Skip to content
volko

Work Clinical Interoperability · proprietary

Core PACS Infrastructure

The backbone under the AI: the PostgreSQL data-access layer, the HL7 interoperability suite, twenty PACS-viewer extensions, and the WireGuard VPN that connects every customer site.

213

commits · PostgreSQL DAL (primary author)

20

PACS-viewer web extensions

73

commits · WireGuard VPN system

Architecture diagram of a phone-home WireGuard VPN for PACS connectivity in a hub-and-spoke, outbound-only topology: an admin dashboard registers gateways by MAC and pushes GPG-signed config from a central config server, while customer-site gateways behind NAT dial out over HTTPS 443, pull signed WireGuard and iptables configs, and open encrypted tunnels carrying DICOM, HL7 and SMB traffic.
PhoneHome WireGuard VPN — customer-site gateways dial out over 443, register by MAC, and pull GPG-signed per-device configs to join a hub-and-spoke overlay that tunnels DICOM/HL7/SMB, with no inbound firewall exceptions at the hospital.

Problem

AI features are only as good as the plumbing under them. The PACS needs a reliable data layer, standards-compliant clinical messaging, viewer integrations, and secure connectivity to every hospital — all of it production-grade.

What I built

  • Data Access Layer (213 commits, primary author): a PostgreSQL layer for the aycan Store — thread-safe cursor handles, an auto-generating ORM, a recursive filter-to-SQL compiler, and domain modules for studies, users, sessions, tokens, HL7, and clinical trials, with a pytest / hypothesis test suite.
  • HL7 suite: receive shim, sender daemon, ORU-to-PDF report generator, and a TrueScan EMR webhook — plus 10+ worker modules in the database job daemon (MWL query agent, HL7 passthru/prefetch/sendjob, a Hologic SCO→BTO mammography converter).
  • 20 PACS-viewer web extensions: metadata viewers, hash-indexed DICOM search, LLM-powered smart search, dark mode, storage and services dashboards, and the spine-label renderer — 47% of the framework’s commits.
  • PhoneHome VPN (73 commits): a WireGuard configurator with GPG-signed client/server messaging, MAC-based device registration, and iptables management connecting every customer site.

Impact

The unglamorous, load-bearing systems the clinical AI runs on — and the reason it runs in real hospitals at all.