// shipped
Projects
Real things, deployed, running today. No roadmap items, no vaporware, no "coming soon". Each one started as a problem on this stack and ended as something that other operators can use or read about.
-
sovereign-mcp
mcp-serverA Streamable-HTTP MCP server backing every article and tool on this site. Four tools (search_blog, get_article, list_tags, diagnose_sglang). Live at mcp.sovgrid.org/self-hosted-ai. Listed on the official MCP registry, Smithery 100/100, Glama, awesome-mcp.
-
Sovereign AI Grid Insights
analyticsA public, JSON-LD-backed dashboard that aggregates 30-day MCP tool calls, blog views, and distinct external agents from raw Caddy access logs: no JS pixel, no cookies, no third-party tracker. Filters self-traffic by CIDR, dedupes cloud-IP rotations, and identifies distributed scraper clusters by UA-over-many-/24s signature (one UA from many networks = bot; many UAs from many networks = real viral).
-
Content quality pipeline
editorialA scoring system that gates every article against style-specific thresholds (best-practice / werthaltige-code-beispiele / conclusion / smart-infotainment), enforces an anti-AI stylometry pass (em-dash penalty, uniform-list penalty, sentence-length-stdev reward), and rejects fabricated facts via factcheck.py before deploy.
-
Hero & caricature image pipeline
image-genFLUX.1-schnell on ComfyUI, locally on the DGX Spark. Generates hero images and caricatures per article from auto-derived prompts, then converts to WebP and routes through an interactive rating step (1–5) before publish. Backfilled across all 88 articles.
-
Podcast Studio (script → TTS → MP3)
ttsEnd-to-end CLI: select articles → LLM-written dialog (cipherfox + hexabella personas) → Qwen3-TTS-1.7B per turn → ffmpeg mix with intro jingle, music-duck, loudnorm to −16 LUFS. Voxtral was retired after its V6 expressivity ceiling (the documented pivot to VibeVoice / Higgs Audio v2 / IndexTTS-2 / Qwen3-TTS).
-
sovgrid.org (this site)
astro+caddyAstro 6 + Caddy on a no-KYC FlokiNET VPS. Build pipeline self-heals quality signals, runs an axe-core a11y gate on every deploy, and pushes the regenerated knowledge-base to the MCP server in the same script. Every reading link is marked by where it goes, keyed on the href and WCAG-checked: internal stays green, external is body-coloured with a ↗ and opens a new tab, affiliate carries a ₿ and a disclosure, in-page anchors stay neutral. The full legend is testable on the support page.
-
Sovereign server (NVIDIA DGX Spark)
hardware-setupThe NVIDIA DGX Spark (GB10, SM121A) that runs everything on this site: the self-hosted LLM stack on vLLM (Qwen + GLM + Gemma), the MCP server, the image and TTS pipelines, and the build pipeline for the blog. Set up from scratch with LUKS-encrypted storage, the /data directory convention, local inference, and a 30-minute power-failure recovery procedure. The primary box; the Lenovo Legion below is its companion.
start here reference architecture five disasters survived power-failure recovery
-
Sovereign laptop (Lenovo Legion)
hardware-setupA second sovereign-AI box, built for a friend on a Lenovo Legion Pro 7 Gen 10 (RTX 5080 Mobile, Blackwell): encrypted Ubuntu, a local Ollama LLM with a shared second-brain (mem0 + deterministic RAG), a maintenance/learning dashboard, and a scoped AIDE file-integrity monitor. The companion to the DGX Spark, written up as a reusable playbook for setting someone else up, including the /data-convention LVM trap and how to do it without leaking your own identity.
24h setup log friend-setup playbook second brain the /data trap
-
Floki VPS (sovgrid.org host)
vpsThe no-KYC FlokiNET VPS that serves sovgrid.org and the public MCP endpoint: Debian, hardened, Docker plus Caddy with automatic HTTPS, DNS-only with no Cloudflare proxy by sovereign design, defended at the origin with targeted DOCKER-USER drops and fail2ban. The blog deploys here by rsync over Tailscale.
-
vps-healthcheck
opsTwelve-check daily audit of a remote VPS over SSH: reboot flag, security updates, failed units, UFW, fail2ban, disk, memory, OOM history, LE-cert expiry, container set, optional freshness file. One bundled notification push per run, structured JSON sidecar. Single SSH session for the whole audit, exit 0/1/2 for cron. The README walks through why this is the right size for a one-VPS operator versus Prometheus / Netdata / Uptime Kuma.
-
watchdocker
devopsA bash-native successor to the archived watchtower: a systemd timer pulls and smart-restarts Docker Compose stacks once a week, then gets out of the way, no 24/7 container, no open socket. Built after watchtower 1.7.1 broke against Docker Engine 29.5. About 350 lines of bash plus two unit files, auditable in fifteen minutes. The write-up compares it honestly against the surviving forks (nicholas-fedor/watchtower, WUD) and is explicit about which operator each one fits.
-
sovereign-backup
backupA config-driven, multi-host backup tool extracted from the rebuild after a six-week silent-failure postmortem: tar plus age encryption to a USB stick or local NVMe, driven by per-host YAML, with a systemd timer and a smoke-tested CLI (dry-run, deterministic exit codes, restore --verify). One generic binary across machines; the real source list and destinations live in config, not in the script.
-
Sovereign Qwen (OpenWebUI custom model)
ragQwen3.6-35B-A3B AutoRound int4-mixed on vLLM, fronted by OpenWebUI with a sovereign-kb knowledge collection (ten cross-project markdown files), SearXNG web search, and the sovereign-ai MCP server exposed as OpenAPI tools via an mcpo bridge.
-
Upstream contributions
fixesBugfixes and config patches sent back to the projects this blog runs on: vibe, openhands, opencode, Mistral chat-template handling, and others. Every merged PR is listed individually on the upstream page.