jandresgarcia.dev
Rev. 2026.09
ENES

How JAG HQ works: one ARM server behind Tailscale, a keyboard-first Backstage control center, self-hosted CI, deploys only through jag-deploy, live logs and an agent workflow driven by Plane tickets and SDDs.

AN-03

JAG HQ The self-hosted platform where every product is built, deployed and run.

Private · tailnet only

Video 1. JAG HQ, product overview · 0:42

1 VPS

Every product, its CI runners, Plane and the control center on one Always Free ARM server, behind Tailscale.

How it works

Engineering notes

  • Backstage rebuilt as a keyboard-first control center: a ⌘K command palette, j/k navigation and seven windows for the wall, projects, host, logs, docs and tools.
  • Live ops from the source: logs streamed from Docker through a read-only socket proxy, host checks every 5 minutes, uptime monitors and daily restic backups.
  • Built for agents: skills, SDDs, handoffs and house rules live in the repo. Every change is a Plane ticket, one worktree per agent, merged only on green CI. Architecture diagrams are generated from the code with Archify.

Platform engineeringBackstageSelf-hosted CI/CDObservabilityAgent workflow

Backstage · Docker Compose · Caddy · Tailscale · Cloudflare Tunnel · Plane · GitHub Actions (self-hosted) · Uptime Kuma · restic · OCI ARM64

How a run works

  1. A change starts as a Plane ticket, moved to In Progress the moment work starts.
  2. An agent picks it up in its own worktree, following the repo's skills, SDD and house rules.
  3. It opens a pull request with the ticket key in the title.
  4. CI runs on self-hosted arm64 runners on the same server.
  5. Merge only on green CI. The merge triggers jag-deploy, the only way into production.
  6. It rebuilds and restarts only the affected product, with a rollback ready.
  7. Public traffic reaches EApply through the tunnel; everything else stays inside the tailnet.
  8. The deploy, host health and live logs show up on the wall, and the ticket moves to Done.

System components

ComponentWhat it does
Owner devicesOn the tailnetDeterministic codeLaptop and phone join the private tailnet over WireGuard. That is the only way into the server.
VisitorsPublic internetDeterministic codePublic users only ever reach EApply, the one public product.
GitHubRepos · PRs · ActionsDeterministic codePrivate repos for the platform, the control center and each product. Every PR carries its ticket key.
TailscalePrivate tailnetDeterministic codeSSH and every private panel are reachable only inside the tailnet; the host firewall drops everything else.
CloudflareDNS · TunnelDeterministic codeDNS and a Cloudflare Tunnel publish EApply without opening an inbound port on the server.
CaddyTLS · host routingDeterministic codeOne reverse proxy terminates TLS and routes each hostname to its service, with tailnet-only rules for private panels.
PlaneHQ · EAPP · CLARA ticketsDeterministic codeSelf-hosted project tracking. Ticket state moves in real time: In Progress on start, the PR linked on open, Done after merge and verification.
Agent workflowSkills · SDD · worktreesDeterministic codeSkills, SDDs, handoffs and house rules versioned in the repo, so any agent can pick up a ticket cold. One git worktree per agent.
CI runnersSelf-hosted · arm64Deterministic codeGitHub Actions runners live on the same server: native arm64 builds at no cost, with CPU and memory capped so a build never degrades production.
jag-deployOnly path to prod · rollbackDeterministic codeA single root-owned entrypoint deploys or rolls back one target at a time. Nothing reaches production by hand.
Backstage HQControl center · ⌘KDeterministic codeSeven keyboard-driven windows: the wall, projects, host health, live logs, docs with architecture, project conformance and the tools inventory.
EApplyPublic productDeterministic codeFrontend, API, workers and a render service as their own Compose project, published through the tunnel.
ClaraTailnet onlyDeterministic codeA single container with its own SQLite, reachable only from the owner's devices.
Host healthChecks every 5 minDeterministic codeDisk, containers, runners, memory, load and certificates checked every 5 minutes, plus uptime monitors and alerts.
Own dataPostgres · MinIO · RedisDataDatabases and object storage run on the same host, no managed services.
Backupsrestic · dailyDataDaily restic backups to Oracle Object Storage.
Central secretsSOPS · agePlannedNext: encrypted secrets in the repo with SOPS and age. Planned, not built yet.

Availability

Open to senior AI Engineer and Fullstack roles, and to AI product builds for founders.

Download CV (PDF)EmailLinkedInGitHub