EXTENSIONS

Manage a Backblaze B2 application key via the Native API v4 — sync, create, and idempotent delete. The one-shot applicationKey secret is delivered straight to 1Password Connect and never written to a resource snapshot; create fails closed when no destination is configured.

Manage one Backblaze B2 bucket via the B2 Native API v4 — sync, create, update, idempotent delete, and get/set event notification rules — with first-class lifecycle rules so restic-pruned hidden file versions are actually deleted.

Audit a scanned Backblaze B2 account for hidden-version retention gaps, over-scoped or orphaned application keys, and public buckets. Read-only — it analyses the resources b2-account's scan already wrote and never calls B2.

A swamp vault backend for 1Password Connect — read and write secrets over Connect's HTTP API with a bearer token, so vault.get() works headless in cron, containers, and swamp serve without the op CLI.

Inventory a Backblaze B2 account — one read-only scan method emits a resource per bucket and per application key, plus a summary, via the B2 Native API v4.

Investigate why any swamp model or workflow is failing, without knowing anything about the domain it automates. Every method and workflow run leaves a @swamp/method-summary or @swamp/workflow-summary report behind as versioned model data, written on failure as well as success — so the full history of a target is already on disk with nothing extra instrumented. `investigate` resolves a target by name at call time, walks that history back to the boundary where it stopped working, and classifies the error into auth / unreachable / timeout / tls / rate_limit / not_found / config, each with a concrete next step. The distinction it exists to make is auth vs unreachable: a remote answering 403 is healthy and rejecting your credential (go to the vault), while a remote that never answers is a network problem (go to the host) — the two read almost identically in a notification and lead opposite ways. Unrecognised errors are reported as `unknown` verbatim rather than filed under a plausible-looking category. Read-only: it reads what previous runs recorded and never invokes the failing target.

Declarative DHCP fixed-IP reservations on a local UniFi controller (UDM / UDM Pro / UDM SE). `sync` reads every reservation the controller holds; `drift` compares a desired set against it without writing, reporting missing, mismatched, unmanaged, duplicate and DHCP-pool-overlapping entries; `apply` reconciles the controller to the desired set and supports `dryRun`. `device_drift` does the same read-only comparison for adopted hardware, which cannot hold reservations at all and is addressed through device config instead — the one surface `drift` is blind to. Reservations live on the legacy Network API as `user` objects carrying `use_fixedip`/`fixed_ip`. Adds TOTP/MFA login support, which the upstream @mgreten/unifi auth flow lacks — UniFi SSO accounts with MFA reject password-only logins with MFA_AUTH_REQUIRED. Catches the failure mode where a reservation silently never takes effect because its address is already claimed by a statically-configured host.

Send notifications through an Apprise API server, fanning out to Matrix, Discord, ntfy, email and 100+ other services

Resolve the current public IPv4 address and keep a 1Password field in sync with it via 1Password Connect

Drift detection and change proposal for GitOps-managed Tailscale ACLs. Extends @john/tailscale-acl with `drift` (compare the live tailnet policy against a policy.hujson file, ignoring comments and key ordering) and `propose` (stage an ACL change as a reviewable pull request, writing HuJSON verbatim so comments survive). Neither method writes to the tailnet — the GitOps pipeline stays the sole writer.

Sets aclsExternallyManagedOn on a Tailscale tailnet and verifies the change applied. The base @john/tailscale-settings update method strips this field via its zod schema and sends an empty PATCH, reporting success without changing anything; this method sends it explicitly and asserts the read-back value.

Manage a Scaleway Cockpit (Observability) data source — sync state, create metrics/logs/traces data sources, delete, and discover data sources and tokens in a region, via the Cockpit API with X-Auth-Token auth.

Manage a Scaleway DNS zone — create/delete the zone, sync records, list zones, and update (apply add/set/delete/clear record changes), via the global Domains & DNS API (/domain/v2beta1) with X-Auth-Token auth.

Manage a Scaleway Web Hosting plan — sync state, create, update, and delete hosting plans, and discover plans in a region, via the Web Hosting API with X-Auth-Token auth.

Manage a Scaleway VPC — sync current state, create, update and delete VPCs, and discover VPCs and Private Networks in a region, via the VPC API with X-Auth-Token auth.

Manage a Scaleway Transactional Email (TEM) sending domain — sync state, create, and delete domains, discover domains, and list sent emails in a region, via the TEM API with X-Auth-Token auth.

Manage a Scaleway Serverless Jobs job definition — sync state, create, update, delete, and run it (starting job runs), plus discover job definitions in a region, via the Serverless Jobs API with X-Auth-Token auth.

Manage a Scaleway Serverless Function — sync state, create, update, deploy, and delete functions, and discover functions and namespaces in a region, via the Serverless Functions API with X-Auth-Token auth.

Manage a Scaleway Serverless Container — sync state, create, update, delete, and redeploy a container, and discover containers and namespaces in a region, via the Serverless Containers API with X-Auth-Token auth.

Manage a Scaleway Secret Manager secret — sync/create/update/delete metadata, list secrets in a region, add new secret versions, and access secret values (returned only via a sensitive, vaulted output), via the Secret Manager API with X-Auth-Token auth.

Manage a Scaleway Container Registry namespace — sync state, create, update, and delete namespaces, and discover namespaces in a region, via the Registry API with X-Auth-Token auth.

Manage a Scaleway Managed Database for Redis cluster — sync state, create, update, and delete Redis clusters, and discover clusters in a zone, via the Redis API with X-Auth-Token auth.

Manage a Scaleway Managed Database (RDB) instance — sync state, create, update, and delete PostgreSQL/MySQL instances, and discover instances in a region, via the RDB API with X-Auth-Token auth.

Manage a Scaleway Public Gateway — sync current state, create, update, delete, and discover Public Gateways in a zone, via the zoned Public Gateway v2 API with X-Auth-Token auth.