Ezzoubeir Elasraoui
RBA FR
Open to part-time and freelance work I'm a software engineer

Ezzoubeir Elasraoui: I build the software, and the machines it runs on.

Full-stack engineer based in Rabat. I like the whole job: untangling a messy domain, building the screens people use every day, then setting up the servers, the backups and the dashboards that tell me when something breaks. I'm also a PhD candidate in mobile security at Mohammed V University. I use Claude Code a lot, and I still make the calls on architecture, security and data.

Start a project See the work
2,600+
automated tests on PGSH
6,000+
students in the PGSH database
5
VMs I set up on one ESXi host
€0
a month to host Balagh
Scroll
.NET 9 PostgreSQL React 19 TypeScript Next.js Python FastAPI Tauri Docker VMware ESXi Keycloak OpenTelemetry Grafana AWS Cloudflare Supabase Ollama Claude Code

Most of what I build runs where nobody looks: on a faculty's own servers, on a lawyer's laptop with the Wi-Fi off, on free tiers that cost nothing. It has to work on a Monday morning when I'm not around.

Selected work

Things running in production

PGSH

Internship planning for a faculty of medicine

Context
Faculty of Medicine and Pharmacy, Rabat
Role
Design, build, deploy
Year
2025 → 2026

Every year the faculty sends thousands of medicine and pharmacy students through hospital rotations. All of that used to live in an MS Access file. PGSH replaced it: hospitals and services, student groups, the yearly rotation plan, attendance and grades, all running on the faculty's own servers.

What I built

  • A .NET 9 API with clean architecture and CQRS (MediatR, FluentValidation, EF Core on PostgreSQL). Every endpoint stays closed until a permission opens it.
  • A planning engine that won't put one group in two services at once, respects each service's capacity and follows each promotion's own calendar.
  • Five VMs on ESXi. Caddy is the only way in, over HTTPS, and passes traffic to the API containers, Keycloak and PostgreSQL 17.
  • An ops VM with Prometheus, Grafana, Loki, Tempo and OpenTelemetry, k6 for load tests, and encrypted backups on a systemd timer.
2,634 tests, xUnit and Testcontainers
5 VMs behind one address
6k+ students
.NET 9React 19MantinePostgreSQL 17KeycloakDockerESXiCaddyOpenTelemetryGrafanak6
pgsh/deploy/topology.svg live
ESXI HOST · 5 VMS https://pgsh PGSH-PROXY-01 Caddy · TLS APP-NODE-01 .NET 9 API PGSH-IDP-01 Keycloak PGSH-DB-01 PostgreSQL 17 PGSH-OPS-01 OTel · Grafana · k6

Lexi

An offline legal archive that can read Arabic

Context
My own product, lexiarchive.com
Role
Founder and engineer
Year
2026

Lawyers, notaries and judicial commissioners in Morocco sit on piles of paper they can't search. Lexi reads their Arabic and French documents, files them and answers questions about them. Everything runs on their own computer, so client files never leave the office.

What I built

  • A desktop app in Tauri v2 and React 19, with a Python (FastAPI) backend bundled inside and SQLite for storage.
  • Documents go through a local model (Gemma on Ollama). Scanned pages get cut into strips first, because that's what finally made small Arabic print readable.
  • The chat finds cases through a search tool on a SQLite FTS5 index. I had planned a vector database and dropped it, because the simple index worked better.
  • Licences run on a self-hosted Keygen server behind my own FastAPI admin (310 tests), reached through a Cloudflare Tunnel. The website is Astro, in Arabic and French.
100% offline
AR + FR documents and UI
~30 s per digital document
Tauri v2React 19TypeScriptFastAPISQLite FTS5OllamaGemmaPyMuPDFKeygenCloudflareAstro
Visit the site lexiarchive.com
lexi/pipeline/ingest.svg live
ON-DEVICE · NO CLOUD scan.pdf 3 bands LLM gemma · ollama محضر text SQLITE · FTS5 trigram index TOOL CALL search_cases() OFFLINE

Idara إدارة

A complete HR system for a public institution

Context
Faculty of Medicine and Pharmacy, Rabat
Role
Design, build, deploy
Year
2026

HR in Moroccan public administration still runs on paper, Excel and people's memory. Idara puts it in one place for the faculty: records for teaching and administrative staff, assignments, careers and grades, leave and absences, quotas, discipline, yearly evaluations, and the official documents HR has to sign every day.

What I built

  • A TypeScript monorepo: Express and Prisma on PostgreSQL 17 for the API, React and TanStack Query for the front end, and Zod schemas shared by both sides.
  • Policy-based access with a data scope per unit, so a department head only sees their own people. Every HR change lands in an audit log.
  • Work attestations and mission orders rendered to PDF with Puppeteer, in French and Arabic. The signer comes from the org chart at generation time, never from a hard-coded name.
  • In-app notifications, a monthly job that flags promotion eligibility and upcoming retirements, Excel import of existing staff, reports, and a Docker Compose stack with daily pg_dump backups.
400+ tests
10+ HR modules
3 languages: FR, AR, EN
TypeScriptReactExpressPrismaPostgreSQL 17ZodPuppeteeri18nextDockernginxVitest
idara/modules/orbit.svg live
staff assignments careers leave absences quotas discipline evaluations EMPLOYEE RECORD PDF FR · AR

Balagh بلاغ

Student complaints, handled properly

Context
Faculty of Medicine and Pharmacy, Rabat
Role
Full-stack and security
Year
2026

Students file a complaint through a guided form and follow the answer in a live thread. Staff sort, reply and export. It works in French and Arabic, right-to-left included, and it costs nothing to host.

What I built

  • Next.js 14 with strict TypeScript. Every input goes through Zod and every write is rate limited.
  • Supabase with row level security on every table, so even a bug in the app can't read someone else's data.
  • A form builder for admins, permissions they can change themselves, and an audit log of every admin action.
  • Swappable email providers, outgoing webhooks, and a hook for a Telegram AI agent.
€0 a month to host
RLS on every table
FR + AR right-to-left included
Next.js 14TypeScriptSupabasePostgreSQLRealtimeTailwindnext-intlZodVercel
balagh/request/lifecycle.svg live
student admin NEXT.JS 14 · APP ROUTER middleware · session zod · validate rate limit audit log SUPABASE RLS postgres · auth · storage email webhooks telegram · ai REALTIME
How I work

I work with Claude. I still own every decision.

Claude Code makes me a lot faster. Going fast without rules just means shipping bugs faster, though, so every project follows the same few habits.

  1. 01

    Write it down first

    The schema, the API contracts and the reasons behind decisions go into the repo before the code does. When the code changes, the docs change with it.

  2. 02

    Nothing moves on red

    A phase isn't done until types, lint and tests pass. I don't start the next one with a known failure.

  3. 03

    Test against the real thing

    Smoke tests on real data, load tests on the real servers. When something breaks, I write down why, so it can't break the same way twice.

  4. 04

    The AI drafts, I sign

    Architecture, security boundaries and anything that touches people's data: I decide, and I review every line of it.

~/repos/pgsh — zsh

A typical PGSH session, shortened.

Research

My PhD, in mobile security

PhD candidate · 2024 → 2028

"Security approaches for embedded mobile systems"

Mohammed V University, Rabat · IPSS team (Intelligent Processing and Security of Systems) · supervised by Prof. Ahmed El-Yahyaoui

A phone checks who you are once, when you unlock it. After that it trusts whoever is holding it. My main contribution, CLCA, recognises you from the way you type and keeps up as your habits change, without forgetting what it learned and without keeping your raw data.

What the experiments showed

  1. 01

    Typing behaviour drifts over time, and it drifts a lot when someone switches device. I measured it on real data; the literature hadn't.

  2. 02

    Updating the model session by session lowers verification errors under drift, with no catastrophic forgetting.

  3. 03

    The mechanism that keeps updates small also resists slow poisoning attacks. That held on two independent groups of users.

  4. 04

    After a sudden keyboard change, the adaptive model recovers within one session. A frozen model never does.

CNN-BiLSTM · Variational Continual Learning · Deep Generative Replay · CMU, Tappy and Buffalo datasets

Next: adaptive detection running directly on ARM Cortex-M microcontrollers, with memory and energy as hard limits.

KEYSTROKE DYNAMICS · CLCA ON-DEVICE r a b a t ␣ 2 0 2 6 ENROLLED TODAY still you drift absorbed · no raw data kept

Papers

  • In preparation Journal article

    CLCA: A Continual Learning Framework for Drift-Aware Continuous Authentication Using Keystroke Dynamics

    E. Elasraoui, A. El-Yahyaoui · IEEE Transactions on Biometrics, Behavior, and Identity Science (Q1)

  • 2025 International conference, accepted as a book chapter

    Securing Mobile Short-Range Wireless Systems: A Comparative Survey of NFC and BLE Security Mechanisms, Vulnerabilities, and Mitigation Strategies

    E. Elasraoui, A. El-Yahyaoui · OCMT 2025, Oman College, Oman

  • 2025 National conference

    LSTM-Based GPS Spoofing Detection for Mobile Security

    E. Elasraoui, A. El-Yahyaoui · ICAIM'25, ENSA Fès, Morocco

Capabilities

Three trades, one person

Software

Backends with real business rules, and screens people can use without a training session.

  • C# and .NET 9, ASP.NET Core, EF Core
  • TypeScript, React 19, Next.js, Astro
  • Python and FastAPI
  • Tauri desktop apps
  • Kotlin for Android, Java
  • PostgreSQL, SQL Server, SQLite, MongoDB

DevOps

On your own servers or in the cloud. Monitored, backed up and written down.

  • VMware ESXi virtualization
  • Docker, Compose, reverse proxies, TLS
  • Keycloak, OIDC and SSO
  • Prometheus, Grafana, Loki, Tempo, OTel
  • AWS (EC2, S3, RDS, IAM, CDK), OpenStack
  • Cloudflare, Netlify, Vercel, CI/CD

AI and security

Models that run privately, and the research background to know where they break.

  • Claude Code workflows for teams
  • Local LLMs with Ollama and Gemma
  • Reading scanned Arabic documents
  • Continual learning, behavioural biometrics
  • Mobile security: BLE, NFC, GPS spoofing
  • LSTM, CNN, GANs, Spark MLlib
Services

How we can work together

01

Build a product

An MVP, an internal tool, or that old Access database everyone is scared to touch. I take it from the schema to a running app.

Web appsAPIsDesktopMigrations
02

Set up your infrastructure

Virtual machines or cloud, SSO, monitoring and backups, plus runbooks your team can follow without calling me.

ESXiDockerMonitoringBackups
03

Add AI to what you have

Private LLM features, document reading in Arabic and French, or a Claude Code setup for your developers.

Local LLMsOCRAgentsClaude Code
Format
Part-time, 2 to 3 days a week, or fixed-scope missions
Where
Remote, or on site in Rabat and Casablanca
Time zone
GMT+1, same hours as most of Europe
Languages
Arabic, French, English, some German (B1)
Journey

How I got here

Certifications

  • AWS Academy Cloud Foundations
  • AWS Academy Cloud Security Foundations
  • IBM Big Data 101 and Hadoop 101
  • IBM MapReduce and YARN, Apache Pig 101
  • WIPO Academy DL-101: Intellectual Property
  1. 2024 → 2028

    PhD candidate in science and technology

    Mohammed V University, Rabat · IPSS team

    Thesis on security for embedded mobile systems, supervised by Prof. Ahmed El-Yahyaoui. Two conference papers so far, a journal article on the way, defence planned for 2028.

  2. 2025 → now

    Software and DevOps engineer

    Faculty of Medicine and Pharmacy, Rabat, and independent

    Built and deployed PGSH, Idara and Balagh for the faculty. Started Lexi, my own product.

  3. 2023

    Android developer

    LoginID, Canada (remote)

    Worked on an Android identity wallet that uses fully homomorphic encryption. Kotlin, clean architecture, Dagger Hilt.

  4. 2021 → 2023

    Master in Intelligent Processing of Systems

    Mohammed V University, Rabat

    Big data with Hadoop and Spark MLlib, private clouds on OpenStack and OpenShift, and a self-driving car trained with Q-learning.

  5. 2021

    React developer and data analyst

    Lifemakers Academy, Oujda

    A project management app that predicts how long a task should take, using regression models.

  6. 2020

    Full-stack developer

    Cefolim, Oujda

    An education news platform with a REST API and live chat rooms over WebSockets.

  7. 2018 → 2021

    Professional bachelor's in business intelligence

    Mohammed I University, EST Oujda

    Including a 2019 internship where I built a C# and SQL Server desktop app for the regional education office.

Contact

Got something to build, or to fix?

Tell me what you're working on. I answer within a day, usually with a few questions.

elassraouiezzoubeir@gmail.com
esc

Type to filter · Enter to go · Esc to close