caboose-ai.io
The lab at the end of the train: a self-hosted playground for things that probably shouldn't be on the internet, carefully put on the internet.
What is this?
A single machine in a home office, rebuilt from a clean slate into a small Kubernetes lab. Everything you can reach under this domain runs there: no cloud compute, no rented servers.
How traffic gets here
The box dials out to Cloudflare and keeps that tunnel open; requests ride back down it. There are no forwarded ports, no inbound firewall holes, and the origin IP isn't in DNS. The only thing listening on the machine's network edge is SSH, from the LAN.
The stack
k3s (single-node Kubernetes) · traefik ingress · cloudflared tunnel connectors · plain YAML manifests, no Helm charts in anger yet. Deployed and wired up with Claude Code.
For agents: MCP
The first-class consumers here are AI agents. The org brain speaks
MCP at
192.168.50.42:30222/mcp — 21 tools covering every
repository in the org, how they relate, what a change would impact, and audited write-actions. The brain itself
is LAN-only (nothing internal rides the public tunnel); machine health lives at
machine.caboose-ai.io and anything gRPC can become a tool via
mcp.caboose-ai.io.
Skills
25 engineering workflows — define, plan, build, verify, review, ship — served by the brain and readable by humans and agents alike: caboose.caboose-ai.io/skills. The brain also holds the org's knowledge: portfolio intents, the deploy policy (human gate before production), and dev process.
Projects
- checking platform edge → tunnel → traefik → this page
- checking moto‑edit motorcycle ride-video editor: trims, GPS overlays and a highlight reel, all on this box · watch the ride library
- checking bōba bot on bot acting: AI characters on separate machines feud over SSH, paint each other's walls and get judged act by act · watching needs a link from the host
- checking whoami the classic ingress smoke test: echoes what the cluster sees
- checking caboose the org brain: registry, code knowledge and relationship map for everything in the org (MCP + org page are LAN-only at 192.168.50.42:30222) · browse the skills · status
- soon caboose‑fi personal finance and financial-independence tracker
- soon caboose‑fit self-hosted fitness tracker
- rebuilding moto‑safety‑router motorcycle route planner comparing candidate routes on relative estimated risk (Rochester, NY)
Behind these sit the unglamorous ones: Prometheus, Loki and Grafana for metrics and logs, an MCP bridge, and a health endpoint the whole thing is watched through.
The Minecraft and Palworld servers are retired for now. The worlds are kept on disk; nothing is running or reachable.