09 — Devlog

The loop can page me now

devlog · notifications everywhere

Night two of the rescheduled loop, and the 04:00 implementer has shipped its second feature. The board said "ntfy as the notification backbone"; by breakfast there was a locked-down notification server on the Pi, a topic per job, and the heartbeat fanning its alerts out onto two channels — with a green test suite behind all of it. The loop now has a voice: when a cron job dies or goes quiet, my phone hears about it. Given that ship number one was the dead-man's switch, the watchmen now carry radios.

Shipped

  • pi-cicd — implementer ship #2 off the radar board: the ntfy notification backbone. It installed ntfy from the plain Debian package (no third-party apt repo), bound the server to the tailnet only, and locked it down — deny-all default access, a write-only publisher user for scripts, a read-only subscriber for the phone, tokens kept outside the public repo. A topic-per-job convention (radar, loop-heartbeat, backups — ACLs provisioned already) is documented with a runbook, and a small ntfy-notify helper means every job publishes its outcome in one line. loop-heartbeat now alerts on two channels at once, delivered if either accepts. 50 tests pass locally and on CI across three runs, and a committed live-check script went 7/7 against the production server: deny-all enforced, the publisher can't read, the subscriber can't write, publish and read-back round trip. En route it fixed two latent e2e tests that flipped at midnight — wall-clock assumptions, the classic. The one remaining step is mine: subscribing the phone. A follow-up scrub commit genericised a tailnet hostname that had crept into the docs.
  • A new service, adopted before I'd finished coffee (private repo, so no link) — a single-file Python service that renders a live capabilities page for the box: real systemd unit states and /proc telemetry instead of a hardcoded brag list, published through the funnel. project-guard auto-adopted the repo — CI included — within minutes of its first commit. The adoption pipeline remains the best-behaved employee on this Pi.
  • The Fantasy Premier League assistant got a repo (private) — the Monday-night report → confirm → apply job now lives in version control with tests on push, instead of being a loose script only the cron job knew about. Also adopted on arrival, naturally.
  • This site got an identity scrub — the byline collapsed to EV everywhere, the og image regenerated without my name on it, and the Currently panel no longer says exactly where in Ireland the Pi lives. The public pages now reveal exactly as much as I want them to; git history keeps the rest. Quiet, boring, and overdue.

On the radar

  • Uptime Kuma service monitoring — now that alerts have a backbone, give them something to say. Concrete next step: install Uptime Kuma on the Pi, add one HTTP monitor per long-running service (DNS, portal, dashboards) plus push-type heartbeat monitors that double-check the same cron jobs loop-heartbeat watches, and wire the alert channel to the new ntfy server.
  • changedetection.io with LLM rules — watch the upstream release pages of everything deployed here (ais-catcher, AdGuardHome, ntfy itself) and the status pages of the data sources, with one digesting rule that summarises what changed into a single notification. Next step: install, seed it with the upstream release URLs, one LLM rule posting to the notifications topic.
  • Deduplicated backups with healthchecks hooks — borgmatic (or restic) snapshots of the portal, dashboards and configs to USB storage, a healthchecks-style ping on success, failures published to the ntfy backups topic whose ACL is already provisioned. Next step: install, configure retention, then do a restore drill before calling it done — a backup that's never been restored is a rumour.

Interesting reads

  • How to Monitor Website Changes with changedetection.io in Docker — a careful walkthrough that pins the image version instead of floating on :latest, binds the UI to loopback only, and routes alerts to ntfy over Apprise URLs. If the changedetection idea gets picked off the board, this is roughly the shape it should take on this box.
  • Restic vs Borgmatic: Which Backup Tool Fits? — a sober comparison of the two philosophies: restic's single binary with native S3/B2 targets versus borgmatic's YAML wrapper around Borg with retention, hooks and scheduling built in. The hooks table is what matters here — it's the difference between a backup job and a backup job that tells you it succeeded.
  • AI Coding Agents Matrix — 25 coding agents compared in one filterable table, updated mid-August: open source or not, BYO LLM, MCP support, plan mode, subagents — and AGENTS.md support as a first-class column. Instruction files for agents started as a convention; now they're a shopping-criteria checkbox.
Back to the devlog