Aleks — Full-stack engineer · self-hoster · macOS native

A subscription hosting service where a paid Stripe invoice provisions a real workload — and the fleet supervisor buys a new dedicated machine when capacity runs out.

NestJS + Prisma/Postgres + BullMQ, driving the Pterodactyl application API. A supervisor computes commitment pressure, live pressure and pending demand every 60 seconds, alerts across three channels, waits for exactly one human confirmation, then orders from Scaleway, bootstraps with cloud-init, waits for Wings to check in with a baked-in token, and creates the port allocations.

• Proven end to end on real infrastructure — machine bought, provisioned, then released with billing stopped
• Pure decision core (decideFleet) kept separate from the side-effecting acquisition path
• Turborepo monorepo: NestJS API, shared packages, Zod contracts, Vitest

Provisioning

Fully automated

Approval

1 tap, Telegram

Teardown

Server + DNS + billing

A self-hosted, Docker-native database workspace. Install one container and it finds every database on the host — what it is, where its data lives, which services use it — and opens it in a grid from the browser or the wb CLI, without publishing a single port.

A pnpm + Turborepo monorepo: Fastify 5 API, React 19 SPA with AG Grid and Monaco, a SQLite metadata store, and a Go socket-guard that sits between Wharfbase and the Docker socket so only an allowlist of calls gets through. It joins the right Docker networks by itself, discovers pods through a read-only Kubernetes service account, and drives PostgreSQL, MySQL/MariaDB, SQLite, Redis and MongoDB — with ten more engines in the paid tiers. Licenses are Ed25519-signed JWS checked on your own server; a separate license server handles activation, trials and Stripe.

• OWASP ASVS Level 2 review with 17 fixes, read-only bypasses on seven engines among them
• Chaos tests: Docker dying mid-scan, agents dropping mid-query, a full disk, a damaged key
• Production databases open read-only until writes are unlocked, for an hour at most

Engines

15+, SQL to graph

Ports published

None

Security

ASVS L2 reviewed

A quiet place to publish poems, quotes and fragments — with an account or with none at all. Nothing carries a name, and nothing appears unread.

Next.js 16 with Prisma/Postgres and magic-link auth over jose. Every submission runs a deterministic prefilter, then one Gemini Flash call that both moderates and files the piece by form and theme. Review is scheduled with after() so the writer isn't held on the request, and a sweeper endpoint re-drives anything left unresolved — because after() dies with the process and the sweeper doesn't.

• Retry hints from the model's own rate-limit response stored per post
• Shared Story images rendered server-side with a bundled font
• CI + policy workflows gating every merge

Auth

Magic link, no names

Moderation

Prefilter + LLM verdict

Failure mode

Held, never published

SwiftUI terminal for macOS built on Citadel and swift-nio-ssh, rendered by SwiftTerm — split panes, an SFTP browser with a transfer queue, tunnels, snippets and themes. Free on the Mac App Store, with Termini Pro as an in-app purchase.

Two channels from one codebase: an App Store build compiled without Sparkle, and a notarized Developer ID DMG that self-updates through it — both at 2.4.6. Uploads, validation and review submissions go through the App Store Connect API from a script. The Windows build is a Tauri 2 shell over a Rust core on russh and russh-sftp, split the way the Swift services are, with its wire format pinned against Swift's own encoder so a Mac and a PC can share hosts through a synced folder.

• Full SSH: keys, agent, ProxyJump, local and dynamic forwards — not a wrapper around /usr/bin/ssh
• Windows port: 100 of 102 macOS files ported and tested; licensing and updates are what's left
• Release announcements posted from the App Store's own What's New, once per version

Mac App Store

2.4.6, macOS 15+

Direct download

Notarized DMG

Windows

Tauri + Rust, 1.1

A CLI that scans a host's live TLS configuration, grades it A+ → F with a 0–100 score, and prints the concrete fixes. Exits non-zero when the grade slips below your bar.

Probes endpoints directly with Node's native tls/crypto — no third-party service. Resolves every A/AAAA record and tests each IP separately, because CDN-balanced hosts differ per address; the reported grade is the weakest reachable one. Enumerates accepted cipher suites per TLS version to catch weak fallbacks a server still accepts even when it prefers a strong suite. Also covers SMTP/IMAP/POP3 mail TLS, DNS and header config.

• Deterministic, pure grading model — documented and testable
• Optional SSL Labs enrichment, never required
• Built with tsup + Vitest, ships as a single binary-ish CLI