Bradley Batten

Remote monitoring and management for a Proxmox VE hypervisor, as an installable web app that works properly on a phone. It discovers virtual machines and containers from the cluster inventory rather than a config file, so anything created in Proxmox appears on its own within seconds.

The part I find most interesting is the authorisation model. Actions run under each operator's own Proxmox API token rather than a shared service account, so the hypervisor's native task log independently records who did what — a second record the application itself cannot edit. Every mutating request writes an audit entry, including the ones the app refuses.

It runs behind Cloudflare Zero Trust with no inbound ports open, and guards the containers carrying its own remote access: stopping the one your connection depends on takes a typed confirmation, because otherwise it is a single tap away from cutting you off from the machine entirely.

Source and architecture notes

A TLS certificate expiry checker. Small on purpose: the expiry rules live in their own evaluator, separate from the code that goes and fetches a certificate, so the logic that decides what counts as "expiring soon" is testable without a network or a clock.

Source