Skip to content
Mark Warren
Menu

All work

Operations and security

Monitoring and security for a solo-run fleet

Tests on every push, a morning health check that proves the whole path still works, watchdogs that make no model calls, and guardrails on the coding agents themselves.

How it fits together

  1. Inputs

    • Every push

      Each site repository runs the same QA template on every push.

      • GitHub Actions

    • Every morning

      A scheduled dispatcher starts the health check at a fixed local time.

      • n8n

  2. Engine

    Checks as code

    One canonical QA template synced into each repository by script, and one health check for the whole fleet.

    • GitHub Actions
    1. Before deploy

      Lint, type checks, tests, build, dependency audit, secret scanning, and static analysis.

    2. After deploy

      Wait for the host to report the new commit, then smoke, header, link, accessibility, and performance checks.

    3. Prove the whole path

      Signed test submissions travel the full path through the chat agents and lead forms, built so a visitor can never use them to hide a real lead.

  3. Outputs

    • One morning report

      Site status, health endpoints, certificates, hosting, upstream status pages, and failed or silent workflows in one message.

    • Watchdog alerts

      Spend, capacity, security advisories, and domain changes, posted only when something needs attention.

Guardrails

  • A heartbeat raises an alert if the morning report does not arrive
  • Watchdogs make no model calls
  • Coding-agent hooks block secrets and destructive commands
  • Backups are verified by restoring them

The problem

One person runs many sites, workflows, and agents. Nobody is watching a dashboard, so a quiet failure can go unnoticed, and a page returning success does not prove that a lead form or a chat agent still delivers.

What I built

  • A per-push QA template for every site repository, with security scanning before deploy and smoke and accessibility checks after.
  • A morning health check that covers the fleet, the hosting, and the workflows, and proves the submission paths with signed test submissions.
  • Watchdogs for spend, capacity, security advisories, and domain registration that make no model calls and alert only when something fires.
  • A written security plan, incident playbooks, and a quarterly review that restores backups to prove they work.
  • Hooks on the coding agents that refuse to write secrets or run destructive shell commands, and warn when a working tree holds someone else's changes.

How I built it

GitHub Actions runs the QA template and the health check, and n8n schedules the morning run and the watchdogs. Every check reads through limited, read-only access where it can. Reports go to the operator only, by email and Telegram, and never to a client.

What it shows

I build systems that report on themselves, so a small team finds problems before a customer does.