One Proxmox box running a rack of self-hosted services, with watchers that check its state on a schedule, diagnose what they find, and bring you a researched fix to approve. Below is every fix that has been made: the symptom, what actually went wrong, and how it was resolved. The page is generated from the system's own records and redeployed within a minute of each one.
Every number below is read from the system's own registries when this page is built — the action vocabulary from the code that enforces it, the services from the file that decides how loudly each one pages, the guests from a capture taken off the hypervisor six-hourly. Nothing here is typed by hand, because a feature list written by hand drifts away from the thing it describes and nobody notices.
Each watches something the others structurally cannot see — a dead indexer is a state, not an error line; a remote outage writes no local log at all.
backlog, config-export-monitor, dep-update, dependency-watch, failure-watcher, gap-audit, guest-resource, ha-watch, healthcheck-down, indexer-watch, media-malware-sweep, new-log-template, recording-watchdog, repo-audit, resource-watch, spec-check, stuck-acquisition
A closed vocabulary. An action outside it cannot be selected, whatever the model proposes, and widening the list is a reviewed change to the code rather than a judgement made at three in the morning.
prune-build-cache, prune-images, restart-container, restart-guest, restart-service, set-cpulimit, set-memory, start-container, stop-container, vacuum-journal
Each was paid for by a specific failure and fails on purpose before it is trusted. A check nobody has seen go red has not been tested — it has only been written.
0 health checks · 28 workflows
Graded by who notices when they stop, which decides how loudly a fault is reported and whether a change may be applied without asking.
0 reachable from outside · 0 household · 0 LAN-critical · 0 back-office
Full configuration, installed packages and mounts, captured from the hypervisor and compared against the committed copy. A change made by hand shows up as a failed check rather than as a surprise during the next restore.
plus 4 application settings that used to exist only as a note asking someone to remember them
Media, home automation, networking, and the platform to run them — around a dozen self-hosted services, each right-sized to a tight CPU and memory budget and kept honest by a resource watchdog. Density by discipline, not by throwing hardware at it.
Each entry is a real fix, pulled from the system's own issue log. Click any one to read the symptom, what actually went wrong, and how it was resolved. Internal specifics are scrubbed; the reasoning is not.
Loading the feed…
Each watcher checks one kind of state on a schedule and files what it finds as an issue. None of them applies a change.
Six rules decide what an agent may change on its own, and what has to wait for a person.
Every change is a branch, a review, a merge. Nothing is configured by hand and forgotten. The repository can rebuild the box from scratch.
Anything destructive is replayed on a throwaway clone of production first. The dangerous surprises get caught on a copy, not on the live system the household depends on.
Agents find root causes and propose. A human approves anything that changes state. Confident-but-wrong auto-fixes were tried once — and deliberately removed.
Secrets are scrubbed at the log shipper and again before the repository. A leaked credential is a bug to fix at the source, at multiple layers — never a fire drill.
Every change is classed by how much it can break and who it touches. A back-office tweak lands instantly; anything that reaches the network, the household, or an outside user needs a live preflight and an explicit go-ahead — and fails closed if a check is unsure.
One small box, not a cluster. Every service runs on a deliberately tight CPU and memory budget, rebalanced on a schedule — capacity is a decision, not an afterthought. Over-building for scale it will never have is treated as its own failure mode.
The difficulty is the last mile: a problem that needs a person has to reach one, with enough context to decide in seconds, and silence has to mean healthy rather than unheard. The tap records intent; the change still goes through review.
Agents cluster errors, watch resources, probe reachability, and track versions — turning noise into deduplicated, root-caused issues.
A one-off blip auto-closes as a transient; a fixed issue reopens only if it comes back sustained. The queue stays honest — no flapping, no silent pile-up.
Before anything reaches you, per-tool experts ground the fix in the official docs and the community grounds it in real-world experience: root cause, live state, upstream behaviour. What arrives is a recommendation with its evidence attached.
The researched fix lands on your phone with one-tap Approve / Reject. A daily digest arrives even when everything’s green — so a quiet day is proof the loop is alive, and a missing digest is itself the alarm.
Approve records the decision and routes it into the reviewed, rehearsed path. It never auto-applies a change on its own — the human stays in the loop where it counts.
Fix ready to approve: indexer rate-limiting
Root cause: one indexer is returning 429s and stalling the search queue.
Fix: raise its request delay — hot, no restart, reversible.
Evidence: official docs + 3 corroborating community reports.
Blast radius: back-office, invisible to users.
The actual shape of a decision push. The button carries a one-time signed token — never a credential.