// shipped

Projects

Real things, deployed, running today. No roadmap items, no vaporware, no "coming soon". Each one started as a problem on this stack and ended as something that other operators can use or read about.

  1. Sovereign Fleet

    agent-orchestrator

    Run coding agents unattended on your own machine. Linux Landlock LSM kernel sandbox, compiler test gates, and Thompson-sampling pair routing across Goose, Aider, OpenCode, Pi, and Claude Code. Local weights run first, zero database dependencies, and packaged Goose recipes for self-improving A/B evaluations.

    project page github hydrafusion comparison 192-run bake-off landlock architecture harness plumbing bugs gates & verification worktrees & coordination

  2. Vozonda

    podcast-app

    An open-source podcast studio that turns articles, papers, PDFs, RSS feeds, and notes into private podcast episodes on your own hardware. 14 show formats (deep dive, quick brief, debate, critique, morning dispatch), multi-voice script generation with local LLMs, Qwen3-TTS voicing, and Podcasting 2.0 RSS feeds with chapters and transcripts.

    open-source release multi-agent studio build tts pipeline fixes tts pivot rationale qwen3-tts spike website github

  3. sovereign-mcp

    mcp-server

    A Streamable-HTTP MCP server backing every article and tool on this site. Four tools (search_blog, get_article, list_tags, diagnose_sglang). Live at mcp.sovgrid.org/self-hosted-ai. Listed on the official MCP registry, Smithery 100/100, Glama, awesome-mcp.

    live endpoint article

  4. Sovereign AI Grid Insights

    analytics

    A public, JSON-LD-backed dashboard that aggregates 30-day MCP tool calls, blog views, and distinct external agents from raw Caddy access logs: no JS pixel, no cookies, no third-party tracker. Filters self-traffic by CIDR, dedupes cloud-IP rotations, and identifies distributed scraper clusters by UA-over-many-/24s signature (one UA from many networks = bot; many UAs from many networks = real viral).

    live methodology self-traffic story

  5. Content quality pipeline

    editorial

    A scoring system that gates every article against style-specific thresholds (best-practice / werthaltige-code-beispiele / conclusion / smart-infotainment), enforces an anti-AI stylometry pass (em-dash penalty, uniform-list penalty, sentence-length-stdev reward), and rejects fabricated facts via factcheck.py before deploy.

    quality gate story

  6. Hero & caricature image pipeline

    image-gen

    FLUX.1-schnell on ComfyUI, locally on the DGX Spark. Generates hero images and caricatures per article from auto-derived prompts, then converts to WebP and routes through an interactive rating step (1 to 5) before publish. Backfilled across all 88 articles.

    image-pipeline article

  7. Podcast Studio (script → TTS → MP3)

    tts

    End-to-end CLI: select articles → LLM-written dialog (cipherfox + hexabella personas) → Qwen3-TTS-1.7B per turn → ffmpeg mix with intro jingle, music-duck, loudnorm to -16 LUFS. Voxtral was retired after its V6 expressivity ceiling (the documented pivot to VibeVoice / Higgs Audio v2 / IndexTTS-2 / Qwen3-TTS).

    pivot rationale first VibeVoice spike

  8. sovgrid.org (this site)

    astro+caddy

    Astro 6 + Caddy on a no-KYC FlokiNET VPS. Build pipeline self-heals quality signals, runs an axe-core a11y gate on every deploy, and pushes the regenerated knowledge-base to the MCP server in the same script. Every reading link is marked by where it goes, keyed on the href and WCAG-checked: internal stays green, external is body-coloured with a ↗ and opens a new tab, affiliate carries a ₿ and a disclosure, in-page anchors stay neutral. The full legend is testable on the support page.

    Floki VPS setup Astro migration

  9. Sovereign server (NVIDIA DGX Spark)

    hardware-setup

    The NVIDIA DGX Spark (GB10, SM121A) that runs everything on this site: the self-hosted LLM stack on vLLM (two Qwen models: a fast daily driver and a slower one for hard problems), the MCP server, the image and TTS pipelines, and the build pipeline for the blog. Set up from scratch with LUKS-encrypted storage, the /data directory convention, local inference, and a 30-minute power-failure recovery procedure. The primary box; the Lenovo Legion below is its companion.

    start here reference architecture five disasters survived power-failure recovery

  10. Sovereign laptop (Lenovo Legion)

    hardware-setup

    A second sovereign-AI box, built for a friend on a Lenovo Legion Pro 7 Gen 10 (RTX 5080 Mobile, Blackwell): encrypted Ubuntu, a local Ollama LLM with a shared second-brain (mem0 + deterministic RAG), a maintenance/learning dashboard, and a scoped AIDE file-integrity monitor. The companion to the DGX Spark, written up as a reusable playbook for setting someone else up, including the /data-convention LVM trap and how to do it without leaking your own identity.

    24h setup log friend-setup playbook second brain the /data trap

  11. Floki VPS (sovgrid.org host)

    vps

    The no-KYC FlokiNET VPS that serves sovgrid.org and the public MCP endpoint: Debian, hardened, Docker plus Caddy with automatic HTTPS, DNS-only with no Cloudflare proxy by sovereign design, defended at the origin with targeted DOCKER-USER drops and fail2ban. The blog deploys here by rsync over Tailscale.

    VPS setup

  12. vps-healthcheck

    ops

    Twelve-check daily audit of a remote VPS over SSH: reboot flag, security updates, failed units, UFW, fail2ban, disk, memory, OOM history, LE-cert expiry, container set, optional freshness file. One bundled notification push per run, structured JSON sidecar. Single SSH session for the whole audit, exit 0/1/2 for cron. The README walks through why this is the right size for a one-VPS operator versus Prometheus / Netdata / Uptime Kuma.

    github write-up

  13. watchdocker

    devops

    A bash-native successor to the archived watchtower: a systemd timer pulls and smart-restarts Docker Compose stacks once a week, then gets out of the way, no 24/7 container, no open socket. Built after watchtower 1.7.1 broke against Docker Engine 29.5. About 350 lines of bash plus two unit files, auditable in fifteen minutes. The write-up compares it honestly against the surviving forks (nicholas-fedor/watchtower, WUD) and is explicit about which operator each one fits.

    github write-up

  14. sovereign-backup

    backup

    A config-driven, multi-host backup tool extracted from the rebuild after a six-week silent-failure postmortem: tar plus age encryption to a USB stick or local NVMe, driven by per-host YAML, with a systemd timer and a smoke-tested CLI (dry-run, deterministic exit codes, restore --verify). One generic binary across machines; the real source list and destinations live in config, not in the script.

    github write-up

  15. Sovereign Qwen (OpenWebUI custom model)

    rag

    Qwen3.6-35B-A3B AutoRound int4-mixed on vLLM, fronted by OpenWebUI with a sovereign-kb knowledge collection (ten cross-project markdown files), SearXNG web search, and the sovereign-ai MCP server exposed as OpenAPI tools via an mcpo bridge.

    overbuilding article

  16. Upstream contributions

    fixes

    Bugfixes and config patches sent back to the projects this blog runs on: vibe, openhands, opencode, Mistral chat-template handling, and others. Every merged PR is listed individually on the upstream page.

    upstream PRs page

Missing something? Tag cipherfox on Nostr or send a PR-style note via the MCP server.