AK — you asked for the thing you don't know you don't know. A few days ago you didn't think a custom cloud file explorer or a self-hosted mail platform was possible, and now both exist. This doc is the same move, repeated ~40 times: a sweep of hundreds of open-source tools plus inventions nobody sells, each one judged as a user-facing organ (like your inbox, file explorer, forum, dashboard — not backend glue), ranked by usefulness-vs-complexity, with a build sequence tuned to your token-burn window.
Route: SELF-HOST AS-IS (deploy the OSS, done) · FORK (take the OSS, AK-ify it) · BESPOKE (nothing exists — we build the organ, usually on OSS engines)
Every item names the specific AK problem it solves, citing your systems and frictions. If it doesn't solve a real one, it's not in here.
Constraint respected throughout: everything self-hosts on your machines (Dell XPS, this VM, the tailnet) — no VPS, Docker-compose-friendly where possible.
Executive summary: the top 10, ranked by usefulness ÷ complexity
#
Organ
What it is
Route
Effort
Why it wins
1
Model Switchboard (LiteLLM proxy)
One endpoint for 100+ models; per-agent virtual keys with budgets; spend dashboard per agent per model
SELF-HOST
S
Instant cost visibility + control over the single biggest line item in your operation. Feeds every other agent organ.
2
Cron Mission Control (Cronicle)
Visual front door for your dozens of crons: run history, chains, failure timeline, alerts
SELF-HOST
M (migration)
Your scheduler is currently invisible plumbing. This is the highest-leverage visibility win in the whole doc.
3
DB Console (CloudBeaver)
Your seed idea: a file explorer, but for databases — browse/query/edit every DB from one web tab
SELF-HOST
S
The exact organ you asked for. One container, Apache 2.0, done.
4
Front Door (Homepage)
Start page with live widgets for every organ — the one tab you open
SELF-HOST
S
Agents maintain the YAML; you just open it. Ends "where is that thing" forever.
5
The Pager (ntfy + Healthchecks)
Push backbone: every organ posts alerts here; your phone gets them; agents subscribe too
SELF-HOST
S
Without this, every monitoring organ is a dashboard nobody opens. Cheapest reliability in the space.
6
Uptime Kuma
External reachability probes + free public status page
SELF-HOST
S
Your dashboard watches inside the machines; this watches whether the outside world can reach them.
7
Live Logs (Dozzle)
Real-time Docker log viewer in a browser tab
SELF-HOST
S
Agents debug without SSH. Zero config, one container.
8
Work Queue (Vikunja)
The board agents read/write: lists, kanban, labels, full REST API
SELF-HOST
S
One container, ~50MB RAM, real API. The missing "where does the work live" organ.
9
Org Wiki + Capture Stream (BookStack + Memos)
Durable company manual + zero-cost capture stream
SELF-HOST
S
BookStack's fixed hierarchy kills where-do-I-put-it fatigue; Memos is capture that costs zero, per your standing rule.
10
The Fuse Board (bespoke)
Your completion-enforcer made visible: every commitment, owner, fuse countdown, stall state
BESPOKE
S–M
Operationalizes your own standing law ("decided = will be done, on a fuse, watched every 15 min"). Nothing OSS encodes your fuse/escalation semantics.
Everything below is the full organ catalog, grouped into pillars. The build sequence at the end turns it into a token-burn plan.
Pillar 1 — Data: "a file explorer for your databases"
Your instinct was right, and your dashboard precedent (netdata and cockpit as separate organs) is the correct mental model: this is two organs, not one. You do things in a console; you glance at vitals. One combined tool buries one half or clutters the other.
DB Console
CloudBeaver
SELF-HOST AS-ISEffort: SP0
Problem it solves:your seed idea — the central database access point. One web tab on your tailnet to browse, query, and edit across every SQL/NoSQL store you run, now and future. Agents hit the REST API too.
Why as-is:mature, Apache 2.0, literally docker compose up -d. Nothing AK-specific needed — this is a solved problem, don't bespoke it.
Done looks like:db.akco.dev (or tailnet equivalent) opens a DBeaver-in-the-browser with all your databases connected; you run a query from your phone.
DB Vitals
pgwatch feeding your existing dashboard
SELF-HOST AS-ISEffort: MP1
Problem it solves:the health-check half — bloat, lock contention, slow queries, replication lag, backup success. Your netdata/cockpit dashboard answers "is the host alive"; this answers "is the database healthy."
Why as-is (but piped, not separate UI):pgwatch's Grafana piece is heavy; the lighter play is piping its metric queries into your existing dashboard organ so vitals live where you already glance.
Done looks like:your dashboard gains a "databases" section with per-DB health, and slow-query alerts flow into ntfy.
Problem it solves:when migration volume grows — who changed the schema, was it safe, can we roll it back. GitOps-style review/approval for schema changes.
Why defer:you don't have the migration volume yet. Deploy when the second painful schema incident happens, not before. (License terms have shifted across versions — verify before committing.)
Backup Ops
restic + Backrest
SELF-HOST AS-ISEffort: SP1
Problem it solves:your "Revival kit backups" goal is tracked but backup freshness is exactly what fails the one-week-absence test. Backrest is the web UI organ on top of restic — snapshot browser, schedules, retention, restore — and restic is already installed on your fleet.
Why as-is:the engine (restic) is yours already; Backrest is just the missing face. (Alternate: Kopia — pick ONE pair, not both. restic+Backrest wins because restic is already deployed.)
Done looks like:one tab shows every backup repo, last-success timestamps, and a big green/red per-repo; failures page ntfy.
Search Front Door
Meilisearch engine + bespoke UI
SELF-HOST + BESPOKEEffort: S+MP1
Problem it solves:"where is that thing" across files, notes, forum, databases, bookmarks. No OSS product is a federated search organ spanning your data sources — the engines are just the index layer.
Why split:Meilisearch itself is self-host-as-is (MIT, one container, ready in ~60s). The organ — one search box federating Meilisearch + your file explorer + notes + forum — is bespoke because nothing sells it.
Done looks like:one search box on your Front Door; agents query it via API instead of grepping five systems.
Spreadsheet Data UI
Baserow
SELF-HOST AS-ISEffort: SP1
Problem it solves:non-SQL access to your data — grid/kanban/calendar views over tables, for you and for agents via auto-generated OpenAPI. The Airtable-shaped organ.
Why Baserow over NocoDB:cleanest license story (MIT core vs NocoDB's "Sustainable Use" fair-code license). Single all-in-one container. (If connecting to existing DBs matters more than license purity, NocoDB is the alternate — pick one.)
Done looks like:a friendly grid UI over your operational tables; agents CRUD via the generated API.
BI Dashboards
Metabase
SELF-HOST AS-ISEffort: MP1
Problem it solves:business dashboards, not DB health — "did sales move," venture metrics, nudge-system stats. Point-and-click questions over your own DBs with scheduled email reports.
Why as-is:48k stars, official compose, the default answer. AGPL-3.0 — fine for internal use.
Done looks like:a "ventures" dashboard you check weekly; agents add questions in plain language.
Agent Memory Store
Qdrant + bespoke memory explorer
SELF-HOST + BESPOKEEffort: S+MP1
Problem it solves:your agent team currently has no shared semantic memory — every agent re-derives what another already learned. Qdrant (Apache 2.0, single binary) is the embeddings engine; the organ is a small explorer UI over what the team remembers.
Why split:the engine is solved; the "what does the team know" browser is yours to invent.
Done looks like:agents write memories via API; you browse/search the team's shared memory like a wiki.
Shared Query Notebook
SQLPad
SELF-HOST AS-ISEffort: SP2
Problem it solves:"query once, share with the team" — saved queries with charts and scheduled runs, sitting between CloudBeaver (interactive) and Metabase (dashboards).
Done looks like:a library of named queries the agents reuse instead of rewriting SQL.
Pillar 2 — Observability & Fleet Ops
Front Door
Homepage
SELF-HOST AS-ISEffort: SP0
Problem it solves:you are about to own 20+ organs. Without one tab that lists them all with live status widgets, you get bookmark sprawl — context-switching fuel.
Why Homepage over Dashy/Homarr:100+ native integrations with live data (not just links), millisecond loads, and YAML config that agents generate and version-control. You never edit YAML — you say "add X" in chat and an agent regenerates it. That fits your operating model exactly.
Done looks like:one tab, every organ, green/red at a glance, on your phone.
Uptime Kuma
S
SELF-HOST AS-ISP0
Problem it solves:external reachability — is akco.dev up, is mail up, is every organ reachable from the outside world? Plus a free public status page (custom domain, maintenance windows, RSS).
Why as-is:92k stars, MIT, one container with SQLite. (Skip Cachet — stalled v3, murky license; Kuma's built-in status page covers the job.)
Done looks like:probes on everything public; status.akco.dev exists; SSL-expiry warnings arrive before things break.
The Pager
ntfy + Healthchecks
SELF-HOST AS-ISEffort: SP0
Problem it solves:two halves of one organ. ntfy is the push backbone — every organ POSTs alerts to topics; your phone gets them via the app; agents subscribe and publish too. Healthchecks is the dead-man's switch — your many crons ping it; silence pages ntfy. Together they answer "did the job actually run and succeed?"
Why as-is:ntfy is a single binary (Apache 2.0, 34k stars); Healthchecks is one container (BSD). Cheapest reliability in the entire space.
Done looks like:a cron fails silently at 3am → your phone buzzes, the team inbox gets the receipt, nobody discovers it Thursday.
Live Logs
Dozzle
SELF-HOST AS-ISEffort: SP0
Problem it solves:today agents debug by SSHing into machines and tailing files. Dozzle is real-time Docker logs in a browser tab — no SSH, no context switch.
Why as-is:MIT, one stateless container, zero config. (Phase 2: Loki stack for history/search/correlation — the searchable-log organ. Run both; Dozzle is the live half.)
Done looks like:"the mail service is acting up" → open tab, watch the live stream, no terminal.
The Fleet Deck
M
BESPOKEP0
Problem it solves:your primary constraint is fleet churn ("Dune Sandstorms") across ~10 machines, and no single pane answers "is the XPS up, what ran where, which boot is this."
Mechanic:Tailscale-API-fed roster (hp-z-book, dell-xps, pixel-8-rooted, iPad, this VM…): online/offline, boot-ID aware (a sandstorm reboot is flagged routine, never alarmed — per your standing rule), disk/watchdog status, one-click SSH entry reusing your fleet-ssh wrappers, per-machine "what runs here" (cron list, processes). This is the live ops layer over your machine-inventory artifact — it extends your dashboard prototype, doesn't duplicate it.
Why bespoke:Tailscale gives the API; the sandstorm-aware UX is yours alone. Nothing OSS thinks in boot IDs.
Done looks like:one pane, every machine, green/amber, "rebooted 04:12 — routine sandstorm" instead of a 4am mystery.
Change Detection
changedetection.io
SELF-HOST AS-ISEffort: SP1
Problem it solves:watch-any-webpage-for-changes with diff view + notifications. Direct AK use cases already on your calendar: the Oct 20 Pet Alliance slot-release window (Gideon's neuter), price drops, announcement pages.
Why as-is:Apache 2.0, 34k stars, easy deploy. This is the "watcher agent" niche done better than anything bespoke would be.
Log History — Loki stack · SELF-HOST AS-IS · M · P1 (phase 2)
Problem it solves:Dozzle is the live half; Loki (+Grafana) is the history/search/correlation half — "what did the logs say before it broke."
Why phase 2:your agent team benefits more than you directly; ship Dozzle first, add history when the first "we needed yesterday's logs" incident happens. (AGPL — fine internally.)
Beszel vs. finishing your dashboard
S
SELF-HOST AS-ISP1
Honest call:Beszel (MIT, 26k stars, tiny Go agents) is lighter and more maintainable than finishing your custom netdata+cockpit prototype — but only one survives. Don't stack them. Either retire the prototype and adopt Beszel, or finish the prototype and skip Beszel. Your call; the proposal doesn't presume it.
Pillar 3 — Automation & Scheduling
Cron Mission Control
Cronicle
SELF-HOST AS-ISEffort: MP0
Problem it solves:you run many crons through a custom scheduler with no visual front door — no run history, no failure timeline, no "which job is red right now." Cronicle is the genuine organ: web UI, job history/charts, chained jobs with a graph view, multi-server workers, API, webhook notifications. Actively maintained.
Why as-is:nothing about your scheduling semantics requires bespoke; the cost is migrating your crons, not the install. (Pairs with Healthchecks from Pillar 2.)
Done looks like:every cron visible, history per job, chains graphed, failures in ntfy, agents driving it via API.
Agent-Native Automation
Windmill
SELF-HOST AS-ISEffort: MP1
Problem it solves:your custom MCP gateway is a gateway, not a workflow engine. Agents need a place where multi-step automations live with retries, schedules, and secrets. Windmill's killer feature: a built-in MCP server, and every script declares inputs via JSON schema — so any Windmill script automatically becomes an agent-callable tool. Code-first, so flows are git-reviewable text, not opaque canvases.
Why Windmill over n8n:n8n has 400+ integrations and a huge community, but it's visual-canvas-first (worse for git review) and fair-code licensed (not OSI). For a team whose hands are agents writing Python/Bash, code-first wins. (n8n stays the alternate if prebuilt integrations ever beat code-first.)
Done looks like:an agent writes a 20-line Python script in Windmill → it's instantly callable by every other agent over MCP, scheduled, retried, and secret-managed.
Fleet Task Runner
Semaphore
SELF-HOST AS-ISEffort: S–MP1
Problem it solves:a clickable "run this playbook/script now" front door for the fleet, with scheduling — your FMS/Ansible plans get a UI. Complements Cronicle (Cronicle = schedules, Semaphore = fleet tasks).
Why as-is:MIT, single binary, SQLite. The Ansible Tower shape without the enterprise weight.
Done looks like:"run the backup playbook on the XPS now" becomes a button instead of an SSH session.
Pillar 4 — Work Management
Work Queue
Vikunja
SELF-HOST AS-ISEffort: SP0
Problem it solves:"where does the work live" — the board agents read and write. Lists, kanban, Gantt, labels, checklists, full REST API, CalDAV sync. One container, ~50MB RAM.
Why Vikunja over Plane:Plane is the closer Linear clone with an official MCP server, but its community edition is deliberately hobbled (epics/initiatives and custom fields are paid; 60 req/min/token is tight for agents) and it's a 12-container, 4GB-RAM commitment. Vikunja is the best agent-fit-per-effort; fork Plane later only if you outgrow Vikunja's model.
Done looks like:agents pull tasks from the queue, update status via API, you see the board on your phone.
The Fuse Board
S–M
BESPOKEP0
Problem it solves:your standing law — "decided means will be done, on a fuse, watched every 15 minutes" — is currently invisible plumbing. The Fuse Board makes the completion-enforcer visible: each card = owner, fuse countdown, acceptance criteria, evidence link, last-movement timestamp. Cards go red at fuse-pass, amber at ~1h stall. A "quiet carry" column rolls undone items forward silently — shame-free, per your constraints. Event-gated items get no clock fuse (per your 9/25 lesson).
Why bespoke:the register+enforcer+fuse semantics are your invention. Rebuilding in Linear/Jira would lose them.
Done looks like:you open one board and see every commitment in flight, what's stalled, what's carried — the machine's promises made visible.
The Autopilot Brief — BESPOKE · S · P0/P1
Problem it solves:your acceptance test for every workflow — "what happens if AK doesn't look at this for a week?" Each morning the agents compile: green (on autopilot), amber (decaying but safe — fuses approaching, pending approvals), red (will break without him — blocked tokens, budget caps). Written shame-free ("carried forward"), phone-readable, lands in your digest.
Why bespoke:the generator is cheap; the value is the convention. Ship alongside the Fuse Board — it IS the one-week-absence test, as an organ.
Done looks like:every morning, one artifact telling you exactly what needs you and what doesn't.
Pillar 5 — Knowledge & Capture
Org Wiki
BookStack
SELF-HOST AS-ISEffort: SP0
Problem it solves:the durable company manual — Shelves→Books→Chapters→Pages. The fixed hierarchy kills where-do-I-put-it decision fatigue (genuinely AuDHD-friendly). MIT, monthly releases, trivial backups, solid API.
Why BookStack over Outline:Outline is prettier and Notion-like, but BSL-licensed (source-available, terms can change). BookStack's MIT is cleaner and the rigid structure fits your brain better. Pick ONE — not both.
Done looks like:every durable system documented in one wiki; agents write runbooks into it.
Capture Stream
Memos
SELF-HOST AS-ISEffort: SP1
Problem it solves:your standing rule — capture must cost zero and be Muse-owned. Memos is a Twitter-like memo stream, markdown-first, single Go binary. The stream (quick capture) vs. BookStack the library (durable knowledge) — two distinct organs, not one.
Done looks like:a thought arrives → it lands in the stream in seconds → agents triage it into the wiki, the work queue, or the bin.
The Catch-All
S–M
BESPOKEP1
Problem it solves:unvoiced thoughts die in transitions. Press-and-hold voice note → local transcription on the tailnet (whisper.cpp — free, offline, private, nothing leaves your machines) → triage queue with three states: filed, answered, routed to agent. You only tap "keep/kill" on the flagged few. Chronological by default, per your temporal memory.
Why bespoke:the engine (whisper.cpp) is OSS; the triage-queue organ doesn't exist anywhere.
Done looks like:Alt+Space on any machine, or a Telegram voice message → transcript in the queue by the time you've put the phone down.
Intelligence Inbox
Miniflux
SELF-HOST AS-ISEffort: SP0
Problem it solves:your research workflows need an "intelligence inbox" — RSS with a clean REST API that agents drive: subscribe, pull unread, feed briefings. Single Go binary, Apache 2.0, near-zero maintenance.
Done looks like:agents monitor feeds, the good stuff flows into your briefings; you never open an RSS app.
Save-Everything Archive
Karakeep
SELF-HOST AS-ISEffort: MP1
Problem it solves:full-text search over everything you've saved — agents retrieve research by content, not URL. AI auto-tagging included. (Distinct from Miniflux the inbox and Memos the stream: this is the archive.)
Done looks like:"find that article about X" works even when you only remember one sentence of it.
The Ledger
S
BESPOKEP1
Problem it solves:you mandate decision logging (IDs like 244ded7), but the log is flat text — provenance and outcomes are invisible. The Ledger parses it into a date-anchored timeline: search by ID/keyword/date; each decision shows provenance (your own words vs. relayed, with verification evidence — your 9/29 rule) and disposition (implemented / pending / overturned), linked to the Fuse Board item it spawned. Linear-style Cmd+K jump to any decision.
Why bespoke:no OSS product does "decision ledger with provenance + disposition." It's a reader layer over your existing format — cheap to build.
Done looks like:"what did we decide about X, and did it happen?" answered in one search.
The Temporal Spine
S
BESPOKEP1
Problem it solves:you learn and think chronologically, but artifacts scatter (decisions log, team inbox, kit backups, digests). The Spine is one append-only, date-anchored timeline of everything the machine did, decided, and shipped — zoomable day/week/month, every entry linking to its source. The weekly digest becomes just a filtered view.
Why bespoke:trivial to build, enormous emotional fit. Nothing this specific exists.
Done looks like:"what happened the week of Sep 21?" → one timeline, everything linked.
Pillar 6 — Agent Infrastructure (the team's own organs)
Model Switchboard
LiteLLM proxy
SELF-HOST AS-ISEffort: SP0
Problem it solves:one OpenAI-compatible endpoint for 100+ models; virtual keys per agent with budgets and rate limits; per-model/per-key spend dashboards at /ui. Fallbacks and load balancing built in.
Why as-is:MIT, ~50k stars, single Docker image, 8ms P95. This is the highest-leverage single deploy in the doc — it feeds cost data into the Fuse Board and any future agent market.
Done looks like:every agent call routes through the proxy; you see spend per agent per model; a runaway agent hits its budget cap instead of your wallet.
Eval & Trace
Langfuse
SELF-HOST AS-ISEffort: S–MP1
Problem it solves:your agents' work quality is currently judged by vibes. Langfuse is tracing + evals (LLM-as-a-judge, human annotation) + datasets + prompt registry + spend dashboards, self-hosted, 50+ integrations including LiteLLM.
Why as-is:the two-for-one — it covers the eval harness and the prompt registry (versioned prompts with production/staging labels), so don't build a separate prompt organ. (promptfoo as the lighter CI-gate companion for regression suites.)
Problem it solves:your MCP ecosystem needs a browsable, installable registry. allbotsio's marketplace is self-hostable Docker with full-text search, health checks, and 200+ pre-loaded servers. The mechanic to steal from MCP Harbor: the registry is itself an MCP server — your agents discover tools by asking, not by reading a wiki.
Done looks like:an agent needs a tool → queries the registry over MCP → installs it. No human involved.
Fleet Mission Control
M
FORKP1
Problem it solves:dispatch + watch results + budget enforcement + agent Q&A in one pane. The closest OSS to an agent-fleet command center: 32 panels (tasks, agents, skills, tokens, cron, alerts), multi-gateway including OpenClaw, "Aegis" quality gates blocking task completion without sign-off, and a Skills Hub that's itself a mini MCP-registry.
Why fork, not bespoke:the skeleton exists (MIT, SQLite, zero deps). Fork it to AK-ify: tailnet auth, your agent roster, provenance per the Ledger, Fuse Board semantics. Building dispatch from scratch would burn the token window for no reason.
Done looks like:one console where work is dispatched to agents, results watched, budgets enforced, quality-gated.
Agent Chat Front Door
Open WebUI
SELF-HOST AS-ISEffort: MP0
Problem it solves:the missing front door — one chat UI over all your models, wired to your MCP gateway, from any device. For a founder whose team is agents, this is how you talk to the machine.
Why as-is:150k+ stars, Docker deploy. Caveat: its license moved away from MIT — verify current terms before committing.
Done looks like:one chat app on your phone that reaches every model through your gateway.
The Token Exchange
S–M
BESPOKEP2
Problem it solves:your five-agent team plus side-chat squads allocate work top-down only. The Exchange is a bulletin board where agents post offers and requests priced in tokens or priority credits ("Offer: transcript triage, 2k tokens" / "Need: PDF parsing, paying 1 priority credit"). Standing rules cap spending; every trade logs to the team inbox; token prices double as cost-awareness training for the team.
Why bespoke:no OSS "agent service market" exists. Delightful, network-effects — but only after dispatch (mission control) exists.
Done looks like:agents trade work peer-to-peer within policy; you watch the market instead of dispatching everything.
Pillar 7 — Comms
Buzz stays. Build around it, not beside it.
Honest call from research: adding Mattermost/Zulip/Revolt alongside your custom Buzz isn't a new organ — it's a duplicate chat that fragments attention (two inboxes = shame-machine fuel). Zulip's topic-threading is the only structurally different idea, and that's a "replace Buzz if it ever fails" P2, never an addition. Self-host nothing here.
The Dread Dial
M
BESPOKEP1
Problem it solves:your AccelerateBooks revival hinges on a documented mechanic — your dread drops in three stages (logging in = step change, inbox zero = breakthrough, sustained zero = residual fades). No tool on earth is built around inbox zero as a therapy mechanic. This one is: one Superhuman-style keyboard-first queue aggregating wp-admin comments, support email, and social DMs (Cmd+K actions, e = done, snippets for common replies). Agents pre-triage overnight (draft replies, label spam, cluster duplicates). A big Dread Dial gauge decays as the queue drains; the organ leads with what's done ("47 closed today" headlines, never "12 waiting"). An extinguish-meter logs the history so the effect is visible and repeatable.
Why bespoke:it's a UI over your existing mail platform, not a new mail stack — and the dread-extinction loop is yours alone.
Done looks like:support sessions that end at zero, with the dial proving the dread dropped — the revival's engine room.
Calendar Truth + Booking Face
Baikal + Cal.com
SELF-HOST AS-ISEffort: S+MP1
Problem it solves:you have no calendar organ, and agents currently manage your schedule through Google-API roulette. Baikal is the missing piece everyone skips: a lightweight CalDAV/CardDAV server — the calendar/contacts source of truth that syncs natively to your iPhones, Pixel, and iPad, which agents read/write over CalDAV. Cal.com is the public booking-link face on top (self-hosted Calendly, no per-seat tax).
Done looks like:agents manage your real calendar over an open protocol; anyone can book you via your link; no API quota roulette.
Steal, don't clone — the mechanics worth lifting
Linear's Cmd+K(via cmdk/kbar, effort S): the contextual action palette — one modal, fuzzy search over records + places + actions. The most ADHD-friendly pattern found (recognition over recall). Goes into every organ as a shared component.
Superhuman's split inbox + "mark done" philosophy(effort M): VIP/Team/Important/Other streams; empty = done. Goes into the Dread Dial and your existing inboxes.
Granola's silent capture + notes merge(effort S–M): no bot joins calls, no stored audio — rough jottings merged into structured notes after. Goes into the Catch-All's meeting path.
Pillar 8 — QoL & Media
Immich
M
SELF-HOST AS-ISP0
Problem it solves:phone photo backup — yours, Emily's moments, Gideon's kitten photos. Self-hosted Google Photos: native iOS/Android background upload with a documented Tailscale pattern, face recognition, semantic search. 115k stars, AGPL.
Why P0:it's the only QoL item that protects irreplaceable data. Needs 6–8GB RAM for ML jobs — plan placement on the XPS.
Done looks like:photos leave your phones automatically, searchable by "gray kitten," nothing in Google's cloud unless you say so.
Pingvin Share
S
SELF-HOST AS-ISP1
Problem it solves:WeTransfer-shaped large-file sends — videos, backups, deliverables — link-gated, expiring, on your tailnet or public. (Caveat: original repo went quiet — verify the live continuation fork before deploying.)
Nudge Mission Control
S
BESPOKEP1
Problem it solves:your v4 nudge system is intricate living machinery (planner + deliverer + phrase rotation, recipe secret from you) running blind. The console shows today's plan (4–10 nudges, 45-min floor visualized, doubles flagged), deliverer heartbeat, rotation health, delivery stats — plus a guarded recipe vault (you-excluded view) and your "felt off?" feedback tap feeding the anti-habituation model without revealing the recipe.
Done looks like:the nudge system becomes observable without leaking its secrets.
The long tail (all S, all P2 — pick by itch)
Actual Budget(MIT): local-first envelope budgeting — the one finance organ that fits your stance ("expense tracking is the honest MVP") without violating your finance-gating.
Excalidraw(MIT, solo): the hand-drawn whiteboard for sketching; skip the collab stack (that's glue).
PrivateBin(permissive): zero-knowledge pastebin — client-side encrypted scratch for sharing logs/secrets; the server never sees plaintext.
Shlink(MIT): branded akco.dev short links with analytics and QR; agents mint links via API.
Navidrome(GPL, single binary) then Jellyfin: music first (near-zero cost), media server after Immich.
LifeLog— a Rewind/Limitless-style clone (BESPOKE, M, P2): continuous on-device capture → "everything you saw is searchable." The privacy angle is the whole point: local Whisper, everything stays on the tailnet, nothing leaves your machines. Your temporal memory's dream organ — but P2 until the P0s ship.
Pillar 9 — Cross-cutting
One Login
Authelia
SELF-HOST AS-ISEffort: MP1
Problem it solves:you're about to own 20+ organs. Authelia puts one WebAuthn/passkey + TOTP gate in front of all of them (forward-auth covers organs without native login like Dozzle), with YAML config an agent manages. 30MB RAM, Apache 2.0.
Honest value check:for a single founder this is moderate-but-real — its absence is felt only during a security review or a breach. Ship it in Wave 2, not Wave 1.
Done looks like:one login, every organ, scoped OIDC tokens for agents instead of shared passwords.
What we're deliberately NOT building (the honest no's)
Vaultwarden:you have 1Password working (CLI, biometrics). Self-hosting secrets trades a managed audited service for infrastructure you back up — and you'd store recovery creds in the thing that's down when you need them. Skip.
A second chat platform(Mattermost/Zulip/Revolt): Buzz exists. Duplicates fragment attention.
n8n(picked Windmill), Outline (picked BookStack), NocoDB (picked Baserow — license), Plane as-is (hobbled CE; Vikunja now, fork Plane later if needed), Graylog (Loki does it at a tenth the weight), Cachet (stalled; Kuma's status page covers it), Plausible (Cloudflare Web Analytics already picked for public sites), Huginn/Automatisch/Chronos/Statping (stalled or dead), Hookdeck Outpost (SaaS-product infra you don't need yet), AppFlowy server / Raindrop (licensing friction), Trilium / Focalboard / Taiga (archived or discontinued).
Outerbase Studio:tempting AI query layer, but Cloudflare acquired it and OSS releases stalled ~18 months ago. Maintenance risk — skip.
Suggested build sequence for the token-burn window
Wave 1 — days 1–7: the docker-compose blitz. All S-effort, self-host-as-is. An agent can deploy each in an afternoon: LiteLLM proxy, CloudBeaver, Homepage, ntfy + Healthchecks, Uptime Kuma, Dozzle, Vikunja, BookStack, Memos, Miniflux, Backrest, Meilisearch engine. End of week one: the switchboard is live, every cron is watched, the pager works, and you have a front door. This is the week that pays for the whole window.
Wave 2 — weeks 2–3: the bespoke P0s + heavier deploys. The Fuse Board, the Fleet Deck, the Autopilot Brief (your standing law, made visible — these are the organs only you could have invented). Cronicle migration (the real cost is moving your crons). Langfuse, Windmill, Immich, Authelia, Baikal + Cal.com, Open WebUI. The Catch-All and the Ledger.
Wave 3 — week 4+: inventions and polish. The mission-control fork, the Dread Dial (timed with the AccelerateBooks revival push), the Temporal Spine, Nudge Mission Control, the federated Search UI, Karakeep, Metabase, Qdrant memory organ, Semaphore, Loki history. The Token Exchange last — it needs dispatch to exist first.
Standing rule for all of it: minimal-first, two-week kill/keep experiments. Every organ ships as an experiment with a keep/kill date. Anything unused after two weeks gets retired — the proposal is a menu, not a mandate.
Open questions for you, AK
Beszel vs. your dashboard prototype — retire the prototype and adopt Beszel, or finish the prototype? Only one survives.
Baserow vs. NocoDB — license purity (Baserow, MIT) or widest existing-DB support (NocoDB, fair-code)?
BookStack vs. Outline — rigid hierarchy (BookStack, MIT) or prettier writing (Outline, BSL caveat)? Pick one.
restic+Backrest vs. Kopia — restic is already on your fleet; Kopia's engine is arguably better. One pair only.
The Dread Dial's timing — build it now ahead of the revival push, or after the P0 platform wave?
Which three from the top 10 do you want first? The team starts there the moment you say go.
Research: 4 parallel tracks, 2026-09-30 — Data · Ops/Observability/Automation · Work/Knowledge/Comms/QoL · AI-native + inventions. Star counts and licenses verified against GitHub same-day; license-change caveats (Cal.com/cal.diy, Open WebUI, n8n, NocoDB, Bytebase, Pingvin Share fork) flagged inline for verification before committing. Nothing in this doc touches your existing stack — it builds adjacent: file explorer, MCP + gateway, forum, Buzz, inboxes/mail, dashboard prototype, MuseHub.