thomas
Technitium
Management of a Technitium DNS Server via its HTTP API — built-in ad-blocking control (enable/disable, temporary disable, allow/block list URLs), authoritative zone + record lifecycle, allowed/blocked custom domains, dashboard stats, DNS client + query-log debugging, cache flush, settings backup/restore, and security settings (admin web-service TLS certificate + DNSSEC validation).
Postgres Admin
Non-destructive PostgreSQL administration over a direct TCP connection (node-postgres). Read/audit of databases, roles, permissions, tables, connections, and extensions; plus data-safe admin DDL — create database/role, grant/revoke, rotate passwords, and an idempotent app_provision composite. Never reads or writes table rows; never DROP/TRUNCATE; no arbitrary-SQL passthrough.
Arcane
Management of an Arcane Docker instance via its REST API — GitOps sync setup, compose project lifecycle with validated mode-aware deploy, swarm stack deploy (render-validated, convergence-polled) + secret/config rotation, and volume/prune cleanup.
Woodpecker
Careful administration of a Woodpecker CI server over its REST API, authenticated with a personal access token. Onboard and configure repositories (enable, mark trusted, set timeout/visibility/approval), promote shared CI credentials to org- or repo-scoped secrets idempotently, inspect recent pipelines, and trigger runs. Mutations are additive or reversible (disable/secret-delete undo by re-running enable/set); secret values are write-only — supplied via a vault reference, sent once, and never read back or emitted.
Forgejo
Careful administration of a Forgejo (or Gitea) server over its /api/v1 REST API, authenticated with a scoped access token. Find-or-create organizations and repositories and converge their settings, run GitHub pull-mirrors (create via /repos/migrate, reconcile interval/visibility, queue immediate syncs), and audit every mirror's sync health. Mutations are find-or-create or reversible (archive/unarchive); there are no delete methods — a failed migration's empty shell repo is detected and reported, never auto-deleted. Mirror source credentials are write-only: supplied via a vault reference, sent once, never read back or emitted.