Building Sovereign Software In The Open.

Managing heterogeneous cloud droplets and on-premises hypervisors without heavy Kubernetes overhead or fragile bespoke shell scripts requires a dedicated, lightweight control plane. We open-sourced theta42/native-ops, a generic Infrastructure-as-Code (IaC) and fleet orchestration engine written in Go that manages cloud virtual machines (DigitalOcean) and bare-metal hypervisors (Proxmox VE KVM) with automated cloud-init Incus bootstrapping.

Built under a strict immutable-by-policy architecture, native-ops handles multi-level orchestration: declarative Incus/LXC container services and multi-tenant template instances, persistent storage volume management with security.shifted=true uid/gid shifting, live cgroup CPU/memory resizing, and reconciling dynamic Caddy edge reverse proxy routes and ACME TLS handshakes. It runs 100% runner-driven from CI/CD (GitHub Actions / Gitea Actions) or local CLI with zero long-running host background daemons.

In sovereign homelab and enterprise clusters running 50+ VMs and LXC containers, high discovery event rates expose brutal browser edge cases. On our Proxmox test clusters, regular discovery polls rewrite last_seen across 41 LXC containers, 12 VMs, and 3 hypervisors, publishing model:Resource:update websocket events to every open client. Under this real-world load, the Directory UI was ballooning to over 4GB of RAM until Chrome crashed the renderer process.

Through systematic profiling with Chrome DevTools and Node WeakRef harnesses, we cleared jq-repeat of suspicion—confirming 0 of 500 DOM rows retained after 9 replacement cycles and forced garbage collection. The culprit was two-fold: an unbounded app.notify history buffer in @simpleworkjs/frontend that re-collapsed its entire event array on every tick ($O(N)$ on an ever-growing history), and a Font Awesome SVG-with-JS MutationObserver that choked on high-velocity DOM churn (freezing at 776MB without converting a single icon). We capped event retention, replaced the observer with pure webfont CSS, and released Theta Suite v3.41.0 & v3.42.1 with corrected OpenBao vault resource seeding.

jq-repeat was born out of a desire for AngularJS's intuitive ng-repeat declarative list templating without the baggage of monolithic 500KB client-side frameworks. In versions 2.2.3 and 2.2.4, we optimized high-frequency DOM manipulation by batching element insertions into isolated document fragments during rapid collection updates, significantly reducing layout recalculations and browser paint thrashing.

To eliminate long-term security debt across our open-source supply chain, we also migrated the build and release pipeline to npm Trusted Publishing (OIDC) via GitHub Actions in PR #23. By minting short-lived cryptographic tokens directly linked to GitHub repository provenance, we permanently eliminated static, long-lived npm auth secrets from CI environments while ensuring zero-dependency security audit hygiene.

Maki's autonomous Plan Mode was designed to give developers granular, phased control over multi-file AI coding refactors. However, the ready-plan review modal lived exclusively inside the terminal TUI as a local Ratatui widget (plan_form.rs). When orchestrating Maki sessions remotely via Web UI tunnels or headless server sessions, web operators were blind to plan completion and unable to approve or refine steps.

In PR #5, we bridged this gap by wiring full Plan Mode telemetry into the maki-remote event stream. We introduced Server-Sent Events (SSE) plan and plan_cleared frames, reconnection state snapshots, and a dedicated POST /plan REST endpoint. The browser Web UI now renders a native plan control card allowing operators to inspect generated plans, toggle parallel task execution, and dispatch Refine, Implement, or Clear-and-Implement directives directly over the wire. State diffing is integrated into the core event loop tick via App::take_plan_change(), ensuring zero-latency remote convergence.

Running local LLMs with 32k+ context shouldn't require renting cloud A100s or spending $10,000 on enterprise accelerators. We engineered a 32GB GDDR6 inference cluster inside a repurposed HPE ProLiant DL380p Gen8 server by pairing a desktop RTX 2060 12GB with two decommissioned NVIDIA CMP 50HX crypto mining cards (10GB each).

Mining silicon famously lacks display outputs and has aggressive power configurations drawing ~240W at idle. Through custom MSI VBIOS flashing, hardware strapping, and an aggressive Linux driver P-state governor, we slashed idle power draw down to a near-silent ~33W.

We compiled llama.cpp with CUDA 12 and NCCL tensor parallelism across all three Turing GPUs, achieving 325–500 tok/s prompt prefill speeds. To complete the stack, we wrote ollama-proxy.py—an intelligent API gateway offering dynamic reasoning/thinking control (think_budget=0 fast chat vs full dynamic chain-of-thought) compatible with Ollama, OpenAI, and Anthropic tooling.

AI coding assistants shouldn't require bloated, memory-hungry Electron wrappers that trap your codebase in closed clouds. Maki is a native, lightning-fast Rust-based AI agent extendable via Neovim-style Lua plugins and the Agent Client Protocol (ACP) for modern editors like Zed.

We expanded Maki with full remote control capabilities and a dedicated Web UI to monitor, prompt, and manage autonomous coding sessions from any browser on the local network or Tailnet. We eliminated latent race conditions in async control tunnels so commands execute synchronously without synthetic pauses, hooked dynamic provider scripts into ~/.config/maki/providers/, and optimized local model routing.

Theta Suite v3.21.2 solidifies our multi-site deployment tier. When running decentralized edge nodes across disparate physical sites or homelabs, OpenLDAP syncrepl replication must converge reliably without manual intervention.

This release introduces live LDAP replication convergence monitoring, automated site join preflight validation, and a runtime toggle for mDNS local discovery—allowing fresh nodes to bootstrap without relying on public DNS or central SaaS brokers.

Theta Directory v2.24.2 resolves subtle synchronization race conditions in hub-and-spoke topologies. Spoke instances now verify replication status directly against the primary hub before executing write actions.

Features token cache TTL optimizations, fail-soft join guards for spoke node onboarding, and real-time replication health badges on the admin status dashboard.

Jump Host v3.3.4 sets THETA_MESH_ENDPOINT by default across automated host installation scripts, resolving edge cases where remote nodes roamed across multi-homed interfaces.

Eliminates transient route flapping when bringing WireGuard mesh tunnels down during configuration changes, and finalizes unified shell navigation across the entire suite.

Theta Agent v2.8.2 adds a configuration toggle for LAN mDNS discovery and conditional local /etc/hosts overrides.

This enables edge appliances and development laptops to discover local Theta Directory instances on air-gapped subnets without configuring external split-brain DNS servers.

Merging PR #254 introduced native multi-site topology support to Theta Suite without the complexity of distributed consensus protocols.

Spoke instances handle local reads and ingress authentication at the edge while proxying mutation calls directly to the central hub. OpenBao secrets and TLS certificates synchronize automatically across all spoke locations over encrypted WireGuard backplanes.

Shipped real-time notification toasts and an interactive notification center bell directly inside Theta Proxy's web interface.

Admins and operators receive live UI alerts whenever new wildcard SSL certificates are issued, DNS API challenge credentials rotate, or backend route status changes occur—backed by Redis pub/sub WebSocket channels.

Distributing sovereign endpoint software to enterprise Windows desktops often triggers annoying SmartScreen security warnings unless binaries are cryptographically signed with trusted EV certificates.

PR #25 integrated Microsoft Azure Trusted Signing directly into the Go cross-compilation pipeline. Windows binaries and system tray packages are signed automatically upon GitHub release creation, enabling one-click installation across corporate Windows fleets.

Expanded Theta Directory's hardware inventory engine with native support for Hewlett Packard Enterprise Integrated Lights-Out (HP iLO) management processors.

Theta Directory discovers iLO BMC controllers across LAN subnets, extracts server chassis serials, power metrics, and thermal sensor readings, and allows authorized administrators to execute hardware resets and power cycling directly from the Directory UI.

Replaced periodic frontend polling with a high-speed, bidirectional WebSocket event bus. Every route alteration, DNS challenge state, and host toggle immediately triggers targeted model events in connected browser sessions.

Introduced granular per-socket event authorization, ensuring operators only receive updates for hosts and domains they have explicit permission to view.

A major architectural evolution: migrated Jump Host's routing plane out of containerized Docker bridges directly into host-level Linux network namespaces.

Transformed Jump Host into a high-performance roster-driven WireGuard router capable of line-rate mesh packet forwarding and dedicated per-device internet egress rules.

Initial commit of theta42/theta-agent. We set out to replace complex configuration management scripts with a single cross-platform Go binary that connects sovereign machines to Theta Directory.

The agent automatically generates WireGuard keypairs, establishes encrypted point-to-point tunnels, and listens for gated fleet actions (wireguard, configure_ldap, service_control, reboot) while strictly prohibiting arbitrary remote shell execution.

Storing DNS provider API tokens in Redis or local environment files is a significant security risk if an edge container is ever compromised.

PR #200 moved all DNS API keys (Cloudflare, Porkbun, DigitalOcean, DuckDNS) into OpenBao (open-source HashiCorp Vault fork) KV-v2 secret storage. Credentials are retrieved ephemerally during DNS-01 ACME challenges and never touch persistent disk.

Released @simpleworkjs/bao-conf, a lightweight OpenBao and HashiCorp Vault configuration provider for modern Node.js backends.

Seamlessly plugs into @simpleworkjs/conf to fetch secret trees at application startup with automated token renewal and fail-soft development fallbacks.

Completed full UI unification across all three core applications: Theta Proxy v1.4.0, Theta Directory v1.5.0, and Jump Host v1.3.0.

Every application now shares a byte-identical design shell, unified client-side group gating, cached OIDC authentication promises, and standardized navigation across dark obsidian and warm gold design tokens.

First commit of theta42/jump-host: an intelligent SSH bastion and jump host designed specifically for homelabs and sovereign infrastructure.

Automatically polls UniFi network controllers, Proxmox VE hypervisors, and Docker sockets to present an inventory graph of every online host, enabling point-and-click SSH terminal access behind directory single sign-on.

Rolled out the full suite of SimpleWorkJS packages: @simpleworkjs/orm, @simpleworkjs/orm-identity, @simpleworkjs/backend, and @simpleworkjs/frontend.

Designed to strip the bloat from modern Node.js web services, offering lightweight schema modeling, session handling, and clean RESTful API construction without thousands of transitive dependencies.

Merged PR #8 bringing full TypeScript definitions to model-redis. Provides strongly-typed schema models, autocomplete for relationship fields, and enables arbitrary instance properties on Table types.

Resolved subtle recursion bugs in circular model relationships and integrated full Jest test automation directly into GitHub Actions CI.

Merged PR #30 and PR #32 to release the landmark v2.0.0 update of linux-user (published as linux-sys-user on NPM).

Normalized the error contract across both callback and Promise interfaces. Crucially introduced unprivileged non-root read methods (getUsers, getUserInfo, getGroups), allowing daemon monitoring services to inspect system accounts without elevating to root. Complete TypeScript type definitions included.

First commit of theta-env (later renamed theta-suite). The goal: bundle an OIDC/LDAP identity provider, dynamic ingress reverse proxy, and Linux enrollment into a single ./setup.sh Docker Compose environment.

Proved that full digital sovereignty and enterprise-grade single sign-on can be provisioned on bare metal in under 5 minutes.

Merged native per-host authentication into Theta Proxy using Lua at the OpenResty edge.

Any internal HTTP application—regardless of language or whether it has built-in auth—can now be gated behind Theta Directory single sign-on with group access control in one toggle.

Added native TTL support to model-redis schema definitions.

Enables ephemeral database entities (such as session tokens, authentication challenges, and telemetry caches) to automatically expire in Redis without needing manual background cron sweeping jobs.

Upgraded the underlying Redis driver to ^6.1.0 and engineered generic orphan key detection.

Safely audits and prunes orphaned index keys, secondary index sets, and dangling relationship pointers across high-traffic production databases without risking data loss.

Deployed production toolkits for autonomous AI coding agents using the Model Context Protocol (MCP) and custom skill runtimes.

Included tasmota-skill for IoT energy monitoring and relay control, porkbun-skill for programmatic DNS zone automation, minecraft-monitor-skill for real-time RCON server health, and openclaw-rag-skill for local codebase knowledge retrieval.

Refactored Theta Proxy's internals to use our standardized open-source primitives. Replaced ad-hoc configuration loading with @simpleworkjs/conf (PR #86) and migrated database access to the standalone model-redis ORM package (PR #87).

Significantly improved test suite execution speed and enabled seamless CI/CD validation.

Shipped version 0.3.0 of model-redis: added 100% Jest test coverage across all schema validation and index lookups, eliminated critical edge-case serialization bugs, and added CommonJS synchronous setup support (setUpTable).

Deployed GitHub Pages automated documentation to establish the library as a standalone open-source standard.

Shipped version 26.1.2 of the CoreJourney world engine, introducing performance optimizations for massive mob farms and clan battles.

Deployed the live telemetry web platform (corejourney.org) powered by SQLite WAL mode to track real-time kills, player lifespans, and death bans, alongside the community lore wiki (wiki.corejourney.org).

Completed the world modernization to Minecraft version 1.21.4 without resetting player builds or map history.

Migrated 1.5 TB of world chunks to redundant Crucial MX500 SSDs in a dedicated ZFS mirror pool over an internal 10GbE fiber link, eliminating chunk loading lag during peak player activity.

After 5 years of continuous hardcore survival, the original creator announced the permanent shutdown of CoreJourney on its 5th anniversary. For thousands of players who had built empires and survived real death bans, a world was about to vanish.

William Mantly (tux4242) stepped forward with the #SaveCJ pledge to preserve the community. World files were transferred over 10GbE fiber directly to sovereign HPE DL380 enterprise servers in his homelab—with a strict guarantee of 0% pay-to-win.

Merged full automated wildcard SSL certificate management using DNS-01 ACME verification.

Integrated Cloudflare and DigitalOcean API adapters, dynamic challenge TXT cleanup, and automatic renewal timers into Theta Proxy so wildcard certificates never expire unexpectedly.

First commit of @simpleworkjs/conf: born from the frustration of over-engineered Node.js configuration frameworks.

One require statement deep-merges a conf/base.js with per-environment overrides and a gitignored secrets.js based on NODE_ENV, with zero DSLs and zero bloat.

Merged community PR #24 making the shell argument optional when creating system users, defaulting cleanly to the system login shell.

Released v1.2.0 with modern NPM dependency updates, verifying compatibility across modern systemd distributions and Node.js 20 LTS runtimes.

Initial release of the codeland-ecosystem runner manager and CRunner daemon. Long before modern cloud sandboxes became common, we engineered a self-hosted serverless code execution platform supporting 24 programming languages.

Featured pre-warmed container pools for instant sub-second cold starts, interactive WebSocket terminals, and isolated LXC sandboxing on a frugal $40/month hardware footprint.

Merged PR #2 adding dynamic key prefix isolation to model-redis.

Enables multiple microservices, testing environments, or multi-tenant applications to safely share a single Redis instance without key collisions by scoping all keys and indexes under a configured namespace.

Shipped official TypeScript type declarations for linux-user, bringing IDE autocomplete and compile-time type safety to Linux system administration.

Added support for passing native JavaScript Date objects directly into addUser for setting account expiration dates without manual date string formatting.

Major security overhaul: replaced vulnerable shell command string execution (exec) with structured argument array execution (spawn), completely neutralizing command injection vulnerabilities.

Merged PR #21 adding account expiration date enforcement via chage -E and comprehensive unit tests for SSH public key verification.

January 9, 2022 (commit 4d34eb3): Initial commit of wmantly/model-redis.

Extracted the ultra-fast Redis data modeling layer originally developed for Theta Proxy into an independent, zero-bloat NPM package. Provides schema validation, index tracking, secondary key queries, and JSON serialization with only a single dependency on the native redis driver.

Merged wildcard hostname pattern matching and memory caching for high-throughput socket routing.

Eliminated repetitive database reads on incoming HTTP connections, allowing Theta Proxy to handle thousands of requests per second on budget hardware.

Initial commit of wmantly/p2psub. Designed as a pure peer-to-peer pub/sub messaging engine in Node.js with zero external dependencies.

Features automatic peer reconnection, heartbeat gossip, and RegExp topic subscriptions for building decentralized tools without central message brokers.

Initial commit of theta42/theta-directory. Built to replace bulky enterprise LDAP management tools with a lightweight, modern web interface.

Enables administrators to manage users, groups, and permissions over clean REST endpoints without complex LDAP schema tooling.

Shipped the first browser-based graphical user interface (PR #27) and the foundational REST API v1 (PR #28) for Theta Proxy.

Operators can view active host routes, monitor backend health, and provision new proxy destinations directly from the browser.

Transitioned Theta Proxy from static configuration files to Redis as a dynamic central backplane.

Introduced the hostsCLI command-line utility, allowing routes to be inspected, added, or modified instantly across multiple proxy nodes.

Modernized asynchronous control flow by removing external Bluebird dependencies in favor of native ES6 Promises and async/await.

Merged PR #4 expanding API coverage for granular shell switching, secondary group membership, and system account inspection.

Upgraded the proxy daemon for Node.js 12 LTS with native async/await patterns and dependency vulnerability updates.

Integrated Linux Pluggable Authentication Modules (PAM) for secure local system account verification.

Added cryptographic verification of OpenSSH public keys (verifySSHKey) and direct automated injection into ~/.ssh/authorized_keys with strict POSIX permissions (0600 / 0700).

Engineered in February 2018 to power automated host provisioning for early Theta 42 infrastructure prototypes.

February 5, 2018 (commit 83a1ef3): William Mantly commits the initial prototype of Theta Proxy.

Born out of the frustration of having to reload Nginx and drop active connections every time a new microservice or container was added, the project began as a quest for a genuinely zero-reload dynamic ingress proxy for sovereign infrastructure.

November 2017: Theta 42, INC was officially incorporated with a clear ethos: engineering enterprise-grade, sovereign software that organizations, developers, and homelabbers can truly own.

Rejecting closed cloud lock-in, recurring API taxes, and intrusive telemetry, Theta 42 commits to building open, air-gappable infrastructure and community-first tools for the long haul.

Angular 1.x introduced developers to the magic of ng-repeat, but importing an entire monolithic framework just to synchronize an array of items with the DOM was unnecessary bloat.

We built jq-repeat to bring reactive, declarative list rendering to jQuery and vanilla JS. It automatically synchronizes the DOM when arrays are mutated via push, pop, or splice, with granular animation hooks (__put, __take, __putUpdate).

December 11, 2014 (commit 4599194): The foundational first commit of wmantly/linux-user (published as linux-sys-user on NPM).

Created to provide a reliable, zero-dependency Node.js interface for managing Linux system users, groups, and SSH authorized keys directly from JavaScript. Designed with clean unprivileged read-only calls and root privileges strictly required only for state mutations.