglas. I prefer music that takes risks to music that stays out of the way.

• Bulgarian folk music

  Ivo Papazov and Valya Balkanska are my starting points. The asymmetric dance meters, 7/8 and 11/16, turn up in the music I write in code.

• Audio gear

  I have cared about reproduction quality since I was sixteen. My reference headphones are the Sennheiser HD 800 S.

• Music written in code

  Jazz from Varna is a 3:23 suite in five movements, computed in JavaScript and inspired by Zappa's Jazz from Hell. It plays a 7/8 rachenitsa and an 11/16 kopanitsa over a choir drone and a tapan. A second track, Yogurt Culture Shock, is MIDI rendered with FluidSynth.

• Mountains, the sea and sport

  Backpacking and hiking in the mountains, time by the sea, basketball and cycling. Varna, where I live now, supplies the sea.

• Cooking

  I cook rarely, and when I do it is a proper project.

• Film and television

  I look for psychological depth: David Lynch, Mr. Robot, Breaking Bad, Legion and Hannibal.

• Bulgarian

  Native

• English

  Advanced (IELTS 7.5)

• French

  Intermediate, reading

Five servers: four at Hetzner and one at DigitalOcean. Three serve public sites, and admin consoles and dashboards listen on a private Tailscale network instead of a public interface. All five use public-key SSH with no password logins. The hardening standard is a written playbook of ten steps with a verification checklist: key-only SSH, a host firewall, fail2ban, automatic security updates with reboots left manual, kernel parameter hardening and a login banner. Two incidents shaped it. First, a botnet exploited a Next.js vulnerability on the video generator host, and SSH hardening could not have helped because the attack came in over HTTP. Later, an IP restriction on SSH locked me out of the game server, and I rebuilt it without the restriction. The playbook is a floor that I adapt per machine: the game server follows it almost line by line, and the shared host that runs containers relies on container isolation for part of it. One check carries over to all of them: look at outbound connections from the application, which is how the compromise showed itself.

• Agent workspace host

  Hetzner
  • an autonomous agent's workspace and messaging gateway, using the open-source Hermes Agent from NousResearch
  • a bridge between a Discord voice channel and a hosted voice assistant
  • a self-hosted GitHub Actions runner for one repository
  • a read-mostly copy of my product repositories
  • repository access for an agent, split between an unprivileged executor and a separate service that holds the network credentials

  No public sites. Only SSH listens publicly; the other services listen on loopback or the private network.

• Game server

  Hetzner
  • the Colyseus game server for PlayBelote, behind nginx
  • PostgreSQL 16 behind PgBouncer
  • a small webhook service that deploys new builds, with no CI system in the path
  • nightly database dumps, about a month of them kept

  The machine that follows my hardening playbook most closely: a login banner, kernel parameter hardening, fail2ban, a host firewall and automatic security updates on top of public-key-only SSH. Rebuilt after a lockout.

• Video generator host

  Hetzner
  • the ValoxVSL video generator in production, with a development copy beside it
  • automated trading research with kill switches

  The machine behind the server compromise. The video generator sits behind nginx.

• Shared build and hosting machine

  Hetzner
  • Valox Office, with a sandboxed self-hosted CI runner and 32 isolated Unix accounts for agent workers
  • the production site of a regional pest-control company: Caddy, Next.js, Postgres 17, a self-hosted analytics tool and restic offsite backups
  • automated trading research with kill switches

  8 vCPU and 16 GB of RAM. Container images are pinned by digest, containers drop capabilities and set no-new-privileges, and the web and proxy containers are read-only, with an optional gVisor runtime available. Site releases are timestamped directories behind a symlink, with rollback and retention scripts. The deploy account has no sudo, admin surfaces listen on the private network, and only ports 22, 80 and 443 listen on public interfaces.

• Trading research runner

  DigitalOcean
  • automated trading research with kill switches

  The smallest machine in the fleet, with 1 vCPU and 1 GB of RAM, and the only one outside Hetzner. Only SSH listens publicly, with public-key authentication enforced, fail2ban, a host firewall and custom kernel parameters.