Desktop application
Lampshade
A game launcher with a real auto-updater, access-code gating and a server-enforced admin API. Shipped and in use.
- Tauri
- Rust
- FastAPI
- PostgreSQL
$ systemctl list-timers 'melfina-*' NEXT LEFT LAST UNIT 14:58:17 3min 14:53:17 melfina-sentinel.timer 15:00:01 4min 14:55:01 melfina-coordinator.timer $ melfina sentinel --dry-run INFO evaluated 51 checks INFO no state changes $ melfina coordinator # only when something breaks INFO 1 incident to triage INFO machine/torrentpi → unreachable at both ping and ARP level. Off the LAN entirely, not just SSH down. INFO critic: partially_supported (confidence medium → low) INFO not ruled out: segment-wide fault would look identical INFO diagnose → critique · notified · $0.1250
That last line is the whole design. It notices, works out why, checks its own reasoning, and only then interrupts a human. It costs about a dollar a month to run.
The estate
Friends play on the game servers. People download from the launcher. A public company site reverse-proxies through it. When it breaks, someone notices, which is exactly why it's worth building monitoring for.
These figures are published by the estate itself.
Cloudflare Tunnel ── Access-gated for admin surfaces │ ┌─────────────┴──────────────┐ Raspberry Pi 5 Beelink N100 control plane compute / games ├─ PostgreSQL + pgvector ├─ Palworld dedicated server ├─ Redis ├─ 2× Godot game servers ├─ Gitea (self-hosted git) ├─ Jellyfin ├─ Ops dashboard + REST API └─ Docker, ~6 containers ├─ Launcher backend └─ Melfina (6-tier orchestrator) Pi 3 · VPN-gated box (currently offline, muted)
The centrepiece
Six tiers. Each one gates the next, so cost tracks how uncertain things actually are: a healthy day makes zero model calls, and a confident diagnosis never pays for an investigation it doesn't need.
51 deterministic checks every 5 minutes. No LLM: if deciding whether something is broken needs a model, the rule is wrong. Flap damping, scheduled-maintenance windows, and transition-only events so a week-long outage writes one row, not two thousand.
Wakes only on an incident. Retrieves the relevant runbook, the check's history, and every machine's current reachability, then produces a structured diagnosis with an honest confidence level.
Four diagnostic agents over nine read-only tools. The model never emits a command. It emits validated arguments and the code builds the argv, checked against a live service registry. Tested against command injection, path traversal and cloud-metadata URLs.
Reads the raw command transcript, never the specialist's summary, and is prompted to refute rather than assess. On its first real review it downgraded a diagnosis and caught a citation the agent had attributed to the wrong source document.
Discord and Telegram. Leads with how much the finding is worth: the critic's verdict, not the diagnosing model's opinion of itself.
The only tier that writes, and it ships disabled. A three-item allow-list, live game servers permanently protected, human approval required, and every precondition re-checked at click time. A button pressed an hour later must not fire against a situation that has moved on.
Also running
Desktop application
A game launcher with a real auto-updater, access-code gating and a server-enforced admin API. Shipped and in use.
Multiplayer backend
Two authoritative game servers (a persistent hub world and ranked duels) with clients discovering the endpoint at sign-in.
Public web
An edge-deployed marketing site that reverse-proxies a path straight through to the homelab backend, so one product lives at two URLs.
Operations
One pane for every service on every machine, with allow-listed restart controls, plus a native phone client that falls back from LAN to a service-token-authenticated tunnel.
Game operations
A dedicated server with a password-gated status page for friends. Every login and restart is audit-logged with the real client IP resolved through the tunnel.
How I work
Anyone can stand a service up. The interesting question is what happens on day ninety, when you've forgotten why you made a decision and something breaks at 3am.
Reading the code proves what the code says, not what the program does. Every claim on this page was checked against the running system, including the ones that turned out to be wrong.
Services are defined in exactly one place. The monitoring, the agent's tool validation and the restart controls all read from it, so nothing can drift out of sync, and registering a new service is the definition of done.
Every subsystem has a runbook explaining intended behaviour and past failures. Those documents are also the agent's retrieval corpus, so the documentation earns its keep twice.
Admin surfaces sit behind Cloudflare Access; friend-facing services carry their own auth. There's a written exposure policy saying which is which and why. Secrets never leave the devices, and a leaked one in git history got scrubbed and rotated.
The agent proposes; a human disposes. Automated action shipped switched off, and turning it on is a decision to be made from an audit trail rather than from confidence.