The computer at home runs everything: T3, my notes and the scheduled jobs. If it struggles, everything stops. I also have sites on Cloudflare, some of them private and locked, and if one went public by mistake I’d only find out late. So I set up two jobs, both read-only.
Machine health: every morning
At 6:45 am a small script checks:
- Disk space and memory.
- Services: anything that failed, and whether the ones that must be running really are.
- Updates: whether any are waiting, or the machine needs a restart.
- Backups: how recent the last notes and code backups are.
It writes the result to a small status file. My morning brief reads it 45 minutes later, and if something’s wrong it shows one card listing every problem in plain words. If all is well, it says nothing.
A restart never happens on its own. The brief proposes it, and Claude restarts the machine after my OK, when no thread is running.
The guard
On 3 November, while I was setting up this site, one command published it at a public address before I’d locked it, and it stayed open for about two and a half minutes. I wrote about that mistake in the post on locking the site. Because of it, I added the guard on 8 November.
The guard regularly reads the settings that publish my sites on Cloudflare and compares them with a list I’ve approved. If something unexpected changes, it messages me and adds a card to my morning brief. It checks the settings, not whether each lock actually stops a visitor; that’s a separate test.
The script only reads Cloudflare’s settings. Fixing is my job.
How to set them up
The machine check
Write me a read-only script that checks this computer: free disk space, memory, failed services, whether the services in this list are running: [the list], whether updates are waiting or a restart is needed, and how old the last backups are. It writes a JSON status file with allOk, finishedAt, and problems in plain words. It must never change or restart anything. Then create a systemd timer that runs it every morning.
The guard
First, create a Cloudflare API token with read-only permissions.
Write me a read-only guard for my Cloudflare account. For every domain it collects: DNS records that point somewhere, Tunnels and the addresses they route, Access apps, and Workers routes and workers.dev addresses. It compares them with an approved.json file I sign off. If anything isn't in it, an Access app was removed, or it couldn't read something, it writes the problems to a status file and sends me an alert. It must never change anything in Cloudflare. Write down which read permissions the token needs, and run it on a timer.
The first time, have it list what it collects right now, and review that yourself before it becomes the approved list.
Make the brief watch them
Add a line to your morning brief’s rules: read both status files, and show one card if allOk is false, or if a file is missing, unreadable or older than it should be.
What I learned
- Silence has to mean something. The brief says nothing when all is well, but it does speak up when the status file itself is old, because a check that didn’t run can’t report a problem.
- The guard doesn’t fix. It reads and reports, the same rule as the homelab check.
- A small mistake is worth a guard. It was only two and a half minutes, but since then something checks regularly so I don’t have to.
Tools
Next in the series: the drop folder.