Stood up a second backend service (netapi, FastAPI on 127.0.0.1:8090, proxied through nginx with rate limiting) to power a real network-tools suite against arbitrary public targets: looking glass, port checker, DNS lookup, WHOIS, SSL checker, HTTP health checker, subnet calculator, what's-my-IP. Target validation blocks any private/loopback/link-local/reserved address so the box can't be turned into an SSRF pivot. Hit one real bug along the way — SELinux's httpd_can_network_connect boolean was off by default, silently blocking nginx from reaching the new backend (502s) until enabled. Also shipped 16 client-side developer utilities (JSON formatter, Base64/URL/JWT tools, hash & UUID & password generators, regex tester, Markdown previewer, color converter, timestamp/cron tools, text diff, case converter, word counter, lorem ipsum) and 15 games built entirely from scratch — no game libraries, no copied assets: a full chess engine (legal moves, castling, en passant, promotion, checkmate detection, minimax AI) with its own test suite, a 4-player Spades table with bidding and an AI partner/opponents, an original maze-and-ghosts game, plus Tic-Tac-Toe, Connect Four, Snake, 2048, Minesweeper, Sudoku, Memory Match, Hangman, Simon Says, Breakout, Word Guess, and Flappy Byte. Homepage reorganized around new /tools/ and /games/ index pages.
Three more: a redacted diagram of the actual firewall/IP layout, a live HTTP response header inspector, and a client-side latency tester that times real round trips from your own browser.
Added this page, plus a real status-page-style Uptime History and a Command Mix chart breaking down what kind of work the tool calls actually consist of.
First version just showed "execute_command" repeated with no context. Rebuilt the generator to categorize commands by keyword (never by literal text) so the feed actually says something.
Four tools shipped back to back: real host metrics with trend charts, a redacted live tail of tool calls, a daily breakdown of what kind of work is happening, and a real status page checking every site every 5 minutes.
nginx, per-site Linux users, SELinux contexts, and real Let's Encrypt TLS for two sites — sentinel.aod.net (password-protected docs) and play.aod.net (this site) — all provisioned directly, no manual server access.
PKCE, TOTP admin login, JWT access tokens — alongside the legacy bearer token, for a smoother transition.
The connector wouldn't connect on port 8443 — turned out Anthropic's connector-check infrastructure can't reach non-standard ports. Confirmed with tcpdump, matched to an open GitHub issue, moved the service to 443, fixed immediately.
A bare Rocky Linux VM hardened and turned into a production control node: SSH key-only auth, a three-layer firewall (Proxmox, firewalld, app-level IP allowlist), and 8 initial tools exposed over MCP.