One Proxmox box running a rack of self-hosted services, with watchers that check its state on a schedule, diagnose what they find, and bring you a researched fix to approve. Below is every fix that has been made: the symptom, what actually went wrong, and how it was resolved. The page is generated from the system's own records and redeployed within a minute of each one.
Every number below is read from the system's own registries when this page is built — the action vocabulary from the code that enforces it, the services from the file that decides how loudly each one pages, the guests from a capture taken off the hypervisor six-hourly. Nothing here is typed by hand, because a feature list written by hand drifts away from the thing it describes and nobody notices.
Each watches something the others structurally cannot see — a dead indexer is a state, not an error line; a remote outage writes no local log at all.
acquisition-sli, backlog, config-export-monitor, dep-update, dependency-watch, failure-watcher, gap-audit, guest-resource, ha-watch, healthcheck-down, indexer-watch, media-malware-sweep, new-log-template, recording-watchdog, repo-audit, resource-watch, spec-check, stuck-acquisition
A closed vocabulary. An action outside it cannot be selected, whatever the model proposes, and widening the list is a reviewed change to the code rather than a judgement made at three in the morning.
delete-duplicate-series-timer, prune-build-cache, prune-images, restart-container, restart-guest, restart-service, restore-series-timer, set-cpulimit, set-memory, start-container, stop-container, vacuum-journal
Each was paid for by a specific failure and fails on purpose before it is trusted. A check nobody has seen go red has not been tested — it has only been written.
0 health checks · 33 workflows
Graded by who notices when they stop, which decides how loudly a fault is reported and whether a change may be applied without asking.
0 reachable from outside · 0 household · 0 LAN-critical · 0 back-office
Full configuration, installed packages and mounts, captured from the hypervisor and compared against the committed copy. A change made by hand shows up as a failed check rather than as a surprise during the next restore.
plus 6 application settings that used to exist only as a note asking someone to remember them
Media, home automation, networking, and the platform to run them — around a dozen self-hosted services, each right-sized to a tight CPU and memory budget and kept honest by a resource watchdog. Density by discipline, not by throwing hardware at it.
Memory against each guest's ceiling, and the temperatures the hardware itself calls dangerous — sampled six-hourly from the hypervisor's own records, the last 14 days. Nothing here is a live reading: it is published on a deliberate delay, because a real-time load graph tells a stranger when the machine is busy and when nobody is watching it. Memory is charted against its allocated ceiling rather than against the host, since the interesting moment is a service pressing on the limit it was given.
Each entry is a real fix, pulled from the system's own issue log. Click any one to read the symptom, what actually went wrong, and how it was resolved. Internal specifics are scrubbed; the reasoning is not.
Loading the feed…
One entry per agent run — what set it off, what it looked at, what it concluded, and what it did next. These are written by the system about itself as it happens, not summarised afterwards. Most end in a diagnosis rather than a change: that gap is the point of publishing them. Internal specifics are scrubbed; the reasoning is not.
Loading the log…
Each watcher checks one kind of state on a schedule and files what it finds as an issue. None of them applies a change.
Six rules decide what an agent may change on its own, and what has to wait for a person.
Every change is a branch, a review, a merge. Nothing is configured by hand and forgotten. The repository can rebuild the box from scratch.
Anything destructive is replayed on a throwaway clone of production first. The dangerous surprises get caught on a copy, not on the live system the household depends on.
Agents find root causes and propose. A human approves anything that changes state. Confident-but-wrong auto-fixes were tried once — and deliberately removed.
Secrets are scrubbed at the log shipper and again before the repository. A leaked credential is a bug to fix at the source, at multiple layers — never a fire drill.
Every change is classed by how much it can break and who it touches. A back-office tweak lands instantly; anything that reaches the network, the household, or an outside user needs a live preflight and an explicit go-ahead — and fails closed if a check is unsure.
One small box, not a cluster. Every service runs on a deliberately tight CPU and memory budget, rebalanced on a schedule — capacity is a decision, not an afterthought. Over-building for scale it will never have is treated as its own failure mode.
The difficulty is the last mile: a problem that needs a person has to reach one, with enough context to decide in seconds, and silence has to mean healthy rather than unheard. The tap records intent; the change still goes through review.
Agents cluster errors, watch resources, probe reachability, and track versions — turning noise into deduplicated, root-caused issues.
A one-off blip auto-closes as a transient; a fixed issue reopens only if it comes back sustained. The queue stays honest — no flapping, no silent pile-up.
Before anything reaches you, per-tool experts ground the fix in the official docs and the community grounds it in real-world experience: root cause, live state, upstream behaviour. What arrives is a recommendation with its evidence attached.
The researched fix lands on your phone with one-tap Approve / Reject. A daily digest arrives even when everything’s green — so a quiet day is proof the loop is alive, and a missing digest is itself the alarm.
Approve records the decision and routes it into the reviewed, rehearsed path. It never auto-applies a change on its own — the human stays in the loop where it counts.
Fix ready to approve: indexer rate-limiting
Root cause: one indexer is returning 429s and stalling the search queue.
Fix: raise its request delay — hot, no restart, reversible.
Evidence: official docs + 3 corroborating community reports.
Blast radius: back-office, invisible to users.
The actual shape of a decision push. The button carries a one-time signed token — never a credential.