Secrets without leaks: a Bitwarden CLI into CI and agent permissions
Fetch Bitwarden secrets into CI and AI agents without leaking—shell-variable discipline, masked vs protected vars, first3/last3 verification, permission rules.
Home on zolty.systems
Recent content in Home on zolty.systems
Latest posts
Scoring Pokémon card lots against eBay sold comps
A data model that turns a Pokémon card lot into a defensible max bid using eBay SOLD comps, grade matching, sell-through velocity, and a margin of safety.
Building domain-specific MCP servers: three I actually use
Three real MCP servers — docs, personal finance, inventory ops — and the design lessons: schema from type hints, stdio transport, and gated writes.
The autonomy ladder in practice: letting agents commit, then merge
Five operational rungs for coding agents: from read-only to auto-merge, promotion criteria, demotion triggers, and why infra caps lower than app code.
Background agents that babysit the cluster: drift, test-deletion, and cost sentinels
Background monitors that babysit LLM-driven infra: goal drift, test deletion, CronJob failures, and cost spikes, all gated by deterministic guardrails.
I audited four months of my own repos to see what I was actually early on
I pulled first-commit dates for every agentic pattern in my repos, then researched when each went mainstream. I was two years late on four things I felt clever about, and genuinely ahead on four others. The ones I was ahead on all have something in common.
The merge gate is a rival model: four days of Gemini deleting my code
I route finished, working, already-reviewed code to Google's model and ask it to attack the reasoning. In four days it killed a performance optimization, invalidated my entire backtest leaderboard, and found five data leaks. None of that came from the model that wrote the code.
A panel of LLMs: using Gemini and Claude to pressure-test decisions
Why consulting several LLMs widens your analysis surface instead of chasing consensus: a practical guide to running Claude and Gemini as a decision panel.
Claude asks Claude for help: an agent-to-agent bridge over Mattermost
Two headless Claude agents talk over Mattermost to trade context. A cheap polling gate checks for a real question before waking the costly headless responder.
I don't read the PRs: supervising Claude by reading the docs it leaves behind
I point Claude at a problem and let it run — often without reading the merge request, because the blast radius is internal-only. The supervision happens afterward, by reading the docs, diagrams, and wiki it writes.
I built a headless refurb bench: imaging surplus PCs without a monitor
Automate Dell BIOS with CCTK and run a headless PC imaging bench on a PiKVM V4 Plus and multiport Switch extender — reflash surplus desktops, no monitor.
Phone scan to 3D print: photogrammetry, a watertight mesh, and Bambu
Turn a phone photogrammetry scan into a 3D-printable model: voxel remesh to a watertight, manifold shell, decimate for the slicer, then print it on a Bambu.
Recapping a dead cassette deck: a vintage-audio repair triage
Old cassette decks fail spectacularly—but not always for reasons you'd recap. ESR meters catch dried-out capacitors that voltmeters miss. Here's how to triage.
Beyond cover art: background removal, batch resources, and two GPUs of throwaway pixels
The same local ComfyUI box that makes blog headers also strips backgrounds off hardware photos, batch-generates consistent icon sets, and runs across two Mac Studios. A tour of the graphical-resource workflows.
How this blog is built: Hugo, S3, CloudFront, and an AI drafting pipeline
A tour of the machinery behind this site: Hugo and PaperMod generating static HTML, S3 plus CloudFront serving it, Terraform managing the AWS, and an AI pipeline drafting posts for human review.
From prompt to published: how every image on this blog comes out of a local ComfyUI
Every cover photo and inline illustration on this blog is generated locally by asking an agent to call a ComfyUI MCP tool. Here's the model-per-job table, the prompts that actually work, and the prompt-to-CDN pipeline.
Headless bench-PC fleet: imaging and BIOS-as-code with PiKVM and Dell CCTK
Reimaging and configuring a bench full of small-form-factor PCs without ever plugging in a monitor — PiKVM for eyes and hands, Dell Command Configure for BIOS settings as code.
Token-budgeted self-improvement: pointing parallel agents at my own repos
A budgeted sweep that fans out parallel agents to scan releases, CVEs, and CI inefficiencies across my repos, test the safe wins in isolated worktrees, and open merge requests — under a hard token cap.
LLM-powered GitLab CI: auto-reviewing and auto-fixing merge requests
A GitLab CI pipeline that reviews merge requests, proposes fixes, and — at higher trust rungs — commits them, with deterministic guardrails that always run before any LLM judgment.
Build a 3-node K3s cluster from $150 surplus Dell OptiPlex desktops
Government-surplus Dell OptiPlex 7060/7070 desktops are the cheapest serious x86 cluster nodes you can buy. Add a stick of RAM and a NIC and three of them make a proper k3s cluster for around $600.
Tracing and budgeting LLM agents with Langfuse
Autonomous agents fail quietly and spend silently. Langfuse gives me per-trace cost, goal-drift detection, and weekly action audits — the instrumentation that makes unattended agents trustworthy.
A LiteLLM gateway for the homelab: one endpoint, many models, hard cost caps
I route every LLM call — local Ollama, cloud frontier models, OpenRouter — through a single LiteLLM gateway with per-key budgets and spend alerts, so cheap bulk work stays cheap and nothing runs away.
The peasant has friends now: rumors, routines, and a 3,200-strong crowd
Eight days of shipping on my LLM-driven Ultima Online shard: NPCs with daily routines, towns that gossip about players, a GM avatar with genie rules, delivery quests, and 200 chatty denizens per city — all on free local inference.
Writing MCP servers for your homelab: five tools, 200 lines, and your agents get hands
Model Context Protocol turns any local HTTP API into something your AI agents can call. Here's the pattern I use to wrap homelab services — ComfyUI, wikis, dashboards — as MCP servers.
Every homelab service behind one login: Traefik forward-auth with Authentik
One SSO login in front of every internal service. How I wire Traefik forward-auth middleware to Authentik so dashboards, APIs, and even non-Kubernetes backends share a single sign-on with TLS.
Tiered model storage with MinIO and rclone: keep the SSD hot, archive the rest
A growing library of multi-gigabyte model checkpoints will eat any SSD. Here's how I tier ComfyUI and LLM models across local NVMe and MinIO object storage with rclone, transparently.
The Mac Studio as a GPU appliance: serving Ollama and ComfyUI to a k3s cluster
Running a Mac Studio M3 Ultra as a headless GPU host for local LLM inference and image generation, proxied into a k3s cluster, with 256 GB of unified memory split between Ollama and ComfyUI.
When the peasant talks back: LLM NPCs in Ultima Online
I swapped Ultima Online's canned NPC dialog trees for a local LLM on my homelab — persona, cross-reboot memory, autonomous errands, and now talking liches.
How LLM-driven NPCs work in Ultima Online (ServUO)
A code-level walkthrough of the C# integration that gives ServUO's Ultima Online NPCs LLM dialog, durable memory, and a fail-open, allowlist-guarded loop.
A $150 Surface Pro 7 is the best Home Assistant wall panel you can buy
Used Surface Pro 7 tablets are cheap, have a gorgeous touchscreen, and run a real browser — which makes them a near-perfect wall-mounted dashboard for Home Assistant, Grafana, or any homelab panel. Setup and the kiosk trick.
Re-tuning my Claude Code setup for a new Opus model
When a new Claude model dropped I re-audited my agent config, offloaded bulk work to a local LLM, and wired in session drift monitoring. Here's what changed.
The seam — what I deliberately left in the cloud and why
The parts of my homelab stack that still live in AWS and Anthropic's API — DNS, KMS, S3 backups, Bedrock — and the principles behind drawing the line.
The Saturday DR drill — burning the cluster down on purpose
A deliberate, scheduled disaster-recovery drill — wiping GitLab, Vault, Harbor, and Longhorn volumes on purpose to prove the Terraform + S3 rebuild works.
From managed to owned — the case for self-hosting in 2026
What pushed me off ECR, GitHub Actions cloud, and a chunk of AWS onto my own k3s cluster — and where managed services are still the right answer.
HashiCorp Vault behind Authentik — secrets that survive an auditor
Migrating from sealed-secrets to a HashiCorp Vault HA cluster on k3s, fronted by Authentik OIDC for humans and the Kubernetes auth method for workloads.
Watts, BTUs, and the real cost of running a homelab 24/7
Kill-a-Watt readings from k3s nodes plus a pair of Mac Studios, monthly bill math, BTU heat load, and the honest break-even calculation against cloud.
The agent autonomy trust ladder: supervised → monitored → trusted → full
How I decide what an autonomous agent is allowed to do without asking — a four-rung trust ladder that earns autonomy through repetition, not promises.
Coordinating 3-5 parallel Claude sessions through a shared Mattermost channel
How I run several Claude Code sessions in parallel without them stepping on each other — coordinating via a shared Mattermost channel and a tiny coordination board.
Running a 1T-parameter MoE locally on two Mac Studios over Thunderbolt 5
What it takes to run a trillion-parameter mixture-of-experts model on two M3 Ultra Mac Studios connected via Thunderbolt 5 — and what actually fits in 512GB of unified memory.
Blind Oracle: stripping dates, headlines, and tickers before trusting an LLM trading evaluator
How I caught my LLM-driven hypothesis evaluator cheating by reading the future — and the masking patch that finally produced trustworthy out-of-sample numbers.
$6 enterprise Wi-Fi: flashing Extreme WS-AP3825i access points with OpenWrt
Surplus Extreme Networks WS-AP3825i access points cost about $6 and run OpenWrt 23.05.5 — vendor-free, no controller, no license. The case for ex-enterprise APs, and the one firmware mistake that bricks them.
Harbor as a proxy cache for every upstream registry — killing rate limits in a homelab
How I configured Harbor as a proxy cache for docker.io, ghcr.io, lscr.io, and quay.io — eliminating Docker Hub rate limits and surviving an upstream outage in the process.
Migrating from GitHub to self-hosted GitLab CE — and rebuilding it from S3
Why I moved my homelab repos off GitHub onto self-hosted GitLab CE, what broke during the cutover, and how the disaster-recovery rebuild from an S3 backup actually went.
The cheapest homelab node has a built-in UPS: a used business laptop
A used Dell Latitude 7400 runs k3s or Proxmox for ~$150, sips 10W, and rides out power blips on its own battery. Why a business ultrabook is an underrated cluster node, and how to set one up headless.
Giving Claude the ability to talk back: agentic long-running processes in OpenClaw
How I wire Claude into OpenClaw — my homelab's autonomous ops + trading intelligence platform — so long-running agents can think, act, and interrupt me in Slack when something needs a human. The goal was never chat. It's an agent that finishes a six-hour job and waves a hand.
Three Claude tabs kept clobbering each other. So I built a guard.
I run 3-5 parallel Claude Code sessions against the same codebase. One of them 'tidying up' during another's mid-refactor is a whole category of silent bugs. claude-session-guard is the 500-line Go binary that fixed it.
AI Agents Work Better When They Actually Know How You Operate
A structured 5-layer interview bot that extracts tacit knowledge, generates agent config files, and saves tokens by giving your agents real context. Code included.
Auto-documenting a homelab: the quest for free architecture diagrams
I tried Figma, Excalidraw, Mermaid, Kroki, and raw SVG generation to auto-document a k3s homelab. Here's what worked, what didn't, and what I'm still looking for.
Self-Hosted AI on a 24GB GPU: OpenClaw + Ollama Setup Guide for Windows
A complete guide to running your own private AI assistant on Windows with Docker Desktop, Ollama, and OpenClaw. Updated with model recommendations backed by 5,475 real evaluations — including which hyped models to avoid.
Running GLM-5.1 (744B) Locally on a Mac Studio: Benchmark Results
Benchmarking Z.ai's 744B GLM-5.1 model locally on a Mac Studio M3 Ultra with 256GB unified memory via llama.cpp. Real numbers on speed, quality, and whether it's worth the memory monopoly.