workspace-services

sonarr, radarr and bazarr, hardened for the estate path: non-root images mounting the media library, and their Project Intent

Immich, hardened for the estate path: server, machine learning and its Postgres as non-root images, mounting the media library, and its Project Intent

Kotlin/Spring API for agent workspaces, sessions, and credentials.

Student test site mirroring tribelt.nl to measure SEO and AI-agent discovery (made with Tribelt's permission)

Karakeep, hardened for the estate path: karakeep with its state in Garage, chrome and meilisearch images, and its Project Intent

Overleaf Community Edition, hardened to run as www-data under a read-only root filesystem, delivered as the Project overleaf

hindsight agent memory, hardened for the estate path: api/worker, control plane and TEI images, and its Project Intent

The estate's identity provider: one OIDC sign-in for every app, Clients from deploy-kit, groups and app roles, admin portal.

Kotlin/Spring authentication and authorization API for jorisjonkers.dev.

n8n on the estate: a first-party image with the OIDC sign-in hooks, and its deploy-kit project.

Grimoire: self-hosted D&D 5e table companion. Go API, Vue PWA, rules automation, live play, MCP.

Agent runtime images and deploy-bundle metadata.

Knowledge base API, MCP endpoint, and ingest worker for the agent platform.