Systems engineer in London, specialising in Google Workspace security and email authentication.
I build tools that audit Workspace tenants against the CIS benchmarks and get SPF, DKIM and DMARC deployed properly. Two of them are below: SolarVento and Vigía.
SolarVento
solarvento.esSolar sizing tool for homes in Spain · solarvento.es
What it solves
Deciding whether home solar pays off in Spain means reconciling irradiance, tariff periods, surplus compensation and installer quotes that rarely show their working. SolarVento does that arithmetic from just a location, or from an uploaded electricity bill, PDF or photo. A household weighing up a quote gets yearly production, savings, payback and whether a battery earns its keep — built around Spain's actual tariff periods and surplus-compensation rules, so the numbers are real, not a brochure estimate.
How it works
- Pick the location on the map or search the address, then set the roof's tilt and azimuth or accept the optimum for that spot.
- Upload a bill, PDF or photo, and the annual consumption, contracted power and real price per kWh are read from it. Or type them in.
- Get production by month, savings, payback and battery scenarios, plus a downloadable report in two versions: plain, and installer-ready for asking for quotes.
How it's built
Stack
- Vite
- FastAPI
- PVGIS
Design notes
- Hourly self-consumption simulation: PVGIS irradiance series against a residential load profile, hour by hour, rather than a yearly average multiplied by a factor.
- A battery is only recommended when its marginal payback clears its useful life — the real cycle life, not the warranty — so the tool says no more often than a brochure does.
- Bill photos are OCR-redacted locally before any third-party model sees them: personal data is covered in the pixels first.
- Extractions are cached per browser session and purged when it closes; uploads are rate-limited per IP and globally, because each one is a paid model call.
Vigía
diegofarina.com/vigia/demoSecurity posture scanner for Google Workspace
What it solves
A Workspace admin console has hundreds of settings and no single view of which ones leave the organisation exposed. Vigía reads a tenant's configuration and its public DNS, scores it against the CIS Google Workspace Benchmark and produces an actionable report: every finding names the control it maps to, what was measured and where in the Admin console to fix it. It is for the admin or operator who has to know, and show, exactly where the posture is weak.
How it works
- Connect the tenant with an admin account. A page explains exactly which four read-only permissions are requested, and why, before Google's consent screen.
- The scan reads the directory, the audit logs, the Admin-console policies and the public DNS records — SPF, DKIM, DMARC, DNSSEC — and scores the result from 0 to 100.
- The report, on screen, as PDF or as CSV, groups the findings by severity with the fix location for each. Scans can be scheduled, with an alert when the posture regresses.
How it's built
Stack
- Flask
- React
- Google Admin SDK
- public DNS
- CIS Benchmarks
Read-only by design. Vigía has never requested Gmail, Drive or any other restricted scope, so it cannot read the contents of messages or files: Google's own API prevents it, not just our policy.
Design notes
- Read-only by design: four read-only scopes, none in Google's restricted category, and no write path in the code. Nothing it could change, not just nothing it promises not to.
- When a source could not be read completely, the report says so next to the number instead of scoring a guess.
- The score is auditable line by line: which item, what weight, what it earned — so a second admin can check the arithmetic, not just the verdict.
- Refresh tokens are encrypted at rest, addresses that appear in findings are purged after 24 hours, and disconnecting deletes the tenant record and revokes the grant.
The engineer behind them
Both tools come out of production work: running Google Workspace for a multi-domain estate, and the questions that kept coming back.
Diego Fariña
Systems engineer · Google Workspace security
I'm Diego, a systems engineer in London, from Galicia. Day to day I run Google Workspace for a multi-domain, multi-brand estate at a digital marketing company, and I do the email-authentication work that comes with it. I build tools when the manual version stops scaling: Vigía so the posture audit is repeatable instead of a checklist in my head, SolarVento because a sizing estimate should come from real irradiance data rather than a brochure. BSc in Cybersecurity in progress.
- Google Workspace administration, multi-domain and multi-brand
- Day-to-day administration of a Workspace tenant spanning several domains and brands at a digital marketing company in London: organisational units, delegated roles, 2SV enforcement, session policy.
- Email authentication: SPF, DKIM, DMARC, MTA-STS
- Remediation and rollout across a multi-domain estate — from no policy to enforced, without breaking legitimate senders on the way.
- Incident response: Workspace domain takeover
- A complete Workspace domain takeover handled end to end: the forensic reconstruction of how they got in and what they touched, the incident report, and the controls that stopped it happening again.
- Phishing analysis and content compliance
- Header and payload analysis of reported phishing, and content compliance rules to catch the patterns that keep coming back.
- Infrastructure and monitoring
- Proxmox, Docker, Wazuh and Grafana — built and run, not just installed.
- BSc in Cybersecurity, in progress
- Alongside the work, not instead of it.
Get in touch
If something here is relevant to what you are working on, email is the easiest way to reach me. I read and answer everything myself.