01 / Cockpit plugin
Browser-based RDP into a host's GNOME desktop from inside Cockpit, in four scenarios: a private headless desktop of your own, a virtual second monitor attached to your logged-in session, a mirror of the physical console for admins, and an allow-listed remote host. guacd is never published on a host port — traffic rides Cockpit's own HTTPS and reaches guacd through a local AF_UNIX relay that identifies the caller by SO_PEERCRED and binds every session to that uid, which closes Guacamole's default join-by-UUID screen-sharing path. Each connection runs a FreeRDP 3 bridge, because guacd's bundled FreeRDP 2 cannot negotiate to gnome-remote-desktop.
Python
Updated September 2026
repo: linux-cockpit-remote-desktop-guac
02 / Cockpit plugin
A Cockpit page that unlocks and fully manages a KeePass (.kdbx) or Password Safe v3 (.psafe3) safe on the host — browse, reveal, copy, add, edit, move, delete, attach and save, plus creating a new safe or adopting an existing one. Decryption happens only inside a short-lived server-side helper process, never in the browser; a revealed value re-masks on a countdown, and a save goes backup → temp file → fsync → atomic rename under the desktop clients' own lock files. Its design record is unusually explicit: a threat model, a hazard register, a residual-risk document, and a red-team log of thirty-one defects found in the program and its own tests, thirty of them fixed.
Python
Updated September 2026
03 / Lab platform
A containerised Samba Active Directory lab — five domain controllers, ten Linux clients and two RDP targets — with a Cockpit dashboard that manages it the way the classic Windows consoles do: users and computers, group policy, sites and services, DNS, FSMO roles and replication. Everything runs as rootful podman containers on one host over a static bridge network, and controller and client state is persistent, so a reboot or a container recreate never loses the forest. It also carries SYSVOL replication (Samba has no DFS-R), scale and soak tests, and integration with a network-services controller for CA, DNS forwarding, DHCP and time.
Python
Updated September 2026
04 / Cockpit plugin
A data-driven Cockpit plugin for browsing system-tuning setting schemas and named profiles, and comparing each one against the machine's live value, its persistent value and its own history. Adding a setting or a profile means editing one of two JSON files, not writing code. Without administrative access the page is read-only; where an apply is permitted, every change is journaled to a root-owned undo log and is revertible, and an hourly timer records a snapshot only when a value has actually changed.
Shell
Updated September 2026
repo: cockpit-os-tuner
05 / Cockpit plugin
A read-only Cockpit page showing the live state of both WireGuard instances on a host: the NetworkManager-managed host tunnel and a containerised wg-easy server. Peer health is the headline — handshake age classifies every peer as connected, stale or never connected, and the table sorts worst-first — alongside routing and NAT rules, service state and aggregate throughput. It writes nothing, and private and pre-shared keys are stripped on the host so they never cross the Cockpit channel at all.
Shell
Updated September 2026
06 / Cockpit plugin
A Cockpit page for a headscale control server, written against headscale 0.26.1 as the Canonical snap: tabs for users, nodes, pre-auth keys, API keys and advertised versus approved routes, plus start, stop and restart of the service. It is built around honest degradation — the most common state of a fresh install is "present but not usable yet", so the page reports a checklist of what it actually verified and picks one accurate diagnosis instead of spinning forever. Pre-auth key secrets are shown only as a short prefix and are never placed in the DOM.
Shell
Updated September 2026
07 / PowerShell
A long-running experiment in hosting web applications and APIs directly from PowerShell on HTTPListener, with an asynchronous listener → runspace → router → launcher flow so request handling can scale. The premise is a security one: parse and transform every piece of request data in PowerShell before anything executes, and require HTTPS and WSS throughout. It is published openly as a work in progress, and the README is candid about the trade-offs — PowerShell audit-log volume, and Python as the reasonable alternative.
HTML
Updated August 2026
08 / PowerShell
A second-generation PowerShell web host, started from a single WebHost.ps1 entry point. It carries a far larger written record than the original — an authentication architecture, admin menu setup, route reviews, an error-modal and error-reporting system, and a documentation index that ties them together.
JavaScript
Updated March 2026
09 / PowerShell
A general management environment for PowerShell: custom modules, vendored modules and lab deployment code, organised toward a cross-cloud deployment environment with parity between on-site, Azure, AWS, Linode and Cloudflare. Separate trees cover pfSense, an AT&T router, VMware ESXi, Proxmox, AWS, Windows, Linux and a web front end, against stated goals of IPAM, DNS records, PTR-based address reservation, VLAN and VXLAN automation, and RBAC. The README says plainly that not every script in the repository works and that the modules are the part to rely on.
PowerShell
Updated August 2025
10 / PowerShell
A PowerShell tool for monitoring and managing applications that listen on particular ports, with a web interface to start, stop and watch them. The applications it manages are described in a YAML file that can be edited through the browser, with Basic, NTLM and certificate authentication, a backup of every file it changes, and a self-reload when its own scripts are modified.
PowerShell
Updated April 2025
11 / Python
An infrastructure-portal exploration that builds the same idea on four Python web stacks side by side — Django, FastAPI, Sanic and Tornado — sharing a set of Jinja templates, static assets and an npm front-end folder. It is a comparison of how each stack handles routing, templating, WebSockets and persistence for an internal portal, rather than a finished product.
Python
Updated January 2025
12 / PowerShell
A PowerShell module for building HTML reports with charts and tables from templates. New-Report wraps a script block in which New-Chart and New-Table compose the output, so a few lines of pipeline turn process data into bar and column charts and a sortable table. The oldest project here, and still marked as in progress.
PowerShell
Updated August 2016