A one person lab, with uptime.
The three counters are read live from selflabs.org/stats.json, which a scheduled job regenerates from the GitHub API every Monday. Nothing here is typed by hand.
Self-hosted, self-custody, done by hand. No managed database without a reason, no deploy that depends on someone logging into a server, no private key inside a machine that talks to the internet.
What lives here is software that already broke in production, was fixed, and kept running. Signed firmware for a Bitcoin hardware wallet. A store that erases the buyer's personal data 72 hours after delivery. A personnel system with around 500 military police officers inside. Docker images that rebuild themselves every Sunday and burn no runner minutes when nothing changed, one of them past ten thousand pulls. Home automation on boards flashed here, with two of the fixes it needed now inside Tasmota itself.
When something went wrong, it is written in the repository that it went wrong, with a date and a file reference. That is traceability, not modesty.
| What it is | |
|---|---|
| Wallet Store | Hand assembled DIY hardware wallets, paid by Pix or Bitcoin with no account to create. Watch only xpub, every address derived locally, buyer data destroyed 72h after delivery by a scheduled command. |
| ALFERES | Personnel, leave, headcount and health for the Military Police of Espírito Santo. Live at a unit of around 500 officers, about 20 concurrent users at peak. Administering and commanding are two axes that never mix, and the scope is enforced in SQL with a recursive CTE over the chain of command, not on the screen. |
| Jade DIY | Off the shelf ESP32 boards turned into a working Blockstream Jade. Secure Boot signed firmware, a browser flasher so the owner updates alone, battery and touch logic for four boards. |
| Radar de Promo | Deals picked up from the channels it watches, rewritten by an LLM, sent with a real affiliate link to WhatsApp groups and a Telegram channel with nobody in the loop. When a group hits its member cap, the next one is created and the invite already going around points there. |
| PMES Rosters and ISEO | Monthly roster, daily roster and ISEO for a military police unit, printed on A4 letterhead exactly as the command signs it. Personnel arrive by service number from state systems instead of being retyped on three screens. |
| Escala e Folgas | Shift and leave scheduling. Authorization lives in the token's app_metadata, because user_metadata is writable by the user. |
| Crypto Tracker | On chain balance read from a pool of three Electrum servers, with a three source price cascade behind a circuit breaker. |
| Portal Cativo | Voucher authentication for OpenWrt routers. The uplink monitor only declares the internet down when three independent targets fail, and waits three cycles before waking the admin, because a network hiccup is not an outage. |
| selflabs.org | This lab's landing page. Astro, bilingual, Cloudflare Workers, numbers pulled from the GitHub API instead of typed. |
Parked, and labelled as parked: Atlas Logistics, which hides the real address of sender and receiver by splitting a delivery into hops between intermediaries, the final address only decrypted at the last hop.
Most repositories here are private, because they carry production systems for real organizations. The public write up of each one, with what broke included, is at selflabs.org.
| What it does | |
|---|---|
| Tasmota IR | Home Assistant integration to learn and send IR through any Tasmota board: climate for air conditioners, media player, fan, light and cover built from learned keys, one button per command. The emitter is a property of the appliance, set once, so it is never typed wrong. Under review for the HACS default store. |
| Tasmota for KinCony | Browser flasher for Tasmota builds that fit the KinCony AG8 and KC868-A16v3, where the official binaries lose the W5500 Ethernet or leave the 16 relays behind expanders nobody enabled. Plug in by USB-C, click Install. |
| Custom Branding | White label for Home Assistant: browser tab, login screen, loading logo and PWA icon, surviving every image update with nothing patched inside the container. |
| cateim/cups | CUPS in a multi arch image that turns a USB printer into an AirPrint network printer, rebuilt every Sunday and published only when a package moved.  |
| ai-usagebar-win | Claude and Codex plan quotas in the Windows tray, so the limit shows up before the agent goes quiet mid task. One .exe, no Rust toolchain. |
| DIY | 27 Portuguese guides on self-hosting and home automation, each one with the Portainer stack ready to paste. |
Not wall principles. Each one shows up in the code of at least three projects.
- GitOps with no manual step, on owned hardware. Push to
master, CI tests and builds, the Portainer webhook redeploys. The deploy job fails loud on any HTTP status outside 2xx. ARM64 builds run on a native runner, never under emulation, because the target is an Orange Pi 5 or an Ampere VPS. - Verification instead of trust. A check runs at the entrypoint, before the app server, and refuses to boot if the configured keys derive an address other than the expected one. A swapped xpub does not silently become a redirected payment.
- Privacy and authorization as executable code. A policy page protects nobody. The deletion is a scheduled command, and the permission scope is a SQL predicate.
- Every external integration fails one day. Price has a three source cascade with a circuit breaker. Balance comes from a pool of three servers. Nothing has a single upstream it cannot survive.
- What broke is written down. With a date and a file reference, in the repository where it happened.
- No managed service by default. Database, queue and storage run on owned hardware. When a third party service does enter, the reason is written in the repository.
- No deploy that needs a human. If shipping the new version requires somebody opening SSH, the work is not finished.
- No private key on the server. Anything touching Bitcoin runs watch only. Signing happens on the owner's device, off the machine that faces the internet.
- No promising what does not run yet. A project with no commits for months is labelled stable and quiet, not active. What is parked says it is parked.
Twenty pull requests accepted across nine repositories owned by eight different people, plus write access to somebody else's project.
- Blockstream/Jade: six pull requests accepted and nine commits in the official firmware of the Jade hardware wallet, from PR 260 in December 2025 to a user option that rotates the camera image 180 degrees in September 2026, because two units of the same board with the same camera module came out opposite ways up. Also swapped buttons, USB JTAG, Windows connectivity, battery and power logic across T-Display, T-Display S3 and Waveshare S3, and an i2c bus teardown fix. It is the firmware running on the Jade DIY boards. Most show as closed rather than merged because the maintainers land the changes through their own branch.
- Tasmota:
two pull requests merged in September 2026. One releases the UART0 console on
ESP32-S3, C3 and C6 when a template uses those pins, which was keeping the
Ethernet of KinCony boards down unless a USB cable was plugged in. The other
lets raw IR frames choose their emitter: on a board with several
transmitters, every learned raw code left through the first one while the
command still answered
Done. - Origo, by Oderico: another person's project, where I fix bugs with write access to the repository. It generates a BIP39 seed from human thrown dice, built after roughly 88 million dollars left Coldcard wallets through a build flag that lowered entropy unnoticed for five years.
- ai-memory, by Fábio Akita: three PRs accepted in June 2026. A native subcommand cut the Windows hook cost from around 735 ms to around 175 ms per tool call. The other two stopped deleting third party hooks and stopped polluting someone else's log. All with tests.
- FrankMD, Home Assistant and others: three more accepted in FrankMD, two fixes in a third party Home Assistant component, a translation in another, and a few smaller ones.
Under review right now: Tasmota IR into the HACS default store, large link preview cards in evolution-go, two more Electrolux fixes for Home Assistant, and a one click HACS install for an Intelbras alarm integration.
selflabs.org · store.selflabs.org · contato@selflabs.org · Vitória, Espírito Santo, Brazil
Leia em português em selflabs.org.