EXTENSIONS

Manage a Technitium DNS server or cluster: zones, records, block/allow lists, cache, diagnostics, settings backup and restore, and cluster membership. Written after rebuilding a live authoritative pair, and shaped by what that exposed. `record_ensure` is an idempotent upsert Technitium's own API cannot express — add fails on an existing record, update fails on an absent one — and it works for every record type including TLSA, because the read and write field names for TLSA, SSHFP and URI are not the same names and are mapped per type rather than renamed globally. `settings_backup` includes every section by default, so it produces a backup a server can actually be rebuilt from. `cluster_init`, `cluster_join` and `cluster_state` cover the membership a settings backup can never carry, alongside the TLS listener and certificate it also omits — the three things that make a restored node look broken.

Observability for a Pocket ID instance — the passkey-based OIDC provider. `health` is a cheap, admin-free probe that separates an unreachable host from a wrong API key from a key whose owner is not an admin, and reports version drift; it writes its result as data rather than throwing, so a failed run still leaves a truthful record. `sync` fans out one resource per user, OIDC client, group and API key, joins each user against their passkeys and their sign-ins and each client against its authorizations, then scores the whole instance into `instance.findings`: accounts with no passkey that therefore cannot sign in, public clients with PKCE disabled, clients nobody has authorized, empty groups, and the API key whose expiry will silently stop the sync. `syncActivity` reads a bounded window of the audit log on its own — Pocket ID has no date filter, so the window is applied by walking newest-first and stopping early, which makes a short window genuinely cheap. Read-only throughout.

Observability and safe operational control for a TP-Link Omada controller. One fan-out sync reads every site, device, client, switch port, gateway WAN and SSID into addressable resources, and writes a drift record comparing configuration — not telemetry — against the previous sync, so an idle network reports nothing and a firmware bump, a re-addressed WAN, a disabled PoE port or a device that stopped answering each report themselves. Talks the supported Open API in client-credentials mode, with the controller's own web API as an optional fallback for reads the Open API does not expose. Writes are limited to reversible operational actions — reboot, PoE, client block, reconnect, LED, locate, firmware — each fanning out over a list in one controller session.

Full lifecycle management of an Nginx Proxy Manager instance. `sync` fans out one resource per proxy host, redirection host, dead host, stream, access list and certificate, plus an instance rollup that flags expiring certificates, plain-HTTP hosts and domains claimed by more than one host. The `apply*` methods are idempotent — they match an existing object by its natural key (domain set, listening port, access list name) and update it in place, so re-running a workflow converges instead of accumulating duplicates. `setEnabled` and `delete` dispatch on an object kind and take a list of ids, so a batch is one fan-out call rather than a run per id. Let's Encrypt certificates can be requested over HTTP-01 or DNS-01 (wildcards included), renewed, or replaced with uploaded PEM files.

Read-only VM inventory for standalone VMware ESXi hosts, shaped for planning a migration off one and decommissioning it. Collects over SSH from vim-cmd, esxcli and the guests' own .vmx files — virtual hardware, storage with provisioned vs allocated bytes, in-guest identity (hostname, addressing, DNS, default route, mounted filesystems) via VMware Tools, live usage for rightsizing, and the complete vmx verbatim — plus a warnings list of what blocks a clean rebuild. One fan-out inventory method does the whole host in a single SSH round trip.

Drive an existing Ansible playbook from swamp. `check` runs --check --diff and never mutates, so changed=0 across every host is a machine-readable 'already matches its declaration' gate; `apply` runs for real. Parses the PLAY RECAP into typed per-host tallies for CEL, accepts inventory as content so a workflow can build it from model data instead of a render script, and keeps vault and sudo passwords in 0600 temp files rather than argv.

Code-reading methods for @shrug/forgejo — map a repository's file tree, read individual files, and snapshot every matching text file into one reviewable data blob. Turns a metadata-only forge node into a source for code review and IaC analysis.

Watch-activity methods for @keeb/jellyfin — pull per-session events from the Jellyfin Playback Reporting plugin, plus a core-API watch-history fallback, for building watch-time dashboards.

Monitor a single user's Hardcover reading activity via the Hardcover GraphQL API — profile, the whole tracked library (shelf status, rating, review, pages, read dates), and individual reading sessions (start/finish dates, progress). Read-only, token-authenticated.

Monitor a single user's Letterboxd film diary via their public RSS feed — one record per logged watch (watched date, star rating, like/rewatch flags, film title/year, TMDB id, poster, review). No credentials required; the feed is a rolling window, so run on a schedule to accumulate history.

Monitor a self-hosted Audiobookshelf server — libraries, audiobooks/podcasts, listening progress, listening sessions, and aggregate listening statistics — via the Audiobookshelf REST API.

Monitor a single user's Spotify listening activity via the Spotify Web API — recently-played tracks (accumulate over time), plus top-artists and top-tracks rankings — with built-in OAuth helpers to obtain the refresh token.

Monitor Fly.io organisations and applications — discover apps, machine/deploy state, volumes, snapshots, events — and take safe volume snapshots, via the Fly Machines API.