EXTENSIONS

Declarative DHCP fixed-IP reservations on a local UniFi controller (UDM / UDM Pro / UDM SE). `sync` reads every reservation the controller holds; `drift` compares a desired set against it without writing, reporting missing, mismatched, unmanaged, duplicate and DHCP-pool-overlapping entries; `apply` reconciles the controller to the desired set and supports `dryRun`. `device_drift` does the same read-only comparison for adopted hardware, which cannot hold reservations at all and is addressed through device config instead — the one surface `drift` is blind to. Reservations live on the legacy Network API as `user` objects carrying `use_fixedip`/`fixed_ip`. Adds TOTP/MFA login support, which the upstream @mgreten/unifi auth flow lacks — UniFi SSO accounts with MFA reject password-only logins with MFA_AUTH_REQUIRED. Catches the failure mode where a reservation silently never takes effect because its address is already claimed by a statically-configured host. `forget_client` prunes stale client records the controller still remembers, refusing any MAC that holds a reservation or a live lease unless forced.

Structural health monitoring for a UniFi fabric. The `@sntxrr/unifi-fabric/topology` model's `check` method compares a declared topology against live `/stat/device` rows and reports the failures that outcome-based monitoring cannot see: a device expected on the wire that has silently fallen back to a wireless mesh uplink, attachment to the wrong upstream device, links negotiated below their expected speed, ports carrying error counters, and — the one with no equivalent elsewhere — ports that are down but have carried real traffic before, which identifies a run that used to work. An access point that loses its wired uplink does not fail; it meshes, keeps serving clients, and every uptime check stays green while latency quietly goes from sub-millisecond to tens of milliseconds and jittery. `uplink.type` flipping from `wire` to `wireless` is a boolean, so it is asserted exactly rather than thresholded. Read-only: never writes to the controller. Emits a flat Prometheus-ready metric series alongside the verdict, including for healthy devices, so alerts can fire on a series dropping to zero rather than on a document changing shape. Authenticates with an API key over `X-API-KEY`, which sidesteps the HTTP 499 that MFA-enabled SSO accounts return for password logins.

Auto-applier for docker image updates — pulls + restarts compose stacks with deny lists, cooling periods, and a per-run cap.

An autonomous, driver-free development loop for coding agents. You hand it an

Pi-hole custom DNS record management for swamp — list, add, delete, and

Comprehensive libvirt/virsh management — VMs, networks, storage pools,

Firecracker microVM lifecycle management via SSH + the Unix-socket REST API.

Manage a Technitium DNS server or cluster: zones, records, block/allow lists, cache, diagnostics, settings backup and restore, and cluster membership. Written after rebuilding a live authoritative pair, and shaped by what that exposed. `record_ensure` is an idempotent upsert Technitium's own API cannot express — add fails on an existing record, update fails on an absent one — and it works for every record type including TLSA, because the read and write field names for TLSA, SSHFP and URI are not the same names and are mapped per type rather than renamed globally. `settings_backup` includes every section by default, so it produces a backup a server can actually be rebuilt from. `cluster_init`, `cluster_join` and `cluster_state` cover the membership a settings backup can never carry, alongside the TLS listener and certificate it also omits — the three things that make a restored node look broken.

Docker container discovery + autoheal across a Proxmox cluster — SSHes to each PVE node, runs `pct exec <vmid> docker ps` on every docker-tagged LXC; the autoheal method restarts unhealthy containers within deny-list/cooldown/cap guardrails.

Hypervisor-layer VM inventory for TrueNAS SCALE, via the JSON-RPC WebSocket API.

Observability for a Pocket ID instance — the passkey-based OIDC provider. `health` is a cheap, admin-free probe that separates an unreachable host from a wrong API key from a key whose owner is not an admin, and reports version drift; it writes its result as data rather than throwing, so a failed run still leaves a truthful record. `sync` fans out one resource per user, OIDC client, group and API key, joins each user against their passkeys and their sign-ins and each client against its authorizations, then scores the whole instance into `instance.findings`: accounts with no passkey that therefore cannot sign in, public clients with PKCE disabled, clients nobody has authorized, empty groups, and the API key whose expiry will silently stop the sync. `syncActivity` reads a bounded window of the audit log on its own — Pocket ID has no date filter, so the window is applied by walking newest-first and stopping early, which makes a short window genuinely cheap. Read-only throughout.

Full lifecycle management of an Nginx Proxy Manager instance. `sync` fans out one resource per proxy host, redirection host, dead host, stream, access list and certificate, plus an instance rollup that flags expiring certificates, plain-HTTP hosts and domains claimed by more than one host. The `apply*` methods are idempotent — they match an existing object by its natural key (domain set, listening port, access list name) and update it in place, so re-running a workflow converges instead of accumulating duplicates. `setEnabled` and `delete` dispatch on an object kind and take a list of ids, so a batch is one fan-out call rather than a run per id. Let's Encrypt certificates can be requested over HTTP-01 or DNS-01 (wildcards included), renewed, or replaced with uploaded PEM files.

Read a running OpenWebUI instance and report how far its version has drifted behind upstream. Both methods are strictly read-only — this extension never upgrades the instance, edits its settings, manages users, or touches the container; it tells you an update is available and stops there. `sync` records what the instance reports about itself: version plus the feature flags that decide what automation can reach it, including `enable_api_keys`, which when false blocks every token-authenticated integration and cannot be worked around with any credential — reported as `null` rather than `false` when the instance withholds it, which OpenWebUI has done for unauthenticated callers since v0.9.6, because absent is not the same as off. `drift` compares the running version against the repo's published GitHub releases and reports status (`current`/`behind`/`ahead`), how many releases were missed, and which ones. Needs no credentials at all: both endpoints it uses answer before login. Versions are compared numerically because OpenWebUI's break lexical ordering in both directions — `0.8.12` sorts above `0.11.0` and below `0.8.9` as strings — so a string compare reports an instance eleven releases behind as up to date. An exhausted GitHub rate limit, a missing repo, and an unparseable running version are all raised as errors rather than folded into a reassuring `current`, and a release page that fills up before reaching the running version is reported as `truncated` rather than passed off as a total.

Read the swamp version a host or container is running and report how far it has drifted behind the published channel. Read-only — it never updates, installs, or restarts anything; it tells you a newer build exists and stops there. Fills the gap `swamp update --check` leaves: that answers for the binary invoking it, on the platform invoking it, which is no help when the install you care about is a pinned binary inside a container on another host. `sync` records what a target reports about itself — its version and, via `uname`, the artifact platform it runs on. `drift` resolves the newest build published on a channel for THAT platform and reports status (`current`/`behind`/`ahead`) plus the lag in hours. Targets are reached three ways: the local binary, `docker exec` (optionally through a named docker context, so one host can check a container on another), or SSH with BatchMode so an unattended run fails fast instead of hanging on a password prompt. The channel is resolved by a single HEAD against the `stable` alias, reading the resolved version out of its website-redirect metadata — one request rather than the ~90 MB the archive weighs — and the same pass verifies the platform-specific archive is actually fetchable, which is the precondition for pinning a rebuild to it. Versions are compared numerically because the build ordinal in `YYYYMMDD.HHMMSS.N` is not zero-padded: as strings `20260808.001107.10` sorts below `...9`, so a string compare reports a target one build behind as up to date the day a tenth build ships. `hoursBehind` is derived from the timestamps embedded in each version and is documented as a lag, not a count of missed builds — swamp publishes no release list, so the builds in between cannot be enumerated and this extension does not pretend otherwise. An unreachable target, an unparseable version at either end, a channel alias that answers without its redirect header, and a resolved archive that 404s are all raised as errors rather than folded into a reassuring `current`.

Desired-state local libvirt VM pool reconciler for Swamp. Defines, starts, removes, and publishes per-VM connection facts for downstream SSH/config models.

Send notifications through an Apprise API server, fanning out to Matrix, Discord, ntfy, email and 100+ other services

Resolve the current public IPv4 address and keep a 1Password field in sync with it via 1Password Connect

A catalogue of hosts and groups with hierarchical global/group/host metadata, resolved per host for use in workflows.

Manage Hermes AI agent model configuration — set the main model, configure auxiliary task overrides, and restart the gateway. Safe edit protocol: backup → edit → validate → restart.

Construction site timelapse capture and compilation via the Frigate NVR API. Captures periodic snapshots from any Frigate camera on a remote host via SSH, organises them into named phases, and compiles per-day and full-phase H.264 videos using ffmpeg inside the Frigate container.

Tautulli watch-history wrapper — snapshot per-movie and per-series play counts plus last-played timestamps from a Plex Tautulli instance, or one user's per-title history; the signal feeds keep/drop curation and recommenders.

Personalized Plex 'watch something new' recommender — reads a Plex Home user's all-time watched state (per-account viewCount/viewedLeafCount), builds a genre taste profile, ranks never-watched titles, and pins rotating age-appropriate collections to their home screen.

Administration of a TrueNAS SCALE host (25.04+) via its JSON-RPC 2.0 WebSocket API (wss://, API-key auth). Read/audit of apps + their port bindings, NFS/SMB shares + their host allowlists, services, network interfaces, and a service- exposure roll-up; plus a narrow, reversible mutating surface — flip an app port between published/exposed, and set NFS networks/hosts and SMB hostsallow/hostsdeny. Refuses any non-TLS endpoint by construction (TrueNAS revokes an API key sent over cleartext). Verify-first; no pool/dataset/user or service start/stop.

Plex Media Server control-API wrapper — trigger library refreshes on demand and capture per-section outcomes.